We also have a criteria under the “Trust” heading that reads, “Company based in a jurisdiction where it cannot be forced to do secret logging.” This is by far a more important criteria.
Since Obscura is located in the US, a country that can and does force companies to log data under gag order, I’m curious what defenses and commitments your company has to prevent that scenario or to protect users if that were to happen.
Are you prepared to shut down your service if that were to happen? I know you claim you architecture would not allow such a situation, but to me it seems trivial for the US government to force a backdoor into your clients and/or servers.
This is the biggest issue we currently face against even considering recommending Obscura in my opinion.
Are you also considering changing the wording of Obscuras claim that it is the “first VPN that can’tlog your activity”?
Considering Privacy Guides marketing criteria against 100% claims. It seems to me, the claim is stronger than what the architecture actually guarantees.
Related to what @anon64387538 points out, under a US gag order the no-logging commitment is legally defeasible, and a compelled change to the client or the exit-key distribution could turn that “can’t” into a “can.”
I’m not arguing with you, they might not be the first. But could you give at least 1 example of someone else who really can’t log your activity, please?
In Obscura your traffic is encrypted in such way that Obscura knows who you are, obviously as you’re connected to them, but it’s Mullvad VPN (Exit nodes) that handles your traffic, without knowing you. There is separation
I think you’re focusing on the wrong part of the quote. I am objecting to Obscura claiming they can’t log your activity. What’s cryptographically guaranteed is that the first hop can’t see or log your traffic content. But the first hop still unavoidably sees connection metadata: connecting IP, account number, connection timestamps, bytes transferred, exit chosen, and timing/size patterns. Choosing not to log the IP is a policy commitment, not an architectural impossibility, so “can’t log your activity” reads as broader than what’s provable.
The separation is real. No single party can correlate who you are with what you do. That is genuinely true, and it is the real architectural guarantee.
From what I can tell, the exit’s key is vended by the same first hop, and the client trusts it as is. Obscura’s API is also what registers the client’s key with Mullvad.
“the real architectural guarantee” is probably too strong a phrase. The separation is real, but the honesty of that one channel is an assumption.