A Defensive Computing Checklist    by Michael Horowitz

NOTE: I gave a presentation on Defensive Computing at the HOPE conference in July 2022

HOME | Full Site Index | Domain Names | VPNs | iOS | Android | About | Rules of the Road | DC Presentation |

VPNs

Topics below: Introduction   Is the VPN working?,   Choosing a VPN - Software Features,   Choosing a VPN - Other Criteria,   Blocking Ads and Tracking while using a VPN,   An FYI on Location Hiding,   Double VPNs,   Advanced Techie Stuff,   My User Experience with some VPN client programs

 INTRO

At the simplest level, a VPN is an encrypted connection between two computing devices. The data that flows between the connected devices is encrypted by the software that created the connection. One of the devices is referred to as the VPN server. Like any other type of Server (web, email, etc) a VPN server sits and waits for computers to connect to it. The other device is the VPN client. It is the client that initiates the VPN connection between the two devices.

Software running on a computing device is what determines if it functions as a VPN client or a VPN server. Devices such as phones, tablets and personal computers are usually the VPN clients. Routers are interesting in that many can be either a VPN client or a VPN server. Then again, many routers can do neither. Oftentimes a computer is dedicated to function as a VPN server, so the hardware and software are thought of as one and the same.

There are different flavors of VPNs and both the client and server must be the same flavor. Popular flavors are OpenVPN, WireGuard and IKEv2.

In addition to flavors, there are also different categories of VPNs. Perhaps the biggest category is Consumer vs. Business. Business VPNs are run by large companies for their employees. Typically they connect remote employees to the head office, and they may also be used to connect different buildings in different cities to form one big company-wide network. This page is about consumer VPNs, employees of a large company have their own tech support and don't need anything from me.

With Consumer VPNs, the VPN servers are provided by a VPN company such as Mullvad, ProtonVPN, NordVPN, IVPN, ExpressVPN and hundreds more.

Google's Jigsaw division provides a free VPN called Outline. It differs from Consumer VPNs in that they provide the VPN server software that you have to install, configure and operate. They do their best to make setting up the VPN server as easy and cheap as possible. As to easy, they provide desktop software to install and configure the VPN server. As for cheap, the point out that the VPN server can be run on cloud-based Linux Virtual Machines for as little as $5 US/month. They also claim that their VPN is harder for bad governments to block. Again, this page is focused on Consumer VPNs. Maybe someday, I will get to kick the tires on Outline. Techies, as a rule, are disgraceful at explaining and documenting things, so whether a newbie to the software can actually get it to work will be interesting. In October 2022, the Washington Post said that nthLink offers a version of Outline that is easier to install and more flexible. I took a look at the nthLink website and found it totally devoid of information; a useless site chock full of buzzwords.

The connection between VPN client software on your device and a VPN server, somewhere on the Internet, is referred to as a "tunnel". When it is working as designed, all data entering and leaving the device running the VPN client software travels through the tunnel and is encrypted/decrypted by the VPN software at each end. The term tunnel is quite good, as it illustrates that only the two devices at each end of the tunnel can see the data. To anyone/anything outside the tunnel, all they see is encrypted useless junky bits.

NOTE: There are times when a device running VPN client software does not want all the data coming/going to travel through the VPN tunnel. This, however, is the exception. The official term for this is Split Tunneling. For example, there are some websites that test for the presence of a VPN connection and refuse to work with a VPN. In that case, the computing device running the VPN client software might want to make that one website an exception and let it travel outside the VPN tunnel. The alternative would be to shut down the VPN tunnel when accessing that website.

Who is outside the tunnel? Your ISP for one. Blocking spying by an ISP is especially important in the US, where ISPs are allowed to spy on their customers and sell that data. For details on this see, Internet Service Providers Collect, Sell Horrifying Amount of Sensitive Data, Government Study Concludes by Karl Bode (Oct. 2021). If you are in a public coffee shop, your fellow coffee drinkers are outside the VPN tunnel. If the VPN client software is running on your phone or tablet or computer, then the router is also outside the VPN tunnel.

