A Defensive Computing Checklist    by Michael Horowitz
HOME | About | Domain Names | VPNs | Rules of the Road | DC Presentation | ChangeLog | Stats |

VPNs

Topics below: Introduction   Downsides to a  VPN,   Operating System VPN Bugs,   Is the VPN working?,   Choosing a VPN - Software Features,   Choosing a VPN - Who Owns The Company,   Choosing a VPN - Anonymity,   Choosing a VPN - Other Criteria,   VPN Provider Warnings,   Blocking Ads and Tracking while using a VPN,   An FYI on Location Hiding,   An FYI on Device Limits,   Double VPNs,   VPN Articless,   Advanced Techie Stuff,   My User Experience with some VPN client programs

 INTRODUCTION TO VPNs

At the simplest level, a VPN is an encrypted connection between two computing devices. The data that flows between the connected devices is encrypted by the software that created the connection. One of the devices is referred to as the VPN server. Like any other type of Server (web, email, etc) a VPN server sits and waits for computers to connect to it. The other device is the VPN client. It is the client that initiates the VPN connection between the two devices.

Software running on a computing device is what determines if it functions as a VPN client or a VPN server. Devices such as phones, tablets and personal computers are usually the VPN clients. Routers are interesting in that many can be either a VPN client or a VPN server. Then again, many routers can do neither. Oftentimes a computer is dedicated to function as a VPN server, so the hardware and software are thought of as one and the same.

There are different flavors of VPNs and both the client and server must be the same flavor. Popular flavors are OpenVPN, WireGuard and IKEv2.

In addition to flavors, there are also different categories of VPNs. Perhaps the biggest category is Consumer vs. Business. Business VPNs are run by large companies for their employees. Typically they connect remote employees to the head office, and they may also be used to connect different buildings in different cities to form one big company-wide network. This page is about consumer VPNs, employees of a large company have their own tech support and don't need anything from me.

With Consumer VPNs, the VPN servers are provided by a VPN company such as Mullvad, ProtonVPN, NordVPN, IVPN, ExpressVPN and hundreds more.

Google's Jigsaw division provides a free VPN called Outline. It differs from Consumer VPNs in that they provide the VPN server software that you have to install, configure and operate. They do their best to make setting up the VPN server as easy and cheap as possible. As to easy, they provide desktop software to install and configure the VPN server. As for cheap, the point out that the VPN server can be run on cloud-based Linux Virtual Machines for as little as $5 US/month. They also claim that their VPN is harder for bad governments to block. Again, this page is focused on Consumer VPNs. Maybe someday, I will get to kick the tires on Outline. Techies, as a rule, are disgraceful at explaining and documenting things, so whether a newbie to the software can actually get it to work will be interesting. In October 2022, the Washington Post said that nthLink offers a version of Outline that is easier to install and more flexible. I took a look at the nthLink website and found it totally devoid of information; a useless site chock full of buzzwords.

The connection between VPN client software on your device and a VPN server, somewhere on the Internet, is referred to as a "tunnel". When it is working as designed, all data entering and leaving the device running the VPN client software travels through the tunnel and is encrypted/decrypted by the VPN software at each end. The term tunnel is quite good, as it illustrates that only the two devices at each end of the tunnel can see the data. To anyone/anything outside the tunnel, all they see is encrypted useless junky bits.

NOTE: There are times when a device running VPN client software does not want all the data coming/going to travel through the VPN tunnel. This, however, is the exception. The official term for this is Split Tunneling. For example, there are some websites that test for the presence of a VPN connection and refuse to work with a VPN. In that case, the computing device running the VPN client software might want to make that one website an exception and let it travel outside the VPN tunnel. The alternative would be to shut down the VPN tunnel when accessing that website.

Who is outside the tunnel? Your ISP for one. Blocking spying by an ISP is especially important in the US, where ISPs are allowed to spy on their customers and sell that data. For details on this see, Internet Service Providers Collect, Sell Horrifying Amount of Sensitive Data, Government Study Concludes by Karl Bode (Oct. 2021). If you are in a public coffee shop, your fellow coffee drinkers are outside the VPN tunnel. If the VPN client software is running on your phone or tablet or computer, then the router is also outside the VPN tunnel.

That a VPN hides everything from the router and the ISP is how people in China can interact with the rest of the world. It is also how students in a school can bypass restrictions and see websites that teachers try to block.

As noted above, routers are computers and some can function as VPN client, some can function as a VPN server, some can do both and some can do neither. The advantage to using VPN client software in a router is that all the devices connected to the router are protected by the VPN tunnel created by the router. This can protect devices, such as a Smart TV that are not able to run VPN client software on their own.

There are two reasons to use a VPN server in a router. The first is to provide a secure way to access the devices in your home when you are away from home. The other is to use your home router as a free replacement for paid consumer VPN providers. Again, when away from home, you can connect to the VPN server software in your home router and use that secure, encrypted tunnel to hide your activities from the devices near you. Note however, that this does let your home ISP spy on you.

Some people have argued that since a "secure" website (using HTTPS) prevents others from reading the content of web pages, there is little need for a VPN. However, others can still tell which websites you visited. In some cases, just the website name gives away too much information. And, websites are not the only thing on the Internet. With mobile apps, for example, you can not tell if data is being transmitted securely or not.

In addition, a VPN will change your public IP address, so you can pretend to be in a different physical location.

