D12 · Deep dive
Rejected Designs and Upgrade Paths for a Travel Privacy Kit
Nothing loads from YouTube until you press play. The video then plays in YouTube’s privacy-enhanced mode.
A deep dive into the designs the Communication Suite deliberately rejected, and why: perimeter-only VPN enforcement, plain WireGuard as a low-signature claim, transparent Tor on the router, two Android profiles on Cape, cloud-synced conveniences, stacked browser privacy extensions, and Starlink as a primary uplink. Then the Setup Guide's two untested outer-hop options: Option B, AmneziaWG to a server you host, and what it does to DNS; and Option C, router-side Shadowsocks, which needs a UDP relay, not SOCKS5. Last, the upgrade paths for higher threat models: self-hosted obfuscation, true multipath (Peplink SpeedFusion, Dispersive), and a mix network (Nym) for timing correlation, at a latency cost. None of the upgrade paths is validated, and self-hosting doesn't guarantee undetectability.
What you’ll learn
- Know each rejected design and why
- Know the untested outer-hop options
- Know the upgrade paths and their costs
Chapters
The honest limits
None of the upgrade paths is validated. Self-hosting doesn't guarantee undetectability. Options B and C weren't part of the tested build; each needs the upstream capture, failure, recovery and nested-stability tests repeated.
Check before you rely on it
These details change. Confirm them against the vendor’s current pages.
- Vendor offerings (Peplink SpeedFusion, Dispersive, Nym).
- Mullvad features; Proton as a regional fallback.