That a VPN hides everything from the router and the ISP is how people in China can interact with the rest of the world. It is also how students in a school can bypass restrictions and see websites that teachers try to block.

As noted above, routers are computers and some can function as VPN client, some can function as a VPN server, some can do both and some can do neither. The advantage to using VPN client software in a router is that all the devices connected to the router are protected by the VPN tunnel created by the router. This can protect devices, such as a Smart TV that are not able to run VPN client software on their own.

There are two reasons to use a VPN server in a router. The first is to provide a secure way to access the devices in your home when you are away from home. The other is to use your home router as a free replacement for paid consumer VPN providers. Again, when away from home, you can connect to the VPN server software in your home router and use that secure, encrypted tunnel to hide your activities from the devices near you. Note however, that this does let your home ISP spy on you.

Some people have argued that since a "secure" website (using HTTPS) prevents others from reading the content of web pages, there is little need for a VPN. However, others can still tell which websites you visited. In some cases, just the website name gives away too much information. And, websites are not the only thing on the Internet. With mobile apps, for example, you can not tell if data is being transmitted securely or not.

In addition, a VPN will change your public IP address, so you can pretend to be in a different physical location.

• On a trivial level, this can be used to see stuff that is normally restricted by country. For example, Canadians might connect to a VPN server in the US to access American Netflix if our Netflix offers shows that are not available in Canada.
• On a more serious level, this can be used to hide your physical location, just as Tor does. However, Tor only attempts to hide activity inside the Tor web browser, whereas a VPN typically functions at the operating system level and thus controls all the bits coming and going. However, by the time a VPN client program on any computing device connects to a VPN server and creates a VPN tunnel, the public IP address of the device has already leaked. Thus, people who really want to hide their physical location should not use a VPN on their computing device. Instead they should connect to a router with an existing VPN connection.
• And, see the topic below: An FYI on Location Hiding

Picking a VPN provider is mind bogglingly difficult. See one attempt and another and another and another and another and another and another and another. Even agreeing on the criteria to judge them with is impossible. I have my opinions on good/trustworthy VPN providers, email me for my suggestions. The big danger in picking a VPN provider that is not trustworthy is that they can spy on you, in the exact same way that an ISP can spy on you when you are not using a VPN.

If you are using a VPN on a device capable of both Wi-Fi and 4G/LTE/5G (pretty much every smartphone) it is best to disable the network connection that is not connected to the VPN. There is always a chance, especially on iOS, that data can leave the device on the network without the VPN.

New to VPNs? See my article An introduction to six types of VPN software from 2017. I also wrote A Defensive Computing term paper on privacy: VPNs, Tor and VPN routers in 2016 which offers an introduction to VPNs and Tor.

DOWNSIDES TO VPN

On rare occasions a website will refuse to load when you are using a VPN. This screen shot is an example. It says "Access Denied", but the actual problem was the VPN. The error message is very likely not to say that the VPN is the problem. Note that while a website can detect a VPN, this is not always perfect. It may well be that one VPN server is blacklisted but another, from the same VPN provider, is not. Trial and error is needed. Instead of being completely blocked, some websites may just require extra identification when using a VPN.

A VPN will slow down your Internet connection, but it should be quite rare that the slowdown is noticeable. If the speed is noticeably slower, try connecting to a different VPN server, one that is physically close to you. Some VPN software handles this automatically, that is, it tries to find the fastest available server for you automatically. If you prefer manually picking a city or country that you would like to connect to, some VPN software will show you how busy each available VPN server is, in that city/country.

I suppose just having to turn the VPN on and off is a downside for some people. There are some VPNs that can be configured to start automatically when the computing device boots up, but I am not a big fan of the concept. For devices, like all of mine, that are frequently off-line, the VPN client software should be able to wait patiently until the device goes on-line again and then automatically re-connect. Sometimes this works, sometimes not.