Picking a VPN provider is mind bogglingly difficult. See one attempt and another and another and another and another and another and another and another. Even agreeing on the criteria to judge them with is impossible. I have my opinions on good/trustworthy VPN providers, email me for my suggestions. The big danger in picking a VPN provider that is not trustworthy is that they can spy on you, in the exact same way that an ISP can spy on you when you are not using a VPN.

If you are using a VPN on a device capable of both Wi-Fi and 4G/LTE/5G (pretty much every smartphone) it is best to disable the network connection that is not connected to the VPN. There is always a chance, especially on iOS, that data can leave the device on the network without the VPN.

New to VPNs? See my article An introduction to six types of VPN software from 2017. I also wrote A Defensive Computing term paper on privacy: VPNs, Tor and VPN routers in 2016 which offers an introduction to VPNs and Tor.

This is also a good article: Can you be tracked when using a VPN? by Douglas Crawford of ProtonVPN. December 2022.

  DOWNSIDES TO A VPN   top

An ongoing issue with VPNs is what happens to existing Internet connections/sockets/threads when the VPN tunnel is created? In a perfect world, all the existing connections, which are outside of the tunnel, will be terminated and re-created inside the tunnel. But, this does not always happen and since it is an operating system thing, not a VPN thing, there is a limit as to how much any one VPN provider can do about this. To defend against this, make a VPN connection as soon as the device starts up and before you do anything else with it. For a device that has been powered on for a while, at least close out of all web browsers, email programs, and whatever apps you can close out of, before making the VPN connection.

VPN tunnels can break, even when the Internet connection is alive and well. So, if you are doing something sensitive, you need to watch the icon that indicates that the VPN is currently connected.

Sometimes a website will refuse to load when you are using a VPN. Making this worse, is that the error message, almost always, says nothing about a VPN. At tickets.com, for example,the error is "Access Denied". The US Postal Service, tells you that you do not have permission. Delta Airlines says "We're sorry but there was a problem processing your request. Please go back and try again. #SFAS001". At ticketmaster.com, the useless error message is "Your Browsing Activity Has Been Paused". They even include solutions that say nothing about blocking access from a VPN. Paying customers at Consumer Reports are falsely told that "This service is temporarily unavailable, please try again later."

Note that while a website can detect a VPN, this is not always perfect. It may well be that rather than detecting the VPN, a website is using a list of known bad IP addresses. In that case, one VPN server can be blacklisted while another, from the same VPN provider, might not be. Trial and error is needed.

Instead of being completely blocked, some websites may just require extra identification when using a VPN. For example, there may be a CAPTCHA when using a VPN that you would not see without the VPN.

A VPN will slow down your Internet connection, but it should be quite rare that the slowdown is noticeable. If the speed is noticeably slower, try connecting to a different VPN server, one that is physically close to you. Some VPN software handles this automatically, that is, it tries to find the fastest available server for you automatically. If you prefer manually picking a city or country that you would like to connect to, some VPN software will show you how busy each available VPN server is, in that city/country. Compared to Tor, VPNs are much much faster.

I suppose just having to turn the VPN on and off is a downside for some people. To counter that, many VPNs can be configured to start automatically when the computing device boots up. Personally, I am not a big fan of this because I fear that it may prevent the device from booting at all.

For devices that are frequently off-line, the VPN client software should be able to wait patiently until the device goes on-line again and then automatically re-connect. If your VPN software can not do this, it is annoying on the one hand, and all but insures, you will forget to enable the VPN at one time or another.

Even when using a VPN, there are many ways that a web browser can still spy on you. One way to counter this is to use the Tor browser. However, Tor is brutally slow, so in April 2023 Mullvad created a new web browser, the Mullvad Browser. Basically, this is the Tor browser but without Tor. The Mullvad Browser can be used with any OS level VPN or even without a VPN at all. Both the Tor and Mullvad browsers have many customizations that avoid fingerprinting, that is, they try to make all users of the software appear to be the same. The Mullvad browser is free and available for Windows, macOS and Linux. There is no Mobile version. It uses the Mullvad DoH DNS service that is available to everyone, not just Mullvad customers. They offer two free DNS services, the default one does not block ads, but this can be changed.

  OPERATING SYSTEM VPN BUGS   top

IOS

Apple sends data outside of a VPN connection. They do this on purpose and they can not be shamed into doing the right thing. Their security marketing message is a fib. This is a long story that boils down to not trusting any VPN on an iPhone or an iPad because they all leak data outside the VPN tunnel.

This was first reported by ProtonVPN in March 2020 for iOS version 13. See VPN bypass vulnerability in Apple iOS. I blogged about this in May 2022: VPNs on iOS are a scam and kept updating my blog through October 2022. Security company Disconnect wrote about the problem in March 2022. See Leak advisory: Apple and *All* iOS App Developers Are Able to Unmask VPN Users. In August 2022, VPN company IPVanish wrote an excellent article that went into three different types of leaks in iOS VPNs: iOS VPN leaks: why they happen and how to prevent exposure. In August 2023, VPN company IVPN wrote about this Removal of kill switch from our iOS app due to Apple IP leak issue.

ANDROID

There is a bug in Android, up to and including version 14 that, sometimes, sends data outside the VPN tunnel. Google seems to be taking their sweet time fixing it. But, unlike Apple, chances are that they will, eventually, fix it.

May 3, 2024: Mullvad found the bug and blogged about it: DNS traffic can leak outside the VPN tunnel on Android. They took a small step in the app to partially fix the problem, but the bug is in Android.

