Mullvad has partnered with Obscura VPN

[ignoramous]

@obscuracarl

It is only “static” until the next key rotation, which we do every 30 days

… @jonah brought this up to me originally … and it inspired us to add the Rotate WireGuard key

Key rotation, no matter how frequent, does nothing to address the fact that Mullvad has a static identifier on the client? As long as this remains the case, I don’t see how Obscura’s different than Mullvad’s multi-hop (which costs ~60% less?); especially, when there’s more than one way to purchase Mullvad VPN anonymously.

Besides, I don’t think key rotation will be as seamless (if possible at all) with exported WireGuard configuration for use with 3p clients? So, that’s another foot gun, too. If Obscura doesn’t already, it could warn users that they shouldn’t really use 3p WireGuard clients, unless absolutely necessary.

@jonah

In #1: I feel like this is where we disagree, because the entry’s mere knowledge of the exit node’s identity alone does not seem like sensitive information

Even if the entry node knows your payment information, and knows what exit account you are using, what compromise has taken place?

Hm… when the examples are Phreeli and T-Mobile & not VPN companies, I guess it is easier to grok?

@jonah

Increased separation between T-Mobile and Phreeli is what is missing in the current implementation, and if more zero-knowledge proofs are used in that context, that has no bearing on the fact that T-Mobile is directly getting your IMEI when you connect to their towers.