VPN tunnels can break, even when the Internet connection is alive and well. So, if you are doing something sensitive, you need to watch the icon that indicates that the VPN is currently connected.

If you are using an iOS device (iPhone, iPad) then it is fairly certain that the VPN is not working. This is a long story that boils down to not trusting any VPN on iOS because they all leak data outside the VPN tunnel. This was first reported by ProtonVPN in March 2020 for iOS version 13. See VPN bypass vulnerability in Apple iOS. I blogged about this in May 2022: VPNs on iOS are a scam and kept updating my blog through October 2022. Security company Disconnect wrote about the problem in March 2022. See Leak advisory: Apple and *All* iOS App Developers Are Able to Unmask VPN Users. In August 2022, VPN company IPVanish wrote an excellent article that went into three different types of leaks in iOS VPNs: iOS VPN leaks: why they happen and how to prevent exposure.

Things to test before and after connecting to a VPN:

• Public IP address: this should change after connecting to a VPN. Many websites will display your public IP address, among them ipchicken.com, checkip.dyndns.com, www.ivpn.net and checkip.synology.com.
• It is one thing for your public IP address to change, it is another to actually be connected to a server run by your VPN provider. Some VPN companies have a tester page that reports whether you are connected to their service or not. Four companies that provide this information on the home page of their website, are OVPN, IVPN, Mullvad (see screen shot) and AzireVPN (the top of every page on their site says whether you are connected to their service or not). ExpressVPN offers this service on their IP Address Checker page. TunnelBear has it on their Whats My IP page. When they say your IP address is exposed or public, it simply means you are not connected to their service. ProtonVPN and Windscribe do not offer this service at all.
• DNS SERVERS: DNS is a critical foundational technology on the Internet. DNS servers translate the name of a computer into an IP address. It is very dangerous to use unknown DNS servers. Malicious DNS servers can take victims to scam copies of websites and trick them into entering passwords. Every VPN provider offers their own DNS servers so you should see a change after connecting. Your VPN provider should be able to tell you what DNS servers they use, so you know exactly what to look for.
• Detecting a change in DNS servers: The hard part about verifying a change in DNS is that a computing device can get its DNS configuration from many different places. The VPN has an opinion, the Operating System has an opinion, the router has one, each WiFi network can have its own opinion and so can each web browser. If you have a web browser that is not configured to use Secure DNS (a.k.a. Private DNS), then there are assorted online testers that display the currently in-effect DNS servers. My Router Security website has a page devoted to DNS that links to many of these tester sites. If a web browser is using Secure DNS that seems to over-ride everything and you will see the same DNS servers whether connected to a VPN or not. If you like using Secure DNS, then maybe keep one web browser on hand that does not use it, just for this testing. On Windows and macOS, the nslookup command (for ex: nslookup cnn.com) reports on the DNS servers and runs outside a browser. You should definitely see a change in DNS servers when using nslookup before and after connecting to the VPN. Whew.
• WEBSITE LOCATIONS: As described in more detail at the bottom of this page, your public IP address is not the only way that a website learns where you are physically located. Still, we can do a bit of verification that the VPN server is being used for location information by websites. Go to weather.com, which displays the weather for your location at the top of the page. You want the location to be that of the VPN server, not your actual location. Also, search for "weather" at google.com. Google wants to show you the weather for your location, so it may ask for permission to learn your location. Give it permission (Allow) and hopefully you will, again, see the weather for the location of the VPN server. Obviously, the VPN server has to be far from you for these to be useful tests.
• WebRTC: One of the big reasons to use a VPN is to hide your true public IP address. This conflicts with the WebRTC software in most web browsers. After connecting to a VPN, you want to test that WebRTC is disabled in your web browser. Many VPN providers offer a WebRTC tester page, for example, Mullvad has a Connection check and OVPN has a WebRTC leak test. More WebRTC tester pages are on the Test your Router page of my RouterSecurity.org site. Last I checked, both Safari and Chrome do not support WebRTC on iOS. If you use more than one browser, test each one. See also How to disable WebRTC in Firefox? from PrivacyTools.io.
• IPv6: Personally, I have no use for IP version 6. To me, it is a potential avenue for data to leak out of your computer without going through the VPN tunnel. Some VPN client software lets you disable IPv6, some does not. You can test if IPV6 is alive and well at test-ipv6.com. Good results on this test are "No IPv6 address detected" and "You appear to be able to browse the IPv4 Internet only. You will not be able to reach IPv6-only sites.". The Microsoft tester at ipv6.msftconnecttest.com does not produce error messages, it simply fails to load. To me, this is a good result. The DNS leak testing site, ipleak.net, also reports on IPv6 connectivity.
• How to check that your VPN kill switch is working a pcWRT blog (June 2022). I really like the cute trick used to test VPNs that are configured to run at system start-up.
• SOCKETS:

  A deeper audit of the VPN requires a router that can display the details of individual sockets/connections. Very few do. My preferred router, the Pepwave Surf SOHO does, as do all Peplink routers.

  • After making a connection to a VPN server, all communication from your computing device is unlikely to immediately use the VPN. It is best to wait a minute or two to let existing sockets/connections time out. If you have a router that shows every live socket/connection, then you can monitor this for yourself. When all is well, the only socket you should see is the one for the VPN. Anything else is trouble.
  • I ounce found a bug in VPN software by watching the sockets/connections. This screen shot shows a single device with 10 different UDP connections, from port 4500 to port 4500. The screen shot was taken with the VPN software not only not connected, but not running at all. These were old VPN tunnels that had never been closed. I have blocked out the public IP addresses of the VPN servers to hide the identity of the VPN company, so i don't have to engage a lawyer.
  • As per the above, when the VPN connection is closed, you can watch the live sockets/connections to insure the VPN connection is actually terminated.
• THE ULTIMATE TEST: The problem with monitoring the current connections/sockets via a router (above) is that it is a manual process. No one wants to sit and watch this for hours on end. The ultimate test requires a router that offers outbound firewall rules. This is, really, the only way to verify that all data leaving a VPN-connected device is, in fact, going through the VPN tunnel. As it is commonly used, the term "VPN leak" only refers to DNS requests. That is childs play compared to the full audit that a pair of firewall rules can provide.
  
  Doing this requires two firewall rules. The first allows all data to the currently connected VPN server. The second logs anything else leaving the VPN-connected device. It is assumed that the firewall rules are evaluated top to bottom. In the example shown below, the VPN-connected device (computer, tablet, phone, whatever) is at IP address 192.168.1.2. It is connected to a VPN server at IP address 1.2.3.4 on port number 456. The connection uses UDP rather than TCP. The example is from a Peplink router and the green circle with a check means the outgoing traffic is allowed. The second rule catches anything else leaving the device at IP address 192.168.1.2. The red circle with a line through it in the Action column means that the outbound request is blocked. The piece of paper around the circle means that the outbound request is logged. In a perfect world, the second rule should catch/log nothing.
  
  
  Until you have run this type of audit, you have no idea if there is leakage outside the VPN tunnel.
  
  Another way to do the same thing is with one firewall rule that logs everything from the target device's IP address. Start the firewall rule, then connect to the VPN server. You should see the outbound request(s) that establish the VPN connection. This provides a timestamp for the start of the VPN tunnel. Anything else logged by the firewall rule is trouble.

• CUSTOM DNS
  Most VPN companies insist that you use their DNS services. A few let you choose your own DNS provider, if you have one that does the type of blocking you desire.
  