June 13, 2024: IVPN write a blog about this DNS traffic leak outside VPN tunnel on Android.

July 3, 2024: ProtonVPN writes: Why you should use a VPN on your mobile device by Douglas Crawford. No mention is made about either the known VPN problems in iOS or this known bug in Android. Very disappointing.

April 2024: Mullvad's initial bug report to Google: VPN leaks DNS traffic outside the tunnel. Quoting: "We’re from Mullvad VPN and after a recent user report about DNS traffic leaking in specific circumstances we immediately started investigating the issue. We were able to confirm that Android leaks DNS requests outside the VPN tunnel and that the leaks were not limited to the specific case raised by the user. We’ve done multiple tests over the last few days but all the details surrounding under which conditions the leak happens is yet not clear, what is clear though is that Android do leak DNS traffic outside the VPN tunnel in certain conditions."
The buggy Android function was eventually found, but there are no known work-arounds.

Windscribe has said nothing about this on their blog.

PREVENTION

As described in the section below, there is way to prevent these leaks, but it is beyond the reach of most people. You need a router that supports outgoing firewall rules. After, connecting to a VPN server, say at IP address 1.2.3.4, set a firewall rule that only allows the VPN-connected device to communicate with 1.2.3.4. Any outbound traffic to anywhere else, gets blocked. Log the blocks too, to see where the technology has let you down.

VPN SERVER SOFTWARE BUG

July 18, 2024: A paper was released in July 2024 that found six attackable flaws in VPN server software. The official name for these bugs is "Port Shadow". There are some mitigations for some of the flaws. It is very technical in nature (beyond me for the most part), thus very few people can really understand it and the danger it presents.

Perhaps the most important point to these bugs is whether your VPN provider says anything about them at all. I suspect that most VPN companies to be mute on this. Hopefully a small number will brag about the mitigation steps they took. It can be a great way to judge a VPN provider.

  IS THE VPN WORKING?   top

iPhone 13 mini warning: There is no visible indication that the VPN is connected when using an iPhone 13 mini (last verified on iOS 17.4). So, if the VPN disconnects, you don't know. To see the VPN status, you have have swipe down from the upper right corner to bring up the control panel. Not good.

Things to test before and after connecting to a VPN:

 

 CHOOSING A VPN - SOFTWARE FEATURES  top

 The tech press generally evaluates a VPN based on speed, price, logging and the number of servers. All of these criteria are wrong.

 Choosing a VPN - Who Owns The Company  top

Many VPN providers share the same corporate ownership.

  1. Kape: In September 2021, Kape Technologies purchased ExpressVPN. They already owned CyberGhost, ZenMate and Private Internet Access (PIA). See Former Malware Distributor Kape Technologies Now Owns ExpressVPN by Sven Taylor. Kape also owns VPN review websites vpnmentor.com and wizcase.com. Kape is not particularly trustworthy. Then too, there is this May 2023 writeup from Pen Test Partners: Bullied by Bugcrowd over Kape CyberGhost disclosure byCeri Coburn, in which the company had a very hard time reporting a bug in the CyberGhost software to Kape.
  2. J2Global owns IPVanish and StrongVPN, as well as PC Magazine and Mashable, both of which, review VPNs. They also own Ziff Davis which, in turn, owns the encrypt.me and Internet Shield VPNs.
    Update Nov. 2022: In this video, The DARK side of VPNs Naomi Brockwell says that while Ziff Davis claims to own six VPNs, they really own 13 and maybe more. Skip to 15 minutes 30 seconds.
  3. Some VPN companies are very clear about their ownership:
  4. ProtonVPN: Proton started in 2014 when some scientists at CERN created ProtonMail to make privacy accessible to everyone. ProtonVPN was released a few years later. In this undated article, Who owns ProtonVPN, they say that the company is employee-owned. In this May 2023, Twitter thread they say the company was founded by Andy Yen who, before that, was a particle physicist a CERN, Harvard and Caltech. It is "largely subscription-funded" and there are "no venture capital investors".
  5. From Windscribe: Their VPN map shows the relationships between VPN companies, their corporate owners, and paid affiliates who profit from reviewing them positively. See VPN Relationship Map.
  6. OVPN: This undated blog was valid until May 2023: Who are the people behind OVPN? at which point the company was sold as described in this blog by David Wilbergh (one of the two owners): Next chapter for OVPN (May 8, 2023). OVPN is now owned by Pango which also owns other VPNs: Hotspot Shield, Betternet, VPN 360 and Ultra VPN. Eh. I had a high opinion of OVPN and used their service before this change of ownership. Who owns Pango? They say" "We are proudly backed by some of the leading investor groups, including Warburg Pincus, WndrCo, Accel, and General Catalyst." And, more. Pango is owned by Aura.com which also has their own VPN service. Read about Aura. Both Pango and Aura have no physical location according to their websites.
    July 8, 2024 update: The item linked to above about who are the people behind OVPN, has been revised. It was last updated January 11, 2024 and now says: "OVPN is operated by OVPN Integritet AB. Organization number: 556999-4469. The owner of OVPN is Pango." However, this page is buried/hidden on the ovpn.com website. It is in the Tech Support section, under General Information and not even in the main index for General Information. Meanwhile, easily found pages still have the old information which omits the Pango ownership. For example, the About page is undated and says nothing about Pango. Interested in being an OVPN Affiliate? That page says "The company is 100% owned by David Wibergh & Ruben Rehn." Their Press Resources page also says that "The company is 100% owned by David Wibergh & Ruben Rehn." It too is conveniently undated.
  7. Clearly, security company F-Secure runs the Freedome VPN.
  8. When I first wrote this (I did not save the date), the About Us page for Surfshark avoided the issue of ownership. As of January 2023, it says: "The founder of Surfshark is Vytautas Kaziukonis. In 2022, Surfshark and Nord Security merged under one holding company to form a cybersecurity powerhouse while still operating independently."
  9. The About us page for Astrill says "We are a registered Seychelles company". It does not mention anything else about the company and it says nothing about any of the people involved.
  10. The About Us page for TunnelBear has cartoon pictures of bears. As of March 2018, TunnelBear was owned by McAfee. This despite McAfee offering their own VPN. In November 2021, McAfee agreed to sell itself to a group of Private-Equity investors (Advent International, Permira Advisers, Crosspoint Capital Partners, Canada Pension Plan Investment Board, GIC Private Limited and a subsidiary of the Abu Dhabi Investment Authority). As a rule, things go downhill quickly when a company is owned by private equity investors.
    February 3, 2023: the Tunnelbear About Us page has no information about who/what owns the company. It still has the cartoon bear pictures for each employee, along with their first name, last initial and a made-up joke of a job title. It is useless childish fluff.
    February 9, 2025: Still no information about who/what owns the company.
  11. Nord Security Ltd. owns NordVPN, Surfshark and Atlas.
    In February 2022 it was announced that NordVPN and SurfShark were merging, as per this article in PC Magazine: NordVPN's Parent Company Is Merging With VPN Provider Surfshark. Why are they merging? They said "...the merger will open new technical knowledge-sharing opportunities and enable more focused market diversification." Is that what you want in a VPN provider? It was unclear who will run the combined company which will be called Cyberspace. It was registered in The Netherlands.
    As of January 2023, the Atlas VPN website said: "In 2021, Atlas VPN became part of Nord Security" and "Atlas VPN is a service of Peakstart Technologies Inc, a US company registered in Delaware and a subsidiary of Nord Security Ltd. which owns NordVPN and Surfshark VPN."
  12. 3 companies control many big-name VPNs: What you need to know by Attila Tomaschek of CNet (Feb 2022)
  13. Hidden VPN owners unveiled: 104 VPN products run by just 24 companies by Jan Youngren of VPN review website VPNpro (Oct 2021).

