Carl Dong masks Obscura VPN traffic to bypass ISP blocks
- Single-hop VPNs require blind trust that multi-hop routing eliminates entirely.
- Obscura VPN splits routing across two independent entities using QUIC protocols.
- Hidden HTTP/3 traffic bypasses deep packet inspection by mimicking normal browsing.
Single-hop commercial VPNs ask users for blind trust. Former Bitcoin Core developer Carl Dong wants to destroy that trust model entirely.
On Ungovernable Misfits, Dong detailed how Obscura VPN splits internet traffic into two independent hops managed by separate entities. Obscura operates the first hop, seeing the user’s home IP address but never their destination. Privacy provider Mullvad runs the second hop, unsealing encrypted packets to reach the destination site without ever seeing who originated the request.
Bypassing corporate firewalls and government censors requires more than splitting hops. Obscura wraps its WireGuard tunnels inside the MASK protocol over HTTP/3 and QUIC. Standard VPN signatures are easily identified and blocked by deep packet inspection middleboxes. By masking encrypted packets as standard HTTPS traffic, Obscura makes VPN connections look indistinguishable from routine web browsing.
The architecture relies on subtle quirks in modern browser design. Chrome's chaos protection mechanism continuously shuffles and splits QUIC handshake packets. On Ungovernable Misfits, Dong explained that this randomized packet splitting makes it computationally impractical for middleboxes to inspect and extract plain-text Server Name Indication fields. State censors cannot easily filter the VPN without breaking large swaths of normal web traffic.
This obsession with verification stems directly from Dong's work on Bitcoin Core. During three years at Chaincode Labs, Dong focused on software supply chain security and bootstrappable builds. He helped build a toolchain starting from a human-auditable 500-byte assembly script that compiled all the way up to a full GCC compiler and Bitcoin Core binary.
Dong also initiated `libbitcoinkernel`, a dedicated C++ library designed to encapsulate Bitcoin's consensus engine. That project aimed to eliminate catastrophic chain splits caused by subtle code inconsistencies between node implementations. Translating that level of paranoia to consumer privacy software means treating trust as a structural flaw.
If software cannot be independently verified, its promises mean nothing.
Source Intelligence
- Deep dive into what was said in the episodes
Obscura VPN with Carl Dong | FREEDOM TECH FRIDAY 54 • Aug 29
- Carl Dong worked on supply chain security at Chaincode Labs to develop a bootstrappable compiler toolchain. The project compiled GCC and Bitcoin Core starting from an auditable 500 byte assembly program.
- Carl Dong initiated the libbitcoinkernel library to encapsulate Bitcoin's consensus engine. This encapsulation prevents catastrophic chain splits that occur when different node implementations interpret transaction scripts inconsistently.
- Obscura employs the Mask protocol over HTTP3 to disguise VPN traffic as standard web browsing. This design targets corporate firewalls and network censors that automatically block standard WireGuard or OpenVPN protocols.
- Carl Dong highlights that Chrome's chaos protection shuffles and splits QUIC handshake packets. This technique makes deep packet inspection computationally impractical for middleboxes attempting to extract plain text Server Name Indication fields.
Also discussed on this episode: (4)
AI Infrastructure (1)
- Seth has expanded his local AI cluster to eight total DGX Spark units. He notes that running KMAK 3 requires doubling this hardware setup to 16 units.
Privacy (2)
- Obscura utilizes a two hop architecture with Mullvad to protect user identity. Obscura handles the first hop and knows the user's IP, while Mullvad handles the second hop and only sees the web traffic.
- Carl Dong plans to eliminate manual VPN toggling through smart routing. This feature will automatically bypass the VPN for banking sites or route specific top level domains through optimized regional exit nodes.
Agents (1)
- Seth uses AI agents to conduct overnight pull request reviews and scan upstream software dependencies. This pipeline recently identified a medium severity security vulnerability in an upstream library used by Cake Wallet.