Spends most of article telling you why they probably aren’t necessary.
Ends with 4 examples why they’re useful, which are the main reasons they’re used to begin with.
I feel like the opening sentences explained the reasoning behind the article sufficiently, even when there are plenty of valid use cases for them. This was mostly a response to manipulative marketing tactics:
Virtual Private Networks, or VPNs, are popular services for (supposedly) increasing your security and privacy on the internet. They are often marketed as all-encompassing security tools, and something that you absolutely need to keep hackers at bay. However, many of the selling points for VPNs are exaggerated or just outright false.
They’re not the only ones pointing this out, either. Tom Scott released a video on the topic a few years ago to explain his thoughts VPN sponsorships
Your comment in no way negates my observation. If the clickbait title of the article was “You probably don’t need a VPN to avoid market tracking” or something similar, you’d have a point.
I was simply adding information your comment had left out, it wasn’t negating information at all. So congrats on getting the point, not everyone is trying to argue 🎉
You may want to reconsider your phrasing then if you don’t want it to appear to be argumentative.
Neutral party here, I read it naturally as a supplement to your comment, not an opposition. I don't detect an argumentative tone personally.
You’re welcome to your opinion but these phrases
I feel like the opening sentences explained the reasoning behind the article sufficiently,
They’re not the only ones pointing this out, either.
are oppositional in tone.
If you ask me, you seem to be looking for a fight here.
I didn’t ask you. I didn’t ask the other neutral guy either. Not my issue that you have a problem with me suggesting the original respondent check his phrasing to make his intention clear, or pointing out the specific phrases that make it unclear.
"Everybody on this highway is driving in the wrong lane! What a bunch of idiots!"
The only reason this continues is because you morons insist on it. I stand by my feedback to the person who responded to me, whether you like it or not. Get over it, you’re not going to harass me into changing my mind about it.
The funny part is I wasn’t picking a fight, that’s what you douchebags are doing with the ongoing commentary. For me this would have been done and forgotten about already.
Assuming good faith, I don't see the argumentative part.
I already addressed this in reply to someone else, you only wasted your time here.
Maybe. And yet, this also didn't sound particularly nice.
…and since then, Tom Scott took a NordVPN sponsorship. And possibly SurfShark too?
He found that it was actually useful while in countries with questionable Internet access.
Personally, I just host my own VPN, so no matter where I am, all my traffic exits from my home ISP. I figure they’re at least accountable to the same laws I am.
But that's the thing. When that Video was made, almost all of the advertising was focused on the same BS the article is disagreeing with.
I remember lots of NordVPN ads by uninformed nontechnical creators just reading the provided script. Saying that Balaklava wearing hackers will steal your credit card data just by being in the same cafe as you, and only an expensive VPN subscription can protect you from that. Or that only using a VPN will protect you from malware.
This sort of advertising is what Tom Scott critizied back then. IIRC he even said that there are real use cases, but that you shouldn't believe the fearmongering. Same as the article.
The fearmongering advertising was the problem, not advertising the service itself.
Yep, articles have different audiences.
Sure one group might understand why a tool exists and use it effectively, but there are also companies over-selling their capabilities and people are using it for things it doesn't help with.
I don't know if those useful features are the main reasons VPNs are used, though. There's evidence they are used often for bypassing blocked sites (like VPN downloads jumping in Russia recently), most of the other advertised privacy and security benefits are questionable. Most of them don't advertise torrenting/piracy because that's a legal gray area.
My VPN advertises protected torrenting as a feature. Many do.
And it’s pretty nondebatable that VPNs are advertised for getting around regional blocking for Netflix etc, or generally getting around censorship like in China.
Ironically, almost all the exit VPNs are owned by either China or Israel. With a few exceptions.
citation needed
My VPN is headquartered in California, and actively removed their presence from Hong Kong once their security policy matched China’s, and removed themselves from Russia since that country was opposed to the zero logs policy.
The title should be "You should understand what a VPN is for, before using one."