 Choosing a VPN - Anonymity  top

One downside of a VPN, compared to Tor, is that the VPN company normally knows who you are, if for no other reason than you paid with a credit card.

 Choosing a VPN - Other Criteria  top

There is still more to choosing a VPN provider. Ugh.

Many VPN companies rent their servers. It is more secure if the VPN provider owns their own servers. Many VPN companies use a VPS (Virtual Private Server). It is more secure to not use virtualization (called a bare-metal server or a dedicated server). It is also more secure if a VPN server runs totally in RAM and never writes to the hard disk (called RAM-disk mode). Most VPN companies are mum on these points. A good survey on these two points is at Restore Privacy. It says: ProtonVPN and VPN.ac use dedicated bare-metal servers, all ExpressVPN servers use RAM-disk mode, Perfect Privacy uses bare-metal servers running in RAM-disk mode, OVPN uses dedicated bare-metal servers running in RAM disk mode, that they own. Mullvad owns some of their servers but most are rented. AzireVPN also uses dedicated servers running in RAM disk mode, that they own. They blogged about this in September 2022: Why we Own our Own Servers.

Diskless servers: Some VPN companies use disk-less VPN servers. These are server computers where the operating system exists only in RAM. When the computer is powered on, it downloads the operating system and starts running it. This is also referred to as a RAM-Only server. Some VPN providers offering this are: Mullvad, OVPN, NordVPN, ExpressVPN, Surfshark, Private Internet Access, CyberGhost and AzireVPN. It is claimed that this increases privacy because when a server is powered off or re-booted, everything in RAM is lost. It also makes it harder (not impossible) to create logs. If nothing else, it makes the servers more reliable as there is one less thing to break and they probably run cooler too. In my opinion, this is nice to have but not a show-stopper feature.

Marketing honesty: Many VPN companies make vague promises of security, privacy and anonymity. This is stretching things. Look for a VPN company that is very clear about exactly what a VPN can and can not do.

Installation instructions: Most of the time, you have to install software to use a VPN. The instructions provided by the VPN companies differ greatly. I have seen companies that document every step of the install and others just say run the file you downloaded. You should be able to find the installation instructions on the website of the VPN company.

Canceling: How a VPN provider handles customers canceling their accounts can tell us something about the company. I have tried to cancel two VPN accounts before the time had run up. IVPN handled it very well, ProtonVPN did not. ProtonVPN accounts auto-renew and you can not tell them not to renew when your time is up. You can only tell them to cancel now. Right now.

Technical Communication: When there is an industry-wide VPN issue, does the company explain how it affects them? This happened in August 2023 with the TunnelCrack flaw. Mullvad responded on Aug. 9th: Response to 'TunnelCrack' vulnerability disclosure. IVPN responded on Aug 10th: IVPN + TunnelCrack vulnerability information. As far as I can tell ProtonVPN, NordVPN and AirVPN said nothing.

