Carl Dong launches Obscura VPN to eliminate single-hop trust
- Single-hop VPNs force users to trust single providers with their full browsing traffic.
- Obscura VPN splits routing between two providers to prevent any single entity from tracking users.
- Developer Carl Dong applied Bitcoin Core's strict supply chain isolation to consumer privacy software.
Single-hop commercial VPNs demand total user trust. The provider sees your home IP address and every website you visit, creating a single point of failure.
On Ungovernable Misfits on August 29, 2026, former Bitcoin Core developer Carl Dong introduced Obscura VPN to eliminate that central vulnerability. Obscura adapts Apple's iCloud Private Relay concept into an open architecture, splitting network traffic across two separate, independent entities. By design, neither provider has sufficient access to link user identity with target destinations.
The routing mechanics enforce cryptographic isolation. Obscura operates the first hop, knowing the user's origin IP address but holding no insight into their browsing destination. Mullvad manages the second exit hop, unsealing encrypted packets to process the destination request without ever learning who initiated the traffic.
To bypass corporate firewalls and middle-box deep packet inspection, Obscura runs the Mask protocol over HTTP/3 and QUIC. The application wraps VPN traffic so it mirrors standard web browsing, hiding WireGuard signatures. Dong noted that Chrome's chaos protection further scrambles QUIC handshakes, rendering packet inspection computationally impractical for middleboxes attempting to extract plain-text Server Name Indication fields.
Dong is also targeting friction in consumer privacy tools. Obscura plans to remove manual VPN toggling through smart routing, automatically bypassing encrypted hops for sensitive local services like banking sites while routing specific top-level domains through specialized regional exit nodes.
This structural refusal to rely on unverified trust stems directly from Dong's work on Bitcoin Core. During three years at Chaincode Labs, Dong focused on reproducible builds and supply chain verification. His team built bootstrappable toolchains starting from a 500-byte human-auditable assembly script, compiling upward step-by-step to a full GCC compiler to guarantee downloaded binaries match public source code without hidden backdoors.
Widespread supply chain exploits across NPM, Rust, and Linux repositories have vindicated that obsessive security posture. By bringing Bitcoin's zero-trust build discipline to consumer network routing, Dong is arguing that privacy software must rely on structural isolation rather than corporate promises.
Source Intelligence
- Deep dive into what was said in the episodes
Obscura VPN with Carl Dong | FREEDOM TECH FRIDAY 54 • Aug 29
- Obscura utilizes a two hop architecture with Mullvad to protect user identity. Obscura handles the first hop and knows the user's IP, while Mullvad handles the second hop and only sees the web traffic.
- Obscura employs the Mask protocol over HTTP3 to disguise VPN traffic as standard web browsing. This design targets corporate firewalls and network censors that automatically block standard WireGuard or OpenVPN protocols.
- Carl Dong highlights that Chrome's chaos protection shuffles and splits QUIC handshake packets. This technique makes deep packet inspection computationally impractical for middleboxes attempting to extract plain text Server Name Indication fields.
- Carl Dong plans to eliminate manual VPN toggling through smart routing. This feature will automatically bypass the VPN for banking sites or route specific top level domains through optimized regional exit nodes.
Also discussed on this episode: (4)
AI Infrastructure (1)
- Seth has expanded his local AI cluster to eight total DGX Spark units. He notes that running KMAK 3 requires doubling this hardware setup to 16 units.
Coding (1)
- Carl Dong worked on supply chain security at Chaincode Labs to develop a bootstrappable compiler toolchain. The project compiled GCC and Bitcoin Core starting from an auditable 500 byte assembly program.
Protocol (1)
- Carl Dong initiated the libbitcoinkernel library to encapsulate Bitcoin's consensus engine. This encapsulation prevents catastrophic chain splits that occur when different node implementations interpret transaction scripts inconsistently.
Agents (1)
- Seth uses AI agents to conduct overnight pull request reviews and scan upstream software dependencies. This pipeline recently identified a medium severity security vulnerability in an upstream library used by Cake Wallet.