Another reason to use a VPN is that ISPs have every motive to sell your browsing data and they do. Unlike many other groups tracking you, your ISP inherently has your meatspace name, address, and payment information making their data easily collatable and very valuable.
If you use the default DNS on their provided router they can even tell if someone purchased an XBox, Playstation, or any other smart device just from update and telemetry lookups.
As the article says, by using a VPN youre using someone else's ISP making that info worthless.
If your threat model includes preventing ad networks from gathering data, a VPN absolutely is a tool to prevent that. Do you have to pay for a service? Probably not if you're technical enough; a VM in a data center is probably sufficient.
Yep. BIG deficiency in this article. I don't use a VPN because of shadowy "hackers" who sit in front of their keyboards with a pistol and a balaclava. I use it because ISPs and governments have demonstrated they can't be trusted.
How about this?
I live in the United States, where I already have no digital privacy, and tunneling my internet traffic through a VPN owned and operated in another country won't meaningfully improve my privacy or safety
Uh, what? If someone wants my traffic logs in the US, now they have to go through Mullvad, which has a track record of not providing or collecting it.
They don't even know who I am, much less have all the data that my ISP has about me. So selling it would be pretty useless
Oh last edit: turns out this is the guy who was trying to well ackshually us into thinking Chrome nerfing ad blockers is not a big deal.
Yeah, part of it reads like he was paid to do it, just without including obvious marketing links so he can claim in the article that he wasn’t. Ending the article with valid use cases seems like preventing anyone saying he left out valid reasons, but after a wall of text that could make less savvy users do a “TL;DR: VPN not needed” before they got to that part. I’d respect it more if he led off with the same short description of valid uses, especially considering the article title, then pivoted to where it could be irrelevant.
ISPs have every motive to sell your browsing data and they do
That sounds very illegal under the GDPR
Oh, if us in America were as privacy minded as the EU. People here gladly hand over every bit of data about themselves either to feel safer or just to save 10 cents on groceries.
People do that everywhere, the only difference is the laws that cover what can be done with that data
Do you have to pay for a service? Probably not if you're technical enough; a VM in a data center is probably sufficient.
Where are you getting free VM hosting?
also, i feel like most of your argument is rendered moot with encrypted dns solutions like DoH.
Where are you getting free VM hosting?
The comment was in reference to VPN services. Sadly, given theres no right to privacy, you must pay to not be tracked.
i feel like most of your argument is rendered moot with encrypted dns solutions like DoH.
You misunderstand. Large ISPs run their own DNS servers which are preconfigured into the devices they sell. They are the intended recipient and you'd just be encrypting it in transit to their servers.
i don’t think many ISPs even offer encrypted DNS, i’m talking about using a third party dns. you can set up a standard dns endpoint that uses DoH upstream to the server of your choice. cloudflared makes this really easy if you are happy using their dns, and you can even have it sit upstream of something like pihole, giving your whole home network dns tracking protection and ad blocking without the overhead of a VPN.
VM in a data center is probably sufficient.
Um, those aren't cost-free.
Oracle Cloud has a free tier and this video shows you how to set up your own VPN there. I wouldn't really recommend this as a free VPN solution though. If you need something that's free, go with Proton VPN's free tier, Proton is pretty trustworthy and they are very upfront about their business model...
You could also just set your DNS to one of the many free DNSSEC providers. That’s even more secure because there are fewer middle men who can track you. After all, while your ISP may not be able to see that DNS traffic, if you arn’t using DNSSEC anyway then your VPN and their upstream provider can.
Besides, nearly all tracking nowadays uses third party browser fingerprinting, which a VPN does nothing about. Practically, a VPN is far more security theater than actual security.
Also, isn’t it funny that sending all your data though a second nation where it no longer legally counts as Amarican internet traffic became really well advertised right after a major scandal came out where the NSA was illegally monitoring American traffic, and more protections were put in place to keep them from doing it again?
