dongcarl

5 ms·

1.
Reverse Engineering Google's Proprietary Hypervisor(alexhulbert.com)
2 points by dongcarl 2mo ago|0 comments
2.
by dongcarl 3mo ago
Appreciate the shoutout! :-)
3.
by dongcarl 3mo ago
Thanks for the shoutout!
4.
Cloudflare, Chrome, Firefox Developing Next-Gen Privacy Pass: PACTs(theregister.com)
10 points by dongcarl 3mo ago|1 comments
5.
by dongcarl 4mo ago
Heh yeah we just check for a Mullvad exit IP, it's one way you know we're actually relaying to Mullvad!
6.
by dongcarl 4mo ago
Carl here (Obscura CEO, one of Mullvad's partners) This was an interesting finding, though as kfreds mentioned it would have been better to notify the vendor before publishing. The main finding (IP-position-in-pool correlation between
7.
Cursed Knowledge(obscura.net)
5 points by dongcarl 7mo ago|0 comments
8.
by dongcarl 11mo ago
> should Chat Control not pass Unfortunately in the world we live in no single jurisdiction is good enough anymore, laws can always change and Chat Control can be re-proposed over and over again. Luckily, an MPR like Obscura with hops ac
9.
by dongcarl 11mo ago
We've had many reports that it works. In fact, one of our users told us he took an hour video call over Obscura in China and things worked smoothly! Unfortunately, because we don't identify users we cannot offer a free tier (since
10.
by dongcarl 11mo ago
You could probably implement a pluggable transport for it?
11.
by dongcarl 11mo ago
Ah that's excellent! Do you have a link to the thesis?
12.
by dongcarl 1y ago
Yes, you can with Obscura. That limitation of Private Relay is just an arbitrary limitation made by Apple.
13.
by dongcarl 1y ago
We should really be moving towards a world of Multi-Party Relays rather than Single-Party VPN operators: https://www.privacyguides.org/articles/2024/11/17/where-are-... With Multi-Party Relays you no lon
14.
by dongcarl 1y ago
Actually, they don’t need to do a reverse lookup at all. They can just look at the TLS SNI field and the hostname is there in plaintext. It’s _more_ trouble to do the reverse lookup.
15.
by dongcarl 1y ago
If you can't see your VPN's source code, you can almost safely assume that they're broken in some way.
16.
by dongcarl 1y ago
It's trusting A OR B, rather than A AND B
17.
by dongcarl 1y ago
Yup, when you're not using a VPN, even with encrypted DNS and HTTPS, you're still sending hostnames (e.g. wikileaks.org) over plaintext in TLS SNI for every HTTPS connection. I believe most firewall appliances now even prefer to u
18.
by dongcarl 1y ago
I'm surprised no one has mentioned iCloud Relay-style Multi-Party Relays yet: https://www.privacyguides.org/articles/2024/11/17/where-are-... It greatly improves on the existing VPN trust model by s
19.
by dongcarl 1y ago
We're working on it! Android is next :-)
20.
by dongcarl 1y ago
We should link it in more places, apologies! Here it is: https://github.com/Sovereign-Engineering/obscuravpn-client
21.
by dongcarl 1y ago
Very possible, though many of our users are saying that in network environments where WireGuard is blocked they were able to use Obscura.
22.
by dongcarl 1y ago
Give Obscura a try, we get around internet restrictions by using QUIC as transport, which looks like HTTP/3 and doesn't suffer from TCP-over-TCP meltdown: https://obscura.net/ Technical details: https:/&#x2F
23.
by dongcarl 1y ago
I actually spent a few months prototyping SGX/SEV VPNs before settling on a Multi-Party Relay scheme for obscura.net Things may have changed since mid-2023 but here were my takeaways: ----- Re: Vendor lock-in Vendor lock-in is (was?) a
24.
by dongcarl 1y ago
At Obscura we just tunnel WireGuard over QUIC's unreliable datagram mechanism to make it look like HTTP/3 (for DPI): https://github.com/Sovereign-Engineering/obscuravpn-client/b... We just upstreamed our
25.
by dongcarl 1y ago
I think he's just talking about using Mullvad's [DNS servers]( https://mullvad.net/en/help/dns-over-https-and-dns-over-tls ), which work in most cases.
26.
by dongcarl 1y ago
You may want to try using a generic WireGuard client (e.g. `wg-quick`) rather than Mullvad's client, you can generate a WireGuard config on Mullvad's website.
27.
by dongcarl 1y ago
> On another note: I wonder how many of those VPN services are actually fronts of intelligence services. This is why we need more [MPRs]( https://www.privacyguides.org/articles/2024/11/17/where-are-...
28.
by dongcarl 1y ago
TIL!
29.
by dongcarl 1y ago
Some roaming SIM cards aren't restricted by the Great Firewall, but in general, yes you'd need a VPN.
30.
by dongcarl 2y ago
(Carl from Obscura here) 1) Here's what [one of our FAQ entries]( https://obscura.net/#faq-trust ) say: > Additionally, our app displays your current exit hop’s WireGuard public key on its “Location” page. You can che

More ›