Dedicated IP address: A normal VPN environment has multiple customers sharing a single VPN server computer. This offers some anonymity as anyone monitoring data coming and going from the VPN server machine will see data/traffic for all the customers. And, the number of customers on the machine will always vary. To me, this is a good thing. However, in some cases people want a VPN server just for themselves - a feature typically referred to as a dedicated IP address. Not all VPN providers offer this feature and those that do charge extra for it.
  One reason to want a dedicated IP address is less nagging. Oftentimes VPN customers have to jump through hoops that others do not - an extra CAPTCHA for instance. Or, access to a website may be blocked when using a VPN. Still another reason is your own personal source IP blocking. For example, if you have to leave a port open on a router, a good router can limit the IP addresses that are allowed to communicate on that open port. You can get the same effect by using a small VPN provider that has only one or two servers in a given physical location. The large VPN providers have many servers in each location.
  However, if you have a target on your back (say you are a high profile person) then having a dedicated IP address makes it easier to spy on you. Personally, I often change the VPN servers that I connect to.

Change Log: It is nice to see a list of changes made to the VPN client software. If bugs are fixed, you want to know if they were in features you use. The log also includes new features, ones that you might not have otherwise known about. Some software releases are major, others are minor. Standard practice is to avoid the major releases for a while until the inevitable bugs are fixed. A change log shows which releases contain many updates and which just fix one or two bugs. Perhaps most importantly, it is a sign of professionalism to publish a Change Log. I publish one for this very website.
Examples: The Windscribe Change Log is here for their Windows, macOS and Linux software. Mullvad publishes their Change Log (and source code) on GitHub. IPVN maintains a Change Log for their desktop software (Windows, Linux, macOS) and there is a link to it on the page where you download the software. They have separate Change Logs for their iOS and Android apps but again, they link to it on the page where you download the apps. I could not find a Change Log for ProtonVPN on their website. I also checked their iOS app and there was no Change Log there either.

Praise: Finally, you don't see this every day. In April 2022, the Windscribe blog featured a puff piece on the founder of the company: Who is Yegor Sak? The Man Behind The Meme by Catt Garrod. The article included this: "I started using VPNs in 2009 for my daily Internet activity ... This led me to learn all about what VPNs can and cannot do ... The one that stood out as different and I personally used for years was IVPN. Windscribe was very much inspired by how that company was operated: solid apps, no marketing speak, brutally honest information on capabilities and limitations.".

The website Privacy Guides recommends three VPN providers: Mullvad, IVPN and ProtonVPN. At first glance, they seem independent and not biased.

 

 VPN PROVIDER WARNINGS  top

This 20 minute November 2022 video, from Naomi Brockwell, has many warnings: The DARK side of VPNs. She interviews VPN expert Jonathan Tomek. At the end he recommends Mullvad.

Other VPN providers too, have been caught doing bad things.

Misleading pricing: From How Cheap VPNs Can Cost More Than You Bargained For by Fergus O'Sullivan for HowToGeek. February 8, 2023. Some VPN providers offer initial discounts and revert to higher fees afterwards.

 

  Block Ads/Tracking While Using a VPN   top

As a rule, the job of blocking ads and/or trackers falls to your web browser and its extensions. But some VPNs can do this too. One advantage of VPN blocking is that it applies to the entire operating system, not just one web browser. If you connect to one of these VPNs from a router, it can block ads/tracking on any device connected to the router. The downside of any such blocking (in a browser or a VPN) is carving out exceptions to the rules.

These VPNs do blocking:

  1. IVPN calls their tracker blocking feature AntiTracker. Initially they used a single block list. Around August 2023, this was expanded and they now offer 10 different lists and you can customize the ones you want. Despite the name, these lists block both ads and trackers. That said, they do not let you specifically block/allow a single domain or sub-domain. See Better tracker blocking controls with AntiTracker Plus by Viktor Vecsei of IVPN. Also AntiTracker Plus Lists Explained.
  2. ProtonVPN calls their ad/tracker blocking feature NetShield. It uses DNS filtering to protect you from malware, blocks ads, and prevent website trackers from following you around the web. It is only available to paid customers.
  3. Mullvad added support for custom DNS server configuration on macOS, Windows, Linux and Android in April of 2021. This can be used with an assortment of DNS providers that block ads/trackers. In May 2021, they introduced ad blocking How to set up ad blocking in our app. In June 2021, ad and tracker blocking was a new feature in their iOS app (How we’re knocking down ads and tracking). In March of 2022, they added malware blocking. See Adding another layer: Malware DNS blocking. Their customers can enable or disable each type of blocking individually. They also offer ad blocking for free to anyone, not just their customers, via their secure DNS service. DNS over HTTPS and DNS over TLS (last updated November 2021).
  4. OVPN added ad/tracker blocking to their Android and iOS apps in November 2021.
  5. At Perfect Privacy, their TrackStop feature blocks ad-tracking and phishing.
  6. The Disconnect Privacy Pro SmartVPN blocks trackers on iOS. Their Premium VPN blocks trackers on iOS, Android and macOS.
  7. Windscribe VPN offers what they call a "One-of-a-kind customizable server-side domain blocking tool" that blocks ads and trackers. And, you can customize it. They call the feature R.O.B.E.R.T. Their big advantage is that you can easily customize the blocking with your own block list and allow list - much like NextDNS.
  8. The Freedome VPN from F-Secure blocks trackers on iOS, Android, Windows and macOS.
  9. The Guardian Firewall + VPN app on iOS "blocks digital trackers from secretly collecting your information." It is from the Sudo Security Group. For free, their VPN service alerts about tracking but does not block. I wrote about it in August 2019.
  10. On Android, there are three versions of the Blokada ad-blocker. The free version that blocks ads is not allowed in the Play Store. It installs a VPN, but only to block ads by intercepting DNS requests. There was a trivial version in the Play Store that also installed a VPN but all it did was modify the DNS servers. Currently (Feb.2020) the version in the Play Store is called Blokada Slim and it combines the older DNS changer with a fairly new, real, VPN called Blokada Tunnel which costs 5 Euros/month (roughly $5.50 in US dollars). Great feature: customized white and black lists.
  11. Coming: AdGuard VPN (Jan 2020). They are writing a new VPN protocol, which is not a good sign.
  12. Android 9, 10, 11 and 12: There is an interesting conflict between a VPN and the Android Private DNS feature. Each wants to be in charge of the system-wide DNS. In a test of Android 10 with three VPN providers, Private DNS won out every time. This was not a DNS leak, the DNS requests went through the VPN tunnel and the Private DNS resolver sees requests coming from the VPN server, not from the VPN client. However, in a test with Android 9, the VPN DNS won out. Beats me why. If Private DNS wins, and you use NextDNS, then any VPN can be used alongside the ad and tracker blocking from NextDNS. The best of both worlds. I tested with multiple DNS testers on my RouterSecurity.org site.