You don’t even need the VPN company to be in on it, a group like the NSA can pretty easily compromise a “no logs” VPN’s technical infrastructure or that of their upstream provider, and they’re even got people who feel like they have something to hide to self select for it to cut down on the amount of boring traffic in the first place.
This is absolutely not what DNSSEC is. DNSSEC provides authenticity of the response, not privacy. You're describing a means of encrypted name resolution, like dns-over-tls, dns-over-https, etc.
Right, I had just responded off the top of my head and got the name wrong. Point still stands.
Potentially, but precision is important, especially if you're going to make sweeping claims about a topic, acting as an authority.
I mean it was just mixing up two similar names, the point remains the same.
Thank goodness we absolutely know for certain that no VPN would ever sell your browsing data.
meatspace name
I laughed reading this, it has a strong SMBC vibe :)
Well, that article was a hot mess.
I appreciate the authors effort and they are correct about lack of "what is VPN" articles that are not written by VPN-vendors in marketing purpose. But I'm not sure if this was it.
Writing an article meant to "debunk" misconceptions and getting two core concepts, Security and Privacy mixed up right from the start wasn't very good.
A lot of time was spent on explaining HTTPS and how it somehow magically makes you and your data secure on the Internet and it completely missed to mention who the potential threat actors thwarted by HTTPS are?
Could have probably used a chapter on how actual threats (both security and privacy) work and how don't have much to do with the level of encryption your TCP/IP connection happens to encapsulate.
The last chapter with the first 3 bullets was pretty good though. That could have just been the whole article and it would have been alright.
VPNs are not magical fixes for privacy and security on the internet. However, there are some specific situations where they are useful tools.
Network blocks and internet censorship. VPNs can help you access sites and services that are restricted by your local network or government. That's why downloads of VPN apps in Russia skyrocketed in 2022, after the country's invasion of Ukraine and more services became blocked. The same trend happened in Virginia and other U.S. states after they passed laws requiring photo identification for adult websites.
Piracy. Internet service providers can sometimes detect when you are pirating movies, TV shows, music, or other media and send you angry letters. You can avoid that entirely by using a VPN when you download or torrent copyrighted material. Do what you want 'cause a pirate is free... but use a VPN.
Region-locked content. This is a popular selling point for VPN companies that is actually true: VPNs can help you access online content that is officially restricted to a certain region. Switching your VPN server to a different country can change what movies and shows are available through Netflix, and UK-based VPN servers are frequently used to access BBC iPlayer content in other countries. However, this is not always reliable, as service providers will usually detect VPN servers after a while and block them.
Accessing your home network. Setting up a VPN server at home is one way to access devices on your home network (such as self-hosted security cameras, media servers, and remote desktop) without opening up more of your network to the rest of the internet.
There are other more niche use cases for VPNs, but those are the most popular ones that aren't completely made up.
I know exactly how litigious Funimation is. I absolutely need a VPN. :D
I like VPNs because you get a colorful selection of who to potentially get man in the middle attacked by.
That's not a VPN issue, that's a provider issue.
Clearly whoever wrote this has not tried torrenting popular content 🤨
Just use any old proxy either paid for in cash in the mail, or in a country that absolutely won't cooperate with yours legally when you need it.
Your VPN will absolutely fold under the slightest legal pressure.
Some of them don't even log the data required to cooperate with requests. Mullvad is one.
Better than most but I couldn't find mention of anything that prevents them from complying with secret requests to begin data monitoring.
Potentially where they're based that's unconstitutional or something but I didn't see evidence of such.
Nevermind the government or hackers, I use a home-grown VPN to keep Comcast off my ass.
Understandable, I would never trust my internet service provider either
I'm not quite paranoid enough to believe that all of these anti-VPN articles are propaganda sponsored by people who want to make mass surveillance easier, but when it's from someone whose other recent posts include one titled "Youtube ads aren't actually that bad" and two explaining why Google's Manifest V3 is great, I'm at least going to suspect it as a possibility.
It's definitely possible they're sincere.