  
  1. IVPN offers custom DNS
  2. Mullvad introduced their custom DNS feature in April 2021. Note that it only allows you to enter an IP address and thus is not a good fit for NextDNS which lets you enter a DoH or DoT server name.
     Aug 22, 2022: I have just been told of a cute trick to link Mullvad Custom DNS with NextDNS profiles using IPv6 addresses. The Setup tab on the NextDNS control panel shows two IPv6 addresses for each of your profiles. It turns out that the ending bits of these IPv6 addresses match the Endpoint ID associated with your profile. One possible downside is that this requires you to enable IPv6 support for the VPN. On the upside, it avoids having to worry about your public IP v4 address changing.
  3. The August 2021 ExpressVPN writeup on this makes no sense at all
  4. Windscribe on Windows gives you a choice of DNS. The default is their R.O.B.E.R.T system which does ad blocking, tracker blocking and has customizable block and allow lists. If you do not want to use R.O.B.E.R.T DNS, you can enter the IP address of another DNS server.
  5. ProtonVPN supports customized DNS on Windows, but only old DNS via an IP address, not Secure DNS (DoH or DoT) via a host name. The feature is not supported at all on iOS.
  6. On Android, there is no need for a custom DNS feature. The Private DNS feature over-rides a VPN and gives you total control.
  7. ChromeOS may let you change the DNS server used by a VPN. In Settings, look for VPN and it reports the DNS server provided by the VPN. I have not tested this.
• ANONYMITY
  One downside of a VPN, compared to Tor, is that the VPN company normally knows who you are. Even Mullvad, and IVPN which take no personal information at all when creating an account, know who you are when you pay with a credit card.
  
  
  • Look for a VPN provider that takes cash or gift cards. Many do.
  • If possible, have someone else pay for the service with their credit card.
  • In July 2022, Mullvad introduced a new wrinkle on anonymous payments. Their blog, Mullvad is now available on Amazon (US & SE) does a poor job of explaining this. On Amazon you can buy a physical card with a scratch off number on it. The number is worth either a year or 6 months of service, depending on how much you pay for the card. The great thing here is that number on the card can be applied to any Mullvad account. There is no way for Amazon to link the purchase of a card to a specific Mullvad account. When the card is purchased, the account it will be used with, does not even have to exist. Still, I suggest using a non-Mullvad VPN when purchasing the card from Amazon. And, do not use an Eero router. Or, maybe have your sister buy the card for you :-)
  • NordVPN has partnered with some retail stores so that you can purchase their VPN with cash. You buy a box which contains a "product key card" What is a product key card? They don't say. Some of the stores are Staples, BestBuy, Walmart, Office Depot, Micro Center and Target.
  • All that said, if you connect to the service from your home, the public IP address of your home can be used to identify you, if the VPN company is either malicious or forced to do so by their government.
• CLIENT SOFTWARE
  This is the software, provided by the VPN company, that you use to control and configure the VPN.
  