 

  FYI ON LOCATION HIDING   top

All VPNs claim to hide your physical location and/or let you appear to be somewhere else. This stems from the fact that, with a live VPN connection, all data going to/from the Internet passes through the VPN server. Your pubic IP address is that of the VPN server not your home or office. In the old days this was sold for the anonymity it offered. Later, it was sold so that people in the US could listen to the BBC.

But the claim predates smartphones, spy machines that they are. A smartphone can locate itself using GPS, Wi-Fi, cell tower location and probably even Bluetooth (not sure). I have tested Wi-Fi based locating and found it extremely accurate. So, if the phone knows where you are, who is to say whether it leaks this information to the outside world. And the outside world, on a phone or a desktop computer, is not just websites. Modifying your public IP address is not the be-all and end-all that it used to be. It is still a good thing, but it may no longer be sufficient.

The June 2022 issue of Unredacted Magazine had a story about this. The anonymous author is a privacy enthusiast. He uses a router with VPN client software, and the router makes a VPN connection that all LAN side devices pass through. One of the LAN side devices is an Xbox that is Ethernet connected to the router. You might think that the outside world only knows about the physical location of the VPN server. That's what the author of the article thought ... until he checked his Xbox Account Settings page and found a picture of the apartment complex where he lives with a pin in it indicating his apartment. It turns out that the Xbox uses Wi-Fi and that it can not be disabled. The Xbox was spying on him. It listened to all the SSIDs and MAC addresses being broadcast by the routers of his neighbors and calculated his location. VPN be damned.

In August 2023 Windows malware (dubbed "Whiffy Recon") was discovered that surveyed the nearby Wi-Fi networks and sent the resulting information to Google using their Geolocation API. While it is not known what the malicious software does with this information, it shows that even if Windows is configured not to track its location and the web browser is also configured not to tell the location to websites, it is still available to software running on the PC. For more see: Whiffy malware stinks after tracking location via Wi-FI by Brandon Vigliarolo for The Register (Aug 28, 2023) and Smoke Loader Drops Whiffy Recon Wi-Fi Scanning and Geolocation Malware by Secureworks (Aug 23, 2023).

In May 2024, Brian Krebs wrote Why Your Wi-Fi Router Doubles as an Apple AirTag. The title is a bit much, but the article describes a new research paper that shows how iOS and Android devices use nearby Wi-Fi networks to figure out where they are. This means that Apple and Google know exactly where every Wi-Fi router is located. A VPN does nothing about this, only Ethernet does.

If hiding your location is really important, it is best to use a device without Wi-Fi or GPS or Bluetooth. On a smartphone or tablet, disable them and hope the phone operating system honors your request. On a cellphone, airplane mode should prevent it from contacting cell towers. I say "should" because I don't know how to verify this. Even if you can not make or receive a phone call, that does not insure that the phone is not communicating with a cell tower. After disabling Wi-Fi, GPS and Bluetooth, re-boot the device to insure that it is not still using a recently detected location.

Clearly, Ethernet is your friend here. iPhones and iPads can use Ethernet with an appropriate adapter. Likewise there are USB type A and USB type C adapters for Ethernet that can be used with any computing device with a USB port.

To put this in perspective, the strongest option is preventing the operating system from knowing where it is. If this is not possible, then you need to try and prevent the operating system from giving the location to applications and to web browsers. In the case of browsers, there are probably configuration options in both the browser and the operating system for this. For more on this, see the Location Tracking topic.

Windows 10, for example, offers OS level configuration options for Location in System Settings -> Privacy -> Location. In the resulting panel, insure that everything is off. On a lower level, Windows users should probably disable the Windows Geolocation service (a.k.a. lfsvc). The description says that it "...monitors the current location of the system and manages geofences (a geographical location with associated events). If you turn off this service, applications will be unable to use or receive notifications for geolocation or geofences." There may be a down side to disabling this service, I have not tested this extensively. But, I doubt it.

As an example of browser location settings, consider the Location settings for the Chrome browser (the screen shot is from Chrome 93 on Windows). You can access the location settings in Chrome at chrome://settings/content/location (last checked with v116 on Windows 10). Here is where you control whether the Chrome browser is allowed to tell websites the location of the computer/phone/tablet. This assumes that the operating system and the browser already know the location. One slip-up in configuring this and a VPN can no longer hide your location from a website.