It's not at all possible that I'm going to care about or respect anything they have to say about privacy or security.
Another good use for VPN is to counter dynamic pricing. My wife visited a website some time ago to request the price for a ticket. When she visited the website a second time the price had increased considerably. However when visiting the price with VPN it was the original price again. It saved her a lot of money.
You can also get around this by using a non-airline owned travel metasearch engine like Kayak.
Thanks for the tip.
IVPN created an awesome website called doineedavpn.com where they honestly and objectively answer that question. It's one of the reasons why I like IVPN as a VPN provider, they are honest and don't hide anything from their customers. Also their apps are open source and they support anonymous signup.
Spends most of article telling you why they probably aren’t necessary.
Ends with 4 examples why they’re useful, which are the main reasons they’re used to begin with.
I feel like the opening sentences explained the reasoning behind the article sufficiently, even when there are plenty of valid use cases for them. This was mostly a response to manipulative marketing tactics:
They’re not the only ones pointing this out, either. Tom Scott released a video on the topic a few years ago to explain his thoughts VPN sponsorships
Your comment in no way negates my observation. If the clickbait title of the article was “You probably don’t need a VPN to avoid market tracking” or something similar, you’d have a point.
I was simply adding information your comment had left out, it wasn’t negating information at all. So congrats on getting the point, not everyone is trying to argue 🎉
You may want to reconsider your phrasing then if you don’t want it to appear to be argumentative.
Neutral party here, I read it naturally as a supplement to your comment, not an opposition. I don't detect an argumentative tone personally.
You’re welcome to your opinion but these phrases
are oppositional in tone.
If you ask me, you seem to be looking for a fight here.
I didn’t ask you. I didn’t ask the other neutral guy either. Not my issue that you have a problem with me suggesting the original respondent check his phrasing to make his intention clear, or pointing out the specific phrases that make it unclear.
"Everybody on this highway is driving in the wrong lane! What a bunch of idiots!"
The only reason this continues is because you morons insist on it. I stand by my feedback to the person who responded to me, whether you like it or not. Get over it, you’re not going to harass me into changing my mind about it.
The funny part is I wasn’t picking a fight, that’s what you douchebags are doing with the ongoing commentary. For me this would have been done and forgotten about already.
Assuming good faith, I don't see the argumentative part.
I already addressed this in reply to someone else, you only wasted your time here.
Maybe. And yet, this also didn't sound particularly nice.
…and since then, Tom Scott took a NordVPN sponsorship. And possibly SurfShark too?
He found that it was actually useful while in countries with questionable Internet access.
Personally, I just host my own VPN, so no matter where I am, all my traffic exits from my home ISP. I figure they’re at least accountable to the same laws I am.
But that's the thing. When that Video was made, almost all of the advertising was focused on the same BS the article is disagreeing with.
I remember lots of NordVPN ads by uninformed nontechnical creators just reading the provided script. Saying that Balaklava wearing hackers will steal your credit card data just by being in the same cafe as you, and only an expensive VPN subscription can protect you from that. Or that only using a VPN will protect you from malware.
This sort of advertising is what Tom Scott critizied back then. IIRC he even said that there are real use cases, but that you shouldn't believe the fearmongering. Same as the article.
The fearmongering advertising was the problem, not advertising the service itself.
Yep, articles have different audiences.
Sure one group might understand why a tool exists and use it effectively, but there are also companies over-selling their capabilities and people are using it for things it doesn't help with.
This article is for them, simple as that
I don't know if those useful features are the main reasons VPNs are used, though. There's evidence they are used often for bypassing blocked sites (like VPN downloads jumping in Russia recently), most of the other advertised privacy and security benefits are questionable. Most of them don't advertise torrenting/piracy because that's a legal gray area.
My VPN advertises protected torrenting as a feature. Many do.
And it’s pretty nondebatable that VPNs are advertised for getting around regional blocking for Netflix etc, or generally getting around censorship like in China.
