We haven’t implemented a feature like Privacy Pass into Obscura yet, but we’re definitely open to adding it. I’ll make sure to note this down and message you directly when it releases
Right now the most private ways to pay is with a prepaid card, a masked card, Bitcoin Lightning or Monero
We looked into adding Obscura to AppVerifier, but they’re not currently accepting submissions. The hash for the non-Google Play release of Obscura (the apk found on our GitHub) is:
Your intuition is right. Some of the popular public VPNs are high-marginsnake oil businesses. Even if you’re paying $2/mo (like for PrivateInternetAccess or SurfShark), that’s likely at 70%+ profit margin for them (even with multi-hop, adblock, and other bells & whistles). It is for nothing that VPN subscriptions are notoriously hard to cancel. And, I run a VPN service myself (but not with UI dark patterns, not yet)!
What you’re paying for is mostly the value you derive from using it (which may be pays for the said VPN provider’s marketing budget). If you know multi-party relay setup covers your threat-model (or worse, their marketing copy has you convinced it does), then well, Obscura (and may be Nym, too) is one of few MPRs around that seem super serious about what they’re doing.
One issue is likely that Obscura is located in the US, which would seem to not meet one of the “Minimum to Qualify” points in the “Trust” section for VPNs.
“Company based in a jurisdiction where it cannot be forced to do secret logging.”
However, that brings up the question of whether that is still a reasonable requirement or whether any of the recommended VPNs still meet that requirement. I don’t closely follow national privacy laws, but I know a bunch of restrictive laws have recently passed in the EU and Europe. Do Sweden and Switzerland still meet this requirement? Gibraltar? I’m curious to know if anyone has concrete knowledge of this, and if those jurisdictions no longer met the requirement, we should consider revising the requirements and/or adding a note to the VPN section that VPNs are definitely not protection against nation state threat models.
Would ProxyStore need a permit from the giftcard issuer to resell them?
I tohught that if there is to special clause that prohibits reselling, you can just buy and resell giftcards if you want to do so.
Currently, Proton does not sell their gift cards in the Proxy Store. They can only be bought directly from them, and it’s not anonymous. That is a problem.
In theory, there is nothing stopping the Proxy Store, from buying gift cards on Proton’s website and reselling them anonymously on theirs. However, that is not how the Proxy Store operates. They always seek permission from the companies whose gift cards they sell. They have an agreement. The Proxy Store doesn’t want to sell gift cards without their permission.
Also, if they did, I suspect that Proton and other companies would have the power to block the use of those gift cards, which would damage the reputation of the Proxy Store.
My question was aimed at this scenario, so is there something in Proton ToS that prohibits it to resell giftcards?
Why should you have such a clause, what would be that advantage?
As far as I know, there is nothing in Proton’s ToS that prohibits the reselling of their gift cards without asking for permission first. But the fact that Proton doesn’t want to sell their gift cards in the Proxy Store, after I have asked them multiple times, suggests to me that Proton has some reservations about anonymous payments.
This would explain why there are limitations to their Proxy Store vouchers, and why they don’t allow their gift cards to be bought with cash or Monero. Or why they require you to declare your username if you want to buy a subscription from them with cash.
The way I see it, Proton is afraid that that completely anonymous payments could damage their reputation, but they are not being completely forthright about it to the public, which is what bothers me.
I understand the Proxy Store wanting to have an agreement with all the companies whose services they sell. What I don’t understand is why a lot of privacy services like Proton have yet to accept direct anonymous payments or sell gift cards to resellers like the Proxy store who access them.
Is this the case of Obscura too?
I have noticed that MEGA has started to become more active on social media in promoting privacy. By this I mean that they comment on news stories and the failures of Big Tech like Proton and Tuta do.
MEGA used to sell gift cards via resellers, but they could not be bought anonymously, and the resellers were not popular and respected services. They seemed a little bit dodgy. They’re not the kinds of services I would trust with my real credit card number. Plus the gift cards had a significant mark up. Like a €30 MEGA gift card would cost between €35 and €40.
If I had a store that sells digitals services, I don’ see a reason why I wouldn’t just allow everyone to buy and resell my giftcards if they want to do so.
I would even offer discounts for big batches of codes to incentive this.
From a business perspective, being listed on sites like ProxyStore, seems like free/cheap marketing.
I don’t know that it’s free marketing, but you make a valid point. I cannot speak for other companies, but based on my exchanges with Proton, they have reservations about supporting anonymouss payments, even if they claim to support it. From what I can tell they are afraid of being linked to crime, that that it could in turn damage their reputation.
Yes, but my impression is that Proton feels they are too notorious to fully implement anonymous payments because it would draw too much unwanted attention to them. Not only would it likely be discussed in major tech news outlets, but they likely also believe that powerful organizations, including governments, could retaliate.
This is why they should have implemented anonymous payments from the start and stopped linking credit cards to accounts, like Posteo does. At the end of the day, if privacy is one of your core values, you should fully support anonymous payments. If I was Tuta, I would use this angle to position myself as a better alternative to Proton. Same for all the other privacy services that already accept anonymous payments.
Obscura has this same issue on their payments page that Nym has (Nym has promised to fix it). Stripe’s telemetry are loaded even when you just want to pay with Crypto
Mullvad, IVPN, and Proton all have it solved. On the main payments page as well as crypto selection, no additional third parties are contacted, and the credit card option does connect to the payment processor.
Proton even somehow doesn’t load telemetry for their initial credit card selection (I haven’t tested past it).
Could you let me know how you’re seeing this? I just did a quick test and we don’t seem to load the Stripe things if you don’t choose Credit Card: https://youtu.be/QKc-vTuH8yM
We were recently looking through the VPN Criteria on the site and realized we could do better with the precision of our wording.
In our most recent update (v1.181), we changed the wording while Obscura is not connected from Traffic is vulnerable → Obscura not connected to be more objective
