I think Mullvad is doing some great work towards advancing the privacy for their users! As for DAITA - we looked at it when they announced it. Looking at the code, they implemented the addition of cover traffic with the Maybenot framework. Doing a bit of a deeper dive back then showed that they used four different state machines, but in all cases, the cover traffic patterns were quite predictable and could be easily filtered out with simple traffic analysis. I haven’t checked recently, so I can’t say whether they’ve improved it, but back then, it was doing very little to hinder traffic analysis. And also it wasn’t by default - you have to enable it in settings.
Regarding the independent operators model with Obscura: I think it is a very nice step towards decentralisation that Mullvad partnered with Obscura, as otherwise Mullvad’s 2-hop mode wasn’t really decentralised because they control all the nodes. Pairing with Obscura adds a bit of decentralisation indeed, as in theory you’re routing traffic through 1 node controlled by Obscura and 1 controlled by Mullvad.
Hence, the claim here is that ObscuraVPN cannot decrypt your traffic, and Mullvad’s servers cannot see your original IP address - and cannot correlate your IP with your activities. This is true under the assumption that the two services do not collude—which, of course at this point, is based on a pinky promise as those two companies already collaborate ![]()
Also, worth noting is that since the Obscura app encrypts traffic using WireGuard for the Mullvad exit server before sending it over QUIC to the Obscura entry node, there is no separate WireGuard tunnel between the Obscura app and the Obscura entry server (at least that’s my understanding of their design). This setup requires the client to be aware of both ObscuraVPN and Mullvad’s servers. Specifically, my device must know the public WireGuard key and endpoint of the Mullvad exit server before it can establish a connection. Because my WireGuard session is end-to-end encrypted between my device and Mullvad’s exit node, Mullvad does see my WireGuard public key. If I reuse the same key across multiple sessions, Mullvad could track my activity by associating different connections with the same key. I’m not sure they rotate the long-term public-private WireGuard key pairs between sessions.