Ironically, almost all the exit VPNs are owned by either China or Israel. With a few exceptions.
citation needed
My VPN is headquartered in California, and actively removed their presence from Hong Kong once their security policy matched China’s, and removed themselves from Russia since that country was opposed to the zero logs policy.
The title should be "You should understand what a VPN is for, before using one."
Another reason to use a VPN is that ISPs have every motive to sell your browsing data and they do. Unlike many other groups tracking you, your ISP inherently has your meatspace name, address, and payment information making their data easily collatable and very valuable.
If you use the default DNS on their provided router they can even tell if someone purchased an XBox, Playstation, or any other smart device just from update and telemetry lookups.
As the article says, by using a VPN youre using someone else's ISP making that info worthless.
If your threat model includes preventing ad networks from gathering data, a VPN absolutely is a tool to prevent that. Do you have to pay for a service? Probably not if you're technical enough; a VM in a data center is probably sufficient.
Yep. BIG deficiency in this article. I don't use a VPN because of shadowy "hackers" who sit in front of their keyboards with a pistol and a balaclava. I use it because ISPs and governments have demonstrated they can't be trusted.
How about this?
Uh, what? If someone wants my traffic logs in the US, now they have to go through Mullvad, which has a track record of not providing or collecting it.
They don't even know who I am, much less have all the data that my ISP has about me. So selling it would be pretty useless
Oh last edit: turns out this is the guy who was trying to well ackshually us into thinking Chrome nerfing ad blockers is not a big deal.
Yeah, part of it reads like he was paid to do it, just without including obvious marketing links so he can claim in the article that he wasn’t. Ending the article with valid use cases seems like preventing anyone saying he left out valid reasons, but after a wall of text that could make less savvy users do a “TL;DR: VPN not needed” before they got to that part. I’d respect it more if he led off with the same short description of valid uses, especially considering the article title, then pivoted to where it could be irrelevant.
That sounds very illegal under the GDPR
Oh, if us in America were as privacy minded as the EU. People here gladly hand over every bit of data about themselves either to feel safer or just to save 10 cents on groceries.
People do that everywhere, the only difference is the laws that cover what can be done with that data
Where are you getting free VM hosting?
also, i feel like most of your argument is rendered moot with encrypted dns solutions like DoH.
The comment was in reference to VPN services. Sadly, given theres no right to privacy, you must pay to not be tracked.
You misunderstand. Large ISPs run their own DNS servers which are preconfigured into the devices they sell. They are the intended recipient and you'd just be encrypting it in transit to their servers.
i don’t think many ISPs even offer encrypted DNS, i’m talking about using a third party dns. you can set up a standard dns endpoint that uses DoH upstream to the server of your choice. cloudflared makes this really easy if you are happy using their dns, and you can even have it sit upstream of something like pihole, giving your whole home network dns tracking protection and ad blocking without the overhead of a VPN.
Um, those aren't cost-free.
Oracle Cloud has a free tier and this video shows you how to set up your own VPN there. I wouldn't really recommend this as a free VPN solution though. If you need something that's free, go with Proton VPN's free tier, Proton is pretty trustworthy and they are very upfront about their business model...
You could also just set your DNS to one of the many free DNSSEC providers. That’s even more secure because there are fewer middle men who can track you. After all, while your ISP may not be able to see that DNS traffic, if you arn’t using DNSSEC anyway then your VPN and their upstream provider can.
Besides, nearly all tracking nowadays uses third party browser fingerprinting, which a VPN does nothing about. Practically, a VPN is far more security theater than actual security.
Also, isn’t it funny that sending all your data though a second nation where it no longer legally counts as Amarican internet traffic became really well advertised right after a major scandal came out where the NSA was illegally monitoring American traffic, and more protections were put in place to keep them from doing it again?
You don’t even need the VPN company to be in on it, a group like the NSA can pretty easily compromise a “no logs” VPN’s technical infrastructure or that of their upstream provider, and they’re even got people who feel like they have something to hide to self select for it to cut down on the amount of boring traffic in the first place.
