Comment by lapcat

2 years ago

VPN:

> As a result, users must rely on their provider’s pinky-promise that none of their data is logged. Yet even a provider that keeps true to its promise can suffer a security breach and be compromised.

2-Party Relay:

> This splits “who you are” from “what you do”, meaning neither party can tie your identity to your browsing.

Ok, but... don't users have to reply on their provider’s pinky-promise that the two parties won't cooperate with each other and share their separate data, thereby connecting the dots? After all, the two parties are already cooperating to an extent, so why can't they cooperate even more, either voluntarily or at the command of some hostile government?

16 comments

lapcat

Reply
dongcarl  2 years ago

In the extreme case that Obscura and Mullvad are forced to cooperate, you're right that this is the case. However, this is strictly (and much) less likely than a _single_ party being pressured or even a single party's infrastructure being hacked.

Another important thing to note: in our App, you can check your connected server’s public key against those listed on Mullvad’s server page, since we use the same servers as Mullvad's normal ones. It would be unheard of for a VPN provider (let alone a trustworthy one like Mullvad) to give their WireGuard private keys to a new partner.

  • ignoramous  2 years ago

    > less likely than a _single_ party being pressured or even a single party's infrastructure being hacked.

    Since Obscura uses a custom QUIC-based (?) protocol, you'd need to use their custom made (open core) app to pay & register with both Obscura & Mullvad. That means, all your apples are in their app-basket, which is built entirely by a single-party?

    Private Relay, otoh, seems like a 3 party setup (Apple, Cloudflare, Akamai)?

    See also: https://news.ycombinator.com/item?id=43017140

    • dongcarl  2 years ago

      Perhaps my answer [here](> The client software is here: https://github.com/Sovereign-Engineering/obscuravpn-client, we also plan to make reproducible builds of our apps. In fact, I previously led the effort to revamp Bitcoin Core’s reproducible builds system to be [bootstrappable](https://bootstrappable.org/), work that is [referenced by the Tor project](

      kfreds  2 years ago

      > Ok, but... don't users have to reply [rely] on their provider’s pinky-promise that the two parties won't cooperate with each other and share their separate data, thereby connecting the dots? >

      Yes. On the other hand, it does complicate things for the attacker, whether it is internal (the orgs) or external - a 3rd party attacker would have to compromise both orgs instead of one.

      > After all, the two parties are already cooperating to an extent, so why can't they cooperate even more, either voluntarily or at the command of some hostile government?

      Voluntarily: If you look at the business incentives that wouldn't make a lot of sense.

      Forced by government: Here I'd say look at the jurisdictions of the orgs.

      (disclosure: I'm one of the founders of Mullvad)

      • ignoramous  2 years ago

        > Here I'd say look at the jurisdictions of the orgs.

        Per Covert Surveillance Act passed in 2020, looks like Sweden (where Mullvad is based) can ask communication providers / website services to secretly add or assist with backdoors?

          ... Where the identity of the suspect is not known, but his contacts are known, or a third party (such as a website which the suspects visits) is known, one can permit secret data reading of these contacts, or the third party, but only in order to identify the suspect. Only (stored) historical metadata, not real-time data or communications and not by means of activation of audio or video surveillance functions can be used for this (section 4b).

        https://www.venice.coe.int/files/Spyware/SWE-E.htm / https://archive.vn/LgE7a

      remram  2 years ago

      Well they do cooperate with each other. They are partners, working together to provide the service, and sharing the cost. But you have to trust that if they are trying to attack you, they do it separately...?

      Ridiculous, as you point out this doesn't increase my trust at all.

      leishman  2 years ago

      There is no perfect solution, but I would argue that a blind relay is very clearly strictly better than the alternative.