Project ideas from Hacker News discussions.

Obscura: VPN that can't log your activity

📝 Discussion Summary (Click to expand)

1. Trust model & jurisdiction concerns
Many commenters focused on how Obscura’s two‑party relay changes trust assumptions—and worries about its U.S. base.
- dongcarl: “With Obscura, even if we're hacked there's nothing to leak … you're trusting that not both Obscura AND Mullvad have been compromised, which is strictly less likely.
- maxloh: “Under US law, a secretive court order could compel a US company to update software or implement targeted logging on a specific user without notifying that user.
- autoexec: “If men with guns and gag orders haven't shown up at their New York office yet, they will as soon as this VPN gets popular enough …

2. Technical implementation & comparison to other systems
The discussion frequently highlighted the protocol choices (QUIC, WireGuard‑over‑QUIC), open‑source clients, and similarities to multi‑hop services like iCloud Private Relay.
- dongcarl: “We use QUIC for transport … we show Mullvad's server pubkey in the app so you can verify against Mullvad’s website.
- skaul: “Two hops … first hop sees your IP but not the destination, second hop sees the destination but not your IP. Similar to Private Relay.
- barathr: “This is like Apple iCloud Private Relay, and other multi‑hop privacy systems that have been built …

3. Design, UX, and signup flow
Opinions also turned to the visual identity (pixelated fonts vs. squircles, retro 8‑bit graphics) and the appeal of an email‑less, randomized‑account signup.
- osnxkwmxkwnd: “bitmap/pixelated fonts and graphics inside perfect squircles … feels like the designer had a bunch of ideas and didn’t know how to bring them together.
- dongcarl: “I'm a sucker for retro 8‑bit graphics … but when we experimented with 8‑bit for actual UI we found it super unusable.
- john_strinlai: “I really wish more companies did the no email + randomized account number flow. … not offering it … is enough signal that it has made me choose not to purchase the product.


🚀 Project Ideas

KeyTransparency for Multi-Hop VPNs

Summary

  • Provides a public, append-only log of signed exit‑server public keys for multi‑party VPN relays, enabling clients to cryptographically verify the authenticity of the hop they connect to.
  • Eliminates the need to trust a single key distribution server and mitigates man‑in‑the‑middle attacks on VPN exit keys.

Details

Key Value
Target Audience VPN service operators (e.g., Obscura, Mullvad) and privacy‑focused app developers running multi‑hop relays
Core Feature Transparent key log with verification API/client library (using Sigsum or similar) plus optional monotonic timestamps
Tech Stack Go/Rust server, SQLite/append‑only log, Sigsum, libsodium for signatures, HTTP/JSON API, optional WASM client
Difficulty Medium
Monetization Revenue-ready: SaaS tiered pricing (free log for open‑source projects, paid private logs + SLA)

Notes

  • HN users worried about key fetching: “How does the Obscura client get the Mullvad exit server’s public key? … fetched from Obscura's server? … dangerous if there isn't some kind of signature verification.” (maxloh)
  • Provides verifiable keys that would address this concern and align with the desire for open‑source, auditable clients.
  • Could spark discussion on trust minimization and be useful for any multi‑hop privacy system (Tor, Private Relay, etc.).

Anonymous Account Number Auth (ANAuth)

Summary

  • Drop‑in authentication service that lets users sign up with a random, Verhoeff‑checksummed account number instead of an email, offering optional anonymous payment via crypto or prepaid cards.
  • Gives SaaS products a privacy‑first sign‑up flow that eliminates email collection and reduces friction for privacy‑conscious users.

Details

Key Value
Target Audience Indie hackers, SaaS founders, privacy‑focused apps wanting to offer email‑less accounts (VPNs, forums, newsletters)
Core Feature Generates unique account numbers, validates checksum, stores salted hash, provides login via number+PIN, integrates with anonymous payment gateway
Tech Stack Node.js/TypeScript backend, PostgreSQL, Redis for rate‑limiting, optional WebAuthn for PIN, frontend widget in React/Vue
Difficulty Low‑Medium
Monetization Revenue-ready: $0.005 per MAU

Notes

  • john_strinlai praised the account number method: “the account number method is really nice, and a great selling point for such privacy‑conscious products.” and dongcarl noted they added a Verhoeff checksum.
  • Users lamented lack of such flow in popular pro‑privacy products; ANAuth would fill that gap.
  • Easy to integrate, could be discussed on HN as a privacy‑first auth alternative.

QUIC Obfuscation Wrapper (QOW)

Summary

  • A pluggable transport library that encapsulates VPN traffic in QUIC with traffic morphing, packet padding, and optional cover traffic to evade deep‑packet inspection in censored networks.
  • Enables VPNs like Obscura or Mullvad to maintain connectivity in regions with aggressive DPI (e.g., Iran, China) without sacrificing performance.

Details

Key Value
Target Audience VPN developers, censorship‑circumvention projects, and privacy‑conscious users operating in restrictive regimes
Core Feature QUIC‑based wrapper that adds random padding, fixes packet sizes, and can multiplex cover streams; provides client and server APIs
Tech Stack Rust (using quinn crate for QUIC), optional WASM for web, configurable via TOML; integrates with WireGuard or OpenVPN via tun device
Difficulty High
Monetization Revenue-ready: enterprise support license; core open‑source

Notes

  • walrus01 asked: “how is this architected to deal with advanced DPI boxes in ISP networks that detect flows of encrypted traffic and drop it?” and dongcarl replied they use QUIC with Chaos Protection.
  • QOW would give a standardized, auditable solution that HN commenters concerned about DPI would appreciate.
  • Could be used by Obscura to improve its resilience and spark discussion on open‑source anti‑censorship tools.

Read Later