Obscura launches two-hop VPN designed so it can't see user traffic
A new VPN service claims architectural impossibility of logging by splitting identity and activity across separate operators.
What to know
- Obscura claims architectural impossibility of logging by splitting identity (visible to Obscura) from traffic (visible only to Mullvad exit servers), accepting only randomized account numbers and cryptocurrency.
- The two-hop relay design is not novel; technologists note similarities to Apple's iCloud Private Relay and decades of prior multi-hop systems, raising questions about competitive differentiation.
- Key technical and trust concerns remain unresolved: whether the architecture actually prevents collusion between operators, whether QUIC obfuscation is effective against sophisticated censors, and whether cryptocurrency payment claims hold up against modern chain analysis.
- Community consensus leans skeptical on whether Obscura offers meaningful privacy advantages over the more mature Mullvad (its partner), which is already open-source and operates the same exit infrastructure.
The dispute Whether the split-relay architecture actually prevents collusion between Obscura and Mullvad if both were compelled to cooperate, and whether it meaningfully improves on Mullvad alone. · positions read across 27 posts and comments
The design is sound in principle but not novel; users should just use Mullvad directly.
-
“I don't understand the point of this. Many (if not all) of the benefits on the landing page are available in Mullvad too, which is a more mature and reputable product.”
maxloh · Hacker News ↗
The Mullvad partnership and no-email signup are positive signals, but trust concerns exist around US jurisdiction.
-
“it is worth noting the official partnership with mullvad which is certainly a positive signal”
john_strinlai · Hacker News ↗
Cryptocurrency payment privacy claims are misleading given modern chain analysis capabilities.
-
“No-KYC cryptocurrency is largely a thing of the past, and outfits like Chainanalysis can associate a Lightning or Monero address to a human with near-perfect accuracy. The fact that Obscura's FAQ doesn't acknowledge this makes me feel like…”
MassPikeMike · Hacker News ↗
Obscura VPN service providerMullvad Exit hop operator and privacy-focused VPN partnerdongcarl Obscura team member
How it unfolded 5 developments, newest first · click a bar or a number to jump postscomments
-
5
Technical questions raised about exit hop anonymity
Commenters asked how the exit server can route traffic without knowing the connecting IP address, and whether the architecture actually prevents both operators from correlating data if they cooperate.
“How is this possible? If the exit server doesn't know your IP, how does it know where to send the traffic?”
— Wowfunhappy -
I hate to be the one to throw stones at an outfit that is trying to do something good, protecting people's privacy.But the claim in Obscura's FAQ that paying with Bitcoin or Monero offers more privacy than paying with a credit card is sadly misguided. No-KYC cryptocurrency is largely a thing of the past, and outfits like Chainanalysis can…
2 more of the top 3 · 10 posts in this stretch
-
With a name like this, I’m reminded that privacy is only as good as your entry node being used widely/not being too “obscure.”https://www.wnycstudios.org/podcasts/otm/articles/harvard-bo... is a good example: because the person making the threat was one of the few people on the campus network using Tor at the time the threatening emails were sent…
-
It would be cool if there were a way to use it the other way around. A Mullvad server as the entry point and an Obscura server as the exit point. My main problem with Mullvad right now is that its servers are blocked almost everywhere or generate an excessive number of Captchas. With other VPNs, that’s been much less of an issue so far…
-
-
4
Skepticism over cryptocurrency payment privacy claims
MassPikeMike raised concerns that Obscura's marketing of Bitcoin Lightning and Monero as privacy-superior to credit cards is outdated, noting that chain analysis firms can now associate cryptocurrency addresses to individuals with high accuracy.
“No-KYC cryptocurrency is largely a thing of the past, and outfits like Chainanalysis can associate a Lightning or Monero address to a human with near-perfect accuracy.”
— MassPikeMike -
I hope MPTCP would be more popularMany src-dst connections but as a single logical connection. There's no way any middlebox could easy capture full data even metadata.http2/QUIC can do something similar with frames (and hopefully multipath)Don't place your whole stream inside a single src-dst IP connection. Demux them into many paths over the…
1 more of the top 2 · 2 posts in this stretch
-
Discussed (just a bit) at the time:The Decoupling Principle: A Practical Privacy Framework [pdf] - https://news.ycombinator.com/item?id=33897450 - Dec 2022 (3 comments)Perhaps we should arrange a new thread about this?
-
-
3
Obscura co-founder clarifies multi-party relay architecture
In response to comparisons with Mullvad, dongcarl (an Obscura team member) explained the distinction as a Multi-Party Relays system where no single entity can be trusted to remain uncompromised, contrasting with traditional single-party VPNs.
“We're a Multi-*Party* Relays (vs. traditional VPNs which are Single-Party Relays)… With Multi-Party Relays you no longer have a trust a single entity not being malicious or compromised.”
