Obscura VPN splits trust with Mullvad so it can't decrypt your traffic

Obscura is a VPN built around a two-party design that aims to make logging structurally impossible rather than a policy promise. Conventional “no-logs” VPNs still see both who you are and what you do, forcing users to trust that the provider won’t retain or hand over that data. Obscura instead relays a WireGuard tunnel over QUIC to an independent exit provider (currently Mullvad): its own servers only see your IP and perform NAT, and they can’t decrypt the WireGuard packets because those are encrypted to Mullvad’s public key. Mullvad, in turn, terminates the traffic but never learns your originating IP. No single hop holds both halves of the identity-plus-activity correlation, which is a stronger guarantee than a single provider’s multihop feature, where one operator controls every hop.

The QUIC transport does double duty: it makes connections resemble ordinary HTTP/3 traffic to slip past censorship and network filters, and its unreliable-datagram mode sidesteps the TCP-over-TCP performance collapse that plagues some tunneling setups. Obscura pitches itself as offering Tor-like separation of identity and destination without Tor’s volunteer-network latency, using two dedicated high-performance hops. Verifiability is a selling point—the app is open source on GitHub, reproducible builds are planned, users can check the displayed exit-hop WireGuard key against Mullvad’s published keys, and the macOS client runs as a sandboxed Network Extension with no kernel access. Pricing is $8/month with Stripe, Bitcoin over Lightning, and Monero accepted, plus WireGuard config export for platforms without a native app.

Worth reading with the caveat that this is drawn from the company’s own FAQ, so the privacy claims are the vendor’s and not independently audited. Still, the architecture is a concrete, checkable approach: the trust reduction comes from cryptographic and network-topology separation rather than a legal pinky-promise, and much of it is designed to be user-verifiable. The main residual questions are the durability of the Mullvad dependency, payment-path metadata (Stripe may require an email Obscura says it never stores), and how well the QUIC stealth protocol holds up against active censors over time.