  
  • It is likely that a VPN provider will offer very different software on the different operating systems they support. Too many reviews evaluate only one operating system. Even on a single operating system, a VPN provider may offer three different software options (their own software, an open source alternative or the native VPN client in the operating system).
  • Some VPN client software has lots of bells and whistles, great for techies. Others have little more than a simple ON/OFF button, great for non-technical people.
  • The available features vary drastically, with each VPN client app.
  • It is easy to suggest looking for Open Source VPN client software. Open Source means that anyone can review it. However, open source does not, in and of itself, make the software good or trustworthy. The infamous Log4J software, that made headlines in December 2021 and may have the worst software bug of all time, was open source. That said, ProtonVPN, Mullvad and IVPN created their own software and made it open source. Some VPN companies will let you use open source software for the OpenVPN flavor of VPNs. I have done this often, using both of the popular apps, and did not like either one.
• Sometimes using a VPN you may want as much privacy as possible. Other times, you may care more about speed. If so, look for VPN client software that shows you how busy a VPN server is before you connect to it. If you want privacy, pick a busy server where its easier to get lost in the crowd. On Windows, the ProtonVPN client software does this, Mullvad does not. Freedome is designed to be as simple as possible, it hides all server information. Perfect Privacy provides this information on a web page rather than their client software.
• As noted in the Android topic, Exodus reports on trackers and permissions of Android apps. VPNs with no trackers: ProtonVPN, Freedome, Mullvad, OVPN and IVPN (note that the number of permissions each app requests vary quite a bit). ExpressVPN has 2 trackers, Tunnelbear and Windscribe have 1 and NordVPN has 4. Last Checked October 2021.
• We can make some judgments about a VPN company (not the service) from the tracking, or lack of it, on their website. In August 2019, Yegor of Windscribe discussed this: Shattering the Grand Illusion of Cookie Flavored Lies. I expanded on the topic in Nov 2019: Judging a VPN by its website. Then, in August 2021, Alfred Ng of The Markup covered this: How Private Is My VPN?. None of these articles looked at a large number of websites. That said, the winners were ProtonVPN, Mullvad, IVPN, Windscribe and AirVPN.
• Kill switch. This is a feature in some VPN client software that looks for a failed VPN tunnel connection and blocks all data leaving the computer until the VPN tunnel is restored. This exists to insure your public IP address is not made available to the Internet. At home, its important, at a coffee shop, not as much. But, what if the VPN client software itself fails? Most likely, this kills the kill switch software too. Few VPN providers will go into the techie details of their kill switch. IVPN does here. The article is poorly written, however, its not clear if it only applies to Windows or not. As of May 2021, ProtonVPN on Windows has two different types of kill switches.
• Split Tunneling: Normally when you create a VPN connection/tunnel you want everything leaving your device to pass through the VPN. But, there are, sometimes, exceptions and that is what split tunneling allows for. For example, some websites block access when using a VPN. Rather than stop the VPN connection, use such a site and then start the VPN, split tunneling lets you specify the websites (really domains) that should not go through the VPN tunnel. On a mobile OS, the split tunnel feature may filter by app rather than by domain. When VPN client software is used on a router, the split tunneling feature may let you specify which devices should not pass through the VPN tunnel created by the router.
• Automatic re-connect: Some (many?) people leave the 4G and WiFi on all the time on their phones and tablets. I do not. I only connect to the Internet as needed. If you are like me, you may prefer VPN software that will hang around, twiddle its thumbs while the phone/tablet is offline, and then immediately reconnect when the device goes back online. All by itself. If you expect to manually connect the VPN every time, there surely will be times where you forget.
• ACCESS TO THE LAN
  
  The focus of any VPN is on Internet access, but the LAN side is also dangerous. If the router allows it, your computing device can be attacked by other users of the same network. Local bad guys might target open TCP/IP ports on your device or take advantage of bugs in the operating system. I blogged about this in August 2021: Hiding on a Wi-Fi network. The rare feature is an option in the VPN client software that will cut you off from other devices on the Local Area Network (LAN). Bad guys can not attack a computer they can't see. Sadly, no review of any VPN ever considers this feature. To test this, after connecting to a VPN, run a LAN scanning app such as Fing. In the best case, you will only see your device and the router.
  1. Mullvad on Windows calls this "Local Network Sharing". I tested it and found that it worked.
  2. In their Android app, IPVN calls it Bypass VPN for local networks. In their Windows, macOS and Linux software IVPN calls it Allow LAN traffic when IVPN firewall is enabled. I tested it on Windows 10 and it worked. See a screen shot from v3.4.5 of their Windows software (Dec 2021).
  3. Windscribe on Android calls it "Allow LAN traffic". In my tests this feature worked outbound, but not inbound.
  4. OVPN on Android has a toggle option called "Communicate with LAN devices". I did not test it.
  5. On iOS, ProtonVPN calls this "Allow LAN connections"
  6. Like many VPN clients, the software from ProtonVPN contains a kill switch. In their writeup, What is a kill switch? they say "Because of the way iOS works, it is not possible to access devices on your local network when the kill switch is enabled." However, this writeup has no creation date, no last review date and it says nothing about the applicable release of their software or iOS. So, it may be ancient.
  7. In October 2021, Sean Gallagher, writing in Ars Technica said: "I use VPNs for very specific purposes - namely, to keep the virtual machines I use for malware hunting segmented from the rest of my network ..."
  8. In September 2021 we learned of a bug in the ARRIS TG2492 router that could leak the public IP address of a computer that was connected to a VPN. The only defense (Virgin Media has not fixed the bug for 2 years) was to block LAN side access while the VPN is active.
• VPN CLIENT IN A ROUTER
  