An article on this: How does my browser know my real location when I'm on a VPN? by pcwrt (January 2021).

I have yet to see any VPN provider mention that location blocking should be configured in both the operating system and the web browser that you use. That would burst their marketing bubble.

Fighting with the operating system and the browser is complicated, error prone and, even if done right, involves some trust that the software is doing what its told. The safer approach is to insure the operating system can not learn its location in the first place. Ethernet is your friend.

 

  FYI ON DEVICE LIMITS   top

NOTE: This topic was added December 10, 2023

If you use a VPN provider that has no device limits, then skip this section.

Both IVPN and Mullvad (and no doubt many others) limit the devices that can concurrently connect to the VPN. But, they both do a disgracefully miserable job explaining this, so I will attempt to here. Assume the device limit is 5, just for the sake of this example.

With both companies, you can install the software on an unlimited number of devices.

With both companies the first 5 devices work fine. Dull and boring.

The sixth device is where things get ugly. This is because, the device limit is not on the number of concurrently connected devices. Even if the first 5 devices are off-line the 6th device will fail to connect to the VPN. The limit is on something neither company explains. For lack of a better term, I will call the limit on REGISTERED devices.

What is not explained is that each device first REGISTERS before it connects to the VPN. The 6th device fails because the maximum devices are already REGISTERED. For the 6th device to connect to the VPN, you first have to de-register one of the first 5.

Mullvad lets you de-register a single device. But, they identify REGISTERED devices using their own code names, which you have to track. REGISTERED devices do not get user-friendly names like "Susans ipad".

IVPN does not let you de-register one device. For the 6th device to connect, all of the first 5 need to be DE-REGISTERED. The good news is that the customizations made to the settings are not lost when a device is DE-REGISTERED (only tested on Windows).

 

  DOUBLE VPNs   top

You can increase your anonymity by using a VPN inside a VPN. Start with a normal Operating System level VPN. Then, while it is connected, use a web browser that has a VPN extension for a different VPN provider.

How does this protect you? The OS level VPN company will only know that you connected to the Browser VPN company. They can not see anything that you do in the browser. The Browser VPN company can see what you do (like any VPN provider) but they do not know where you are. They see you as a customer of the OS level VPN provider. They may, however, know who you are.

If you can be anonymous to the Browser VPN company, all the better. Perhaps the Browser VPN has a limited free tier or a free trial that can be used without providing personal information. Or, you can pay for some VPNs with cash or a gift card. I would avoid any VPN provider that only offers a free service.

Not all VPN companies offer a web browser extension. Some that do:

  1. NordVPN calls theirs a VPN proxy extension and it works with Chrome, Edge, and Firefox.
  2. TunnelBear has extensions for Chrome and Firefox. It is a paid service with a limited free tier.
  3. Windscribe has extensions for Firefox and Chrome. It too, is a paid service with a limited free tier.
  4. ProtonVPN has a browser extension that works with both Chromium-based browsers (Google Chrome, Brave, Microsoft Edge, Chromium, Opera, and Vivaldi) and Firefox-based browsers (Firefox itself, LibreWolf, and Waterfox). See Introducing the Proton VPN browser extension by Antonio Cesarano of Proton (last updated Sept 3, 2024) and How to use the Proton VPN browser extension by Proton (undated). Download it from the Chrome Web Store or from the Firefox Add-ons.
  5. The Opera browser has its own free VPN as part of the browser itself, no extension needed.
  6. Microsoft's Edge browser has a free VPN called the Edge Secure Network that uses services from Cloudflare. The free tier initially had a 1 gigabyte per month limit, but that was raised in July 2023 to 5 GB. Microsoft and privacy, of course, are like oil and water. Microsoft requires users to be signed in to a Microsoft account to use the VPN, so, no anonymity. According to this article (by Mayank Parmar for Bleeping Computer July 3, 2023) signing in to a Microsoft account enables the sync feature of the browser, which makes browsing data accessible across all signed-in versions of Edge. This includes browsing history, favorites, settings, form fill data, passwords, extensions, open tabs, and collections. Not a good choice.
  7. The Epic browser includes a free VPN and it can be installed on Android, iOS, Windows and macOS. That said, I am not familiar with it at all.

Not all browser VPN extensions are limited to just the browser, some work at the Operating System level and thus can not provide a VPN inside a VPN. This is true for the ExpressVPN browser extension and the Mozilla VPN. On Android and iOS, Brave includes a VPN (powered by Guardian) that also works at the operating system level.

Another option for double protection is offered by the desktop (Windows, macOS, Linux) versions of the Brave browser which includes access to the Tor network, no need to install an extension. The option is called "New private window with Tor".

A third approach is to run a normal Operating System level VPN on your computing device, while it is connected to a router that has its own VPN connection. This is most secure when each VPN connection is to a different VPN company.

A fourth approach is only available to Apple Safari users willing to pay for it. The system is called iCloud Private Relay and it is available on iOS, iPadOS and macOS. Users must pay for iCloud+ and it only works with the Safari browser. Like a VPN, it hides your public IP address. Unlike a VPN, Apple claims that they can not spy on you. Not that they don't , but that they can not.

As to how it works, this is from Apple iCloud Private Relay & Privacy (September 20, 2024): "Your internet connection requests are routed through two separate relays operated by different entities. The first knows your IP address, but not the website you are visiting. The second knows the website you are visiting, but not your IP address, instead providing a generalized identity and location to the destination website. In this way, no single entity has the information to identify both you and the sites you visit."

