The only “PII” that’s hidden away from Mullvad is the client IP?[1] If not, what else?
In fact, Obscura is able to leverage (?) Mullvad’s existing design for WireGuard multi-hop[2] as-is precisely because Mullvad categorically knows who the client is (across all sessions), even if it can’t see the IP. I did point this out before; but I’m also not sure if Cure53 cleared any such concern in its audit of Obscura’s two-party protocol: Mullvad has partnered with Obscura VPN - #216 by ignoramous
Mullvad accepts payments without needing KYC, already; so, the two-party system here is only shiting merchant of record from one entity based in Sweden to another based in the US, which has
worser consumer protection laws per this analysis. ↩︎Where only the “Peer Endpoint” is changed to point to the desired entry location, while the “Peer Identity”, is exit location’s public key. ↩︎