The virtual private network industry runs on a simple, foundational promise. Pick almost any commercial provider on the market, and the pitch remains remarkably consistent: "We don’t keep logs." When users subscribe, they hand over their entire internet connection to a private entity and receive, in return, a reassurance that no persistent records of their browsing activity are being written down or stored.
For a growing segment of privacy-minded individuals, however, that promise stopped being sufficient some time ago. Cybersecurity experts increasingly argue that a strict no-logs policy is only as honest as the company making it. Even an honest company can be targeted by sophisticated hackers, compelled by legal subpoenas, or quietly acquired by larger corporate conglomerates with entirely different incentives.
Obscura VPN has emerged to challenge that traditional framework. Instead of asking consumers to trust its corporate word, the service splits the operational workload across two completely independent companies. Under this architecture, neither provider possesses the data necessary to tie a user’s real-world identity to their browsing activity. The first hop of the connection is handled by Obscura’s own infrastructure, while the exit hop is managed by Mullvad, a widely respected privacy-focused VPN provider based in Sweden. Traffic is end-to-end encrypted using Mullvad’s keys, meaning Obscura cannot read the data passing through its servers, while Mullvad never sees the identity or connecting IP address of the user.
The driving force behind Obscura is Carl Dong, a former top-five contributor to Bitcoin Core who describes himself on his website as a "head-janitor" and someone who "fights for the users." In a wide-ranging discussion, Dong explained the philosophy, engineering, and economic realities driving this new approach to internet privacy.
From Bitcoin Core to Rebuilding the VPN Industry
Reflecting on his transition from core cryptocurrency development to founding a privacy startup, Dong pointed to the fundamental tenets of the cypherpunk movement that shaped his early career.
"Don’t Trust, Verify" serves as a foundational cornerstone of those principles, according to Dong. He views trust minimization as crucial when building human-centric technologies where security and privacy are paramount. Yet, he notes, the commercial VPN industry has long been plagued by corporate scandals, broken promises, and unverifiable claims.
When Dong observed how Apple’s iCloud Private Relay operated under the hood, he recognized a blueprint for the next generation of virtual private networks—services that are verifiably private and capable of bypassing strict internet censorship. He wanted to bring that capability outside of Apple’s walled ecosystem, arguing that the market does not need another conventional provider, but rather a completely reimagined approach to digital privacy.
Why the Traditional No-Logs Model Has Failed
Dong’s entire pitch takes direct aim at the traditional no-logs model relied upon by the vast majority of the VPN industry. He argues that the sector is living in the past, dominated by a handful of large conglomerates that create an illusion of choice while routinely betraying user trust and utilizing media cut-outs to push marketing narratives.
The traditional pinky-promise of data deletion has never been adequate for software capable of intercepting the entirety of a user’s internet traffic, Dong contends. Furthermore, that model verifiably approaches obsolescence in an era where large language model-driven cyberattacks run rampant.
At the end of the day, Dong emphasizes, even honest VPN providers operating in good faith can suffer security breaches. As users become increasingly aware of these vulnerabilities, the cybersecurity community has seen rising calls to abandon conventional VPNs altogether. Obscura is positioned as a direct answer to that dilemma, allowing individuals to browse without placing blind faith in any single corporate entity.
How the Two-Party Relay Changes the Trust Model
To understand the structural difference, it helps to examine how traditional services operate. When a user connects to a standard VPN, a single company sees both their real-world identity—established via their connecting IP address and payment details—and their actual internet traffic. Even utilizing a multi-hop option within the same provider does not alter the fundamental risk profile, often serving only to add unnecessary network latency.
Obscura’s Two-Party Relay introduces a different dynamic by utilizing an independent company, Mullvad, as the second exit hop, while Obscura acts exclusively as the first entry hop. All internet traffic is encrypted using keys controlled strictly by Mullvad’s servers and is merely relayed through Obscura’s infrastructure. Consequently, Obscura’s relay servers never observe the contents of the user’s internet traffic, while Mullvad’s exit nodes never see the user’s identifying connection data or payment information.
For those familiar with the Tor network, Dong compares the architecture to a streamlined, two-hop circuit designed specifically for high performance, maximum speed, and daily reliability.
Addressing Skepticism Around Split Trust
A common critique of split-architecture networks is that they simply shift the trust problem rather than solving it, forcing users to place faith in two companies instead of one while leaving open the theoretical possibility of collusion or coordinated legal compulsion.
Responding to these concerns, Dong points out that using a traditional VPN inherently moves trust from a potentially regulated internet service provider to a single, entirely unregulated private company. The overarching goal with Obscura, he explains, is to ensure that no single party possesses the capability to compromise a user’s internet privacy.
As long as either Obscura or Mullvad remains uncompromised and independent, no entity can correlate a personal identity with online activity. Dong argues this posture is strictly superior to trusting either an ISP or the unverified assurances of a conventional single-provider VPN.
Engineering for Stealth and Censorship Resistance
On a technical level, Obscura’s stealth protocol is built directly upon the QUIC transport protocol to mimic standard HTTP/3 web traffic. Dong explains that QUIC was selected not only because its traffic patterns resemble common web browsing, but specifically because its Unreliable Datagram extension successfully avoids the TCP-over-TCP meltdown problem that historically plagues TCP-based virtual private networks.
When confronting serious internet censorship, QUIC presents significant obstacles for middleboxes attempting Deep Packet Inspection. The protocol allows messages to be fragmented and shuffled across multiple UDP datagrams, forcing censorship systems to perform complex real-time reassembly—a computationally costly task that few deployed censorship frameworks currently handle.
The Limits of Anonymity and Toxic Data
Obscura accepts privacy-centric payment methods including Monero and Bitcoin over the Lightning Network, requires no email address during signup, and authenticates users via a random account number. However, the service must still process the user’s connecting IP address at the entry point.
Addressing this limitation, Dong describes consumer data as "toxic waste" that the company actively avoids collecting whenever possible. Aside from standard connection handling, the platform’s website remains accessible over the Tor network.
Acknowledging that the connecting IP address remains visible to the entry server, Dong notes that this fundamental reality of networking will not change unless humanity completely redesigns the OSI network stack. The core point of Obscura’s architecture, however, is that since the entry server must observe that initial connection data, the most secure approach is to completely decouple it from the user’s actual internet traffic downstream.
Reproducible Builds and Economic Sustainability
Reflecting his background with Bitcoin Core, Dong places heavy emphasis on open-sourcing the client application and utilizing reproducible builds. For non-developers, reproducible builds ensure that the application binary downloaded by a user strictly corresponds to the verified source code published publicly on GitHub. In security-critical software like a VPN—which possesses deep visibility into a user’s data stream—verifiable builds protect against malicious tampering during distribution.
Priced at $8 per month, Obscura operates as a small, independent team of six remote contributors without pressure from venture capital firms to aggressively monetize user data. By keeping overhead low, avoiding expensive data center buildouts, and charging transparent subscription fees, the team aims to build a sustainable business model centered purely on customer satisfaction rather than rapid, venture-backed expansion.
Whether Obscura’s split-trust model appeals to individual privacy requirements remains a personal choice, but the architecture represents a distinct alternative to conventional industry practices. With open-source client software, users are empowered to read the code, verify exit hop keys against Mullvad’s published lists, and independently validate the security guarantees underpinning the network.
Leave a Reply