— dongcarl -
We think Mullvad is a great privacy tool, which is why we partnered with them!As for what's different: We're a Multi-*Party* Relays (vs. traditional VPNs which are Single-Party Relays): https://www.privacyguides.org/articles/2024/11/17/where-are-...With Multi-Party Relays you no longer have a trust a single entity not being malicious or…
2 more of the top 3 · 9 posts in this stretch
-
As others have pointed out, this is like Apple iCloud Private Relay, and other multi-hop privacy systems that have been built on and off over the last several decades (Tor included).We wrote a research paper on the general principle a few years ago:
-
> the first VPN that can’t log your activity and outsmarts internet censorship.I guess they never heard of Zero Knowledge Systems:
-
-
2
Community questions the novelty and trust model
Hacker News commenters noted that the two-hop relay design resembles Apple's iCloud Private Relay and prior multi-hop systems, and questioned why users should trust a US-based company over the Swedish Mullvad partner.
“This is like Apple iCloud Private Relay, and other multi-hop privacy systems that have been built on and off over the last several decades.”
— barathr -
Mullvad is a Swedish company, which has stricter privacy protection laws in place.According to Obscura's legal page, it is a New York-based company [0]. Under US law, a secretive court order could compel a US company to update software or implement targeted logging on a specific user without notifying that user.The only scenario where Obscura…
2 more of the top 3 · 6 posts in this stretch
-
i am very skeptical of most vpn companies, and while i haven't looked too hard at obscura, it is worth noting the official partnership with mullvad (https://mullvad.net/en/blog/mullvad-partnered-with-obscura-v...) which is certainly a positive signalside note: i really wish more companies did the no email + randomized account number flow. there is…
-
This sounds pretty neat, and I do dig the website, though I can’t help but think it’s an odd combination to have bitmap/pixelated fonts and graphics inside perfect squircles.Seems like you guys have two distinct ideas of a visual identity completely at odds there. Shape contrast is nice and can be rather fun to play with, but it has to be handled…
-
-
1
Obscura launches multi-hop VPN with claimed logging impossibility
Obscura announced a VPN service using a split-relay architecture where Obscura's servers cannot decrypt user traffic and Mullvad exit servers cannot see user identity. The service requires only a randomized account number, accepts Bitcoin Lightning and Monero, and uses QUIC-based obfuscation to evade network filters.
“Obscura is built such that we can't see your traffic in the first place.”
— Obscura
What people are saying 13 voices from 1 site · best of 27 · verbatim
- If the exit server doesn't know the user's IP, how does it route traffic back to them?
- Can Obscura and Mullvad simply correlate their respective logs on demand to defeat the architectural separation?
- Is QUIC-based obfuscation actually effective against sophisticated state-level censors?
- Yesterday
-
Is there anything like a generalised protocol which would allow network-privacy seekers to decide each hop? Apple iCloud+ Private Relay (2021), INVISV Relay (2022), Obscura VPN (2025, first of its kind) and so on are OK, but it would be nice if the user/customer could choose any two providers that didn't have business relationships with each other…
-
Looks similar to Anonymized DNS, which DNS users have been using for more than seven years:
-
That's really cool, but perhaps a bit overkill for the typical no-log quick access variant, so shameless plug here even if it primarily is for autonomous agents.
-
i'd like to see some more info about the quic as obfuscation claim. imo this isn't really useful for people living in countries with restrictive firewalls. quic is blocked or throttled quite easily.
- Sep 22
-
Any vpn company who market itself as aiming for the anonymity of its user is essentially selling snake oil to its customers. The fact that this company pretends to be more respective of the privacy of its user because it is in America is a vast joke, companies in America are expect to collaborate with the security services, even monopolies don't…
-
> Exit servers (run by Mullvad) connect you to the internet but never see your personal info. Obscura masks your real IP address when relaying to the exit server.How is this possible? If the exit server doesn't know your IP, how does it know where to send the traffic?
-
Great signup flow, except there’s an error when it comes to installing the app at the end. Worked around by installing manually via app store
-
https://obscura.com/check/ does this page know the difference between a direct mullvad user and an obscura user, if so, how?Packet padding but no docs about this?
-
Because its CEO is known as the sponsor of the Orebro party?1.5k comments discussion for context:
-
https://news.ycombinator.com/item?id=48696800This is where part of your money flows to (I have opinions about this).Not sure if you are also aware of it.
-
So two hops, basically. First hop sees your IP address but not the website you're going to, second hop sees website but not IP address. Similar to Private Relay:
-
How does this prove Obscura and Mullvad can't just both gather tracking data and then just combine it on demand?
-
I don't understand the point of this.Many (if not all) of the benefits on the landing page are available in Mullvad too, which is a more mature and reputable product, has all clients fully open-source, and powers the exit servers for Obscura.Why should I choose this over Mullvad?