Obscura looks like it's a double hop system which lacks verification and is based on trust. All it takes is collusion of 2 persons to break this "security" model.
Trust, a non constant, has no place in a security architecture.
Trying it out, so far so good. Worked on my mangled Linux install.
I have and have been using Proton VPN which the free version. If you use it for bittorrent, even to download a Linux ISO which is what I did, will straight up DNS hijack you and feed you a web page instead of the web page you're looking at to scream at you that BitTorrent is only allowed if you're a paying subscriber.
So.. that means they can just access and re-route your traffic however they want and make you see whatever they want.
Fascinating use for SGX Enclave tech, I see in the client debug logs show API hits that do the verification. I'm on an intel i3 with gigabit connection and am pulling 800mbps up/down.
I've been checking everyday if https://github.com/vpdotnet has started to publish any code so that the "verify" part of their claims can be... well verified. Still nothing there.
And another week passes by. Just now the client has been released https://github.com/vpdotnet/vpnet-desktop but still nothing released that enables us to verify claims about security.
10 comments
[ 2.9 ms ] story [ 30.1 ms ] threadTrust, a non constant, has no place in a security architecture.
Don't trust, verify.
I have and have been using Proton VPN which the free version. If you use it for bittorrent, even to download a Linux ISO which is what I did, will straight up DNS hijack you and feed you a web page instead of the web page you're looking at to scream at you that BitTorrent is only allowed if you're a paying subscriber.
So.. that means they can just access and re-route your traffic however they want and make you see whatever they want.
Fascinating use for SGX Enclave tech, I see in the client debug logs show API hits that do the verification. I'm on an intel i3 with gigabit connection and am pulling 800mbps up/down.