D07 · Deep dive
QUIC, DAITA, Multihop: What VPN Obfuscation Actually Buys
Nothing loads from YouTube until you press play. The video then plays in YouTube’s privacy-enhanced mode.
A deep dive into the obfuscation and traffic-analysis stack in the Communication Suite. QUIC carries the endpoint's WireGuard as QUIC traffic (UDP/443 in the test) and raises the cost of casual protocol identification. With the router's WireGuard on, the hotel sees recognizable outer WireGuard whatever the inner setting, and router-side obfuscation (AmneziaWG or self-hosted) is future work. DAITA adds padding and cover traffic to change packet sizes and timing, at a bandwidth cost; its classifier effectiveness wasn't measured. Multihop splits who sees what within one provider. Which mode uses which, and what stays visible regardless: the VPN relay's IP and its reputation, flow duration, volume, and when traffic flows.
What you’ll learn
- Know each control's mechanism
- Know which mode uses which
- Know what stays visible regardless
Chapters
The honest limits
Classifier effectiveness was not measured in the hotel test lab. The results are the Debian laptop's, on IPv4; router-side obfuscation is future work.
Check before you rely on it
These details change. Confirm them against the vendor’s current pages.
- Mullvad desktop feature names and availability (QUIC, DAITA, Multihop, Lockdown).