The first relay device/server that Safari talks to is owned by Apple, the second relay device is not. Who owns/runs these secondary relay servers? Apple does not say, they only say it's not them. DNS requests are encrypted such that the ISP and the Apple-owned first relay thingy can not see them (this assumes old insecure DNS). Both Apple and the ISP do see your public IP address. The second relay thingy decrypts DNS requests and sends your data/traffic out to the Internet. To the rest of the world, your traffic is seen as coming from the second relay thingy. More: iCloud Private Relay Overview (2021).

In February 2025, a fifth double-VPN approach was introduced - Obscura VPN has a partnership with Mullvad. Mullvad announced this on Feb. 11th: Mullvad has partnered with Obscura VPN. At the time, Obscura VPN software was only available on macOS. Obscura customers connect to Obscura VPN servers, but Obscura then connects to a Mullvad server and the traffic exits onto the Internet from a Mullvad server. The claim is that "This two-party architecture ensures that neither Obscura nor Mullvad can see both your identity and your Internet traffic." It is easy to see how Mullvad does not know who you are, all they see is data coming from Obscura. Mullvad should not see your public IP address and you are not their customer. The claim that Obscura also can not see into their VPN tunnel is a stretch. If not for the involvement of Mullvad, I would not believe it. Obscura says "Your traffic is always end-to-end encrypted via WireGuard to the exit server." More from them here: Trust, 2-Party Relays, and QUIC. Even if an Obscura server can not see into your tunnel to them, certainly their macOS software can. I write this in Feb. 2025 and it is too early yet to have a pro/con opinion

  VPN ARTICLES   top

January 17, 2025: If you use a VPN for a TikTok ban, make sure it’s one you can trust by Shira Ovide in the Washington Post. Recommended VPNs are: Mullvad, IVPN, Proton VPN and Mozilla VPN (which is Mullvad under the covers). That said, judging a VPN by watching British videos from the US, is the wrong criteria. It does not make the conclusions wrong, just realize that the author of this article is not a techie. Fortunately "digital security and privacy experts" were consulted.

This article in Wired magazine is really bad: Protect Your Home Wi-Fi Network by Setting Up a VPN on Your Router by David Nield April 25, 2024. The purpose seems to be earning commissions, not informing readers. To begin with it talks about a VPN without distinguishing between VPN server and VPN client software. A huge omission. Just a big, is that there is no mention of the different types of VPNs. It does mention OpenVPN but does not state that it is only one of many types. Then, it mentions a couple VPN providers that sell routers with their software pre-installed but does not bother to mention that many VPN providers do this. And, no mention of my favorite VPN on a router company pcWRT. And, there is no discussion of the pros/cons of running VPN client software on your only router vs. using a second router plugged into the main one. And, editing sloppiness: saying at a VPN on a router protects all your Wi-Fi devices, as if Ethernet devices did not also get protected. If you had any respect for Wired, well ...

 

  ADVANCED TECHIE STUFF   top

The below is very technical, scholarly research into VPNs.

UNIVERSITY of MICHIGAN

The paper, VPNalyzer: Systematic Investigation of the VPN Ecosystem by researchers at the University of Michigan is long and dense and looks at a number of criteria never found in the tech press. They wrote their own software to perform assorted technical evaluations of VPNs. Their software ran on Windows, macOS and Linux, so nothing in the paper applies to iOS or Android. They studied 80 different VPN providers. Some findings (there is much more) are below.

ARIZONA STATE UNIVERSITY

Researchers from a number of different universities looked into hacking VPNs. This is an introductory article about their research and findings: Are virtual private networks actually private? by Annelise Krafft of Arizona State University (October 2022).

UNIVERSITY of MICHIGAN (again)

OpenVPN is Open to VPN Fingerprinting by Diwen Xue, Reethika Ramesh, and Arham Jain, University of Michigan; Michalis Kallitsis, Merit Network, Inc.; J. Alex Halderman, University of Michigan; Jedidiah R. Crandall, Arizona State University/Breakpointing Bad and Roya Ensafi, University of Michigan. This was an August 2022 USENIX presentation. The page has both a PDF and slides. Quoting: "To investigate the potential for VPN blocking, we develop mechanisms for accurately fingerprinting connections using OpenVPN ... We identify three fingerprints based on protocol features such as byte pattern, packet size, and server response ... we identify over 85% of OpenVPN flows with only negligible false positives, suggesting that OpenVPN-based services can be effectively blocked with little collateral damage ... Although some commercial VPNs implement countermeasures to avoid detection, our framework successfully identified connections to 34 out of 41 'obfuscated' VPN configurations."

 

  MY USER EXPERIENCES   top

The experience of using a VPN varies drastically, not only from company to company, but also from operating system to operating system with the same VPN provider. With that in mind, this haphazard section offers some insight into the user experience on a handful of operating systems with a few VPN providers (Windscribe, IVPN, OVPN, ProtonVPN, Mullvad).

See my user experiences (Note: this was moved to its own page November 12, 2023.

 

 This page: 37 views per day (over 1,215 days)   Total views: 44,608   Created: October 17, 2021
This Page
Last Updated

February 11, 2025
Site Page
Views TOTAL

 1,097,343
Site Page
Views TODAY

  1,219
Website by
Michael Horowitz
@defensivecomput
top
Copyright 2019 - 2025