This is absolutely not what DNSSEC is. DNSSEC provides authenticity of the response, not privacy. You're describing a means of encrypted name resolution, like dns-over-tls, dns-over-https, etc.
Right, I had just responded off the top of my head and got the name wrong. Point still stands.
Potentially, but precision is important, especially if you're going to make sweeping claims about a topic, acting as an authority.
I mean it was just mixing up two similar names, the point remains the same.
Direct report from the FTC. ISPs are DIGGING into your web behavior. https://www.ftc.gov/reports/look-what-isps-know-about-you-examining-privacy-practices-six-major-internet-service-providers
Thank goodness we absolutely know for certain that no VPN would ever sell your browsing data.
meatspace name I laughed reading this, it has a strong SMBC vibe :)
Well, that article was a hot mess.
I appreciate the authors effort and they are correct about lack of "what is VPN" articles that are not written by VPN-vendors in marketing purpose. But I'm not sure if this was it.
Writing an article meant to "debunk" misconceptions and getting two core concepts, Security and Privacy mixed up right from the start wasn't very good.
A lot of time was spent on explaining HTTPS and how it somehow magically makes you and your data secure on the Internet and it completely missed to mention who the potential threat actors thwarted by HTTPS are?
Could have probably used a chapter on how actual threats (both security and privacy) work and how don't have much to do with the level of encryption your TCP/IP connection happens to encapsulate.
The last chapter with the first 3 bullets was pretty good though. That could have just been the whole article and it would have been alright.
Oh well. Attempt was made.
I know exactly how litigious Funimation is. I absolutely need a VPN. :D
I like VPNs because you get a colorful selection of who to potentially get man in the middle attacked by.
That's not a VPN issue, that's a provider issue.
Clearly whoever wrote this has not tried torrenting popular content 🤨
Just use any old proxy either paid for in cash in the mail, or in a country that absolutely won't cooperate with yours legally when you need it.
Your VPN will absolutely fold under the slightest legal pressure.
Some of them don't even log the data required to cooperate with requests. Mullvad is one.
IVPN is another
how do they prove that they both don't and can't?
Audit.
https://www.consumerreports.org/electronics-computers/vpn-services/mullvad-ivpn-mozilla-vpn-top-consumer-reports-vpn-testing-a9588707317/
https://mullvad.net/en/blog/2023/8/9/infrastructure-audit-completed-by-radically-open-security https://www.techradar.com/news/mullvad-vpns-servers-have-undergone-an-independent-audit-and-the-results-are-in
https://mullvad.net/en/blog/2022/6/22/vpn-server-audit-found-no-information-leakage-or-logging-of-customer-data
Better than most but I couldn't find mention of anything that prevents them from complying with secret requests to begin data monitoring.
Potentially where they're based that's unconstitutional or something but I didn't see evidence of such.
Nevermind the government or hackers, I use a home-grown VPN to keep Comcast off my ass.
Understandable, I would never trust my internet service provider either
I'm not quite paranoid enough to believe that all of these anti-VPN articles are propaganda sponsored by people who want to make mass surveillance easier, but when it's from someone whose other recent posts include one titled "Youtube ads aren't actually that bad" and two explaining why Google's Manifest V3 is great, I'm at least going to suspect it as a possibility.
It's definitely possible they're sincere.
It's not at all possible that I'm going to care about or respect anything they have to say about privacy or security.
Another good use for VPN is to counter dynamic pricing. My wife visited a website some time ago to request the price for a ticket. When she visited the website a second time the price had increased considerably. However when visiting the price with VPN it was the original price again. It saved her a lot of money.
You can also get around this by using a non-airline owned travel metasearch engine like Kayak.
Thanks for the tip.
IVPN created an awesome website called doineedavpn.com where they honestly and objectively answer that question. It's one of the reasons why I like IVPN as a VPN provider, they are honest and don't hide anything from their customers. Also their apps are open source and they support anonymous signup.