  Routers that can function as a VPN client, typically support OpenVPN and/or WireGuard. To use either type of VPN from a router requires a VPN Provider that lets you generate configuration files from their website. Then you copy the configuration file to a computer and use that computer to access the router and upload the configuration file to the router. There may be a small chance that the VPN client software in a router can be configured on its own, without importing any files, but that has not been my experience.
  
  OpenVPN requires a level of computing horsepower that many routers do not have. Thus, the VPN connection may be much slower from a router, compared to a laptop or desktop computer. WireGuard is far more efficient than OpenVPN. I have been testing VPN clients with the pcWRT router and found that its WireGuard VPN client works with OVPN and Windscribe. The company says it also works with IVPN, Mullvad and StrongVPN. pcWRT is based on OpenWRT so it will probably work with any router running a version of OpenWRT. In my trivially small testing, I found WireGuard to be 7 times faster than OpenVPN on the pcWRT router.
  
  Another thing to look for when using a router as the VPN client, is a VPN company that has a web page with the current status of their servers. I say this because VPN software on a router does not have the bells and whistles that software for a mobile or desktop OS has. One typically missing feature, is a report on how busy the available servers are. This is a nice thing to know when choosing which server to connect to. IVPN has just such a server status page. At the time I wrote this, one of their Canadian servers was 100% busy while another one was only 17% busy. Good to know. ProtonVPN also has a server status page. Mullvad has a page listing all their servers, but it does not show busy each one is.
• EXTRA SECURITY
  Some VPN providers have extra security features.
  
  
  1. Hiding the fact that a VPN is being used at all. I am not familiar with the technical details of how this is done.
  2. Two VPN servers (aka multi-hop connections). ProtonVPN calls this Secure Core. You first connect to one of their extra special super secure VPN servers, then your Internet connection is shuttled to one of their normal servers. Needless to say, this will be slower, but it is done so that if the normal server gets hacked or is spied on, your public IP address is still hidden, you will appear to have come from the super secure server. What they don't tell you is that when using this feature, you are limited to only choosing the exit country, you can not choose an individual server/city in your desired exit country. OVPN also supports multi-hop and is now on the second version of the feature. They have a good explanation of the feature here: How Dynamic Multihop works. IVPN also offers a multi hop option and they let you pick any two VPN servers, with the only restriction being that the first/entry and second/exit servers must be in different countries. They support multi-hop with WireGuard and OpenVPN. If you want to use WireGuard from a router, they have nifty way of modifying the WireGuard config file to specify the two different multi-hop servers.
  3. Combine a VPN with Tor. ProtonVPN is one company that offers a combination of Tor and their VPN. The documentation is poor, but you first connect to a VPN server using their app and that server then automatically shuttles your data over to the Tor network. Some of their servers offer this service, most do not. Expect it to be quite slow. This scheme hides the fact that Tor is being used from your ISP. It also allows access to Tor with your regular web browser(s), there is no need to install the Tor web browser. Note that the Brave browser also can connect to Tor and you can use Brave with any regular VPN connection to get the same effect.
• Public IP addresses (for techies only): If remote access is being used to control a router, it can be made much more secure by limiting the source IP address. While businesses often have a fixed public IP addresses, consumers do not, but we can use a VPN to provide one. One approach is to buy a permanent IP address from the VPN provider. Some offer this service, some do not. Another approach is to use a small VPN provider that has only one (or a very small number) server in a given city. Other publicly available services on the network (perhaps remote control of computers) can also be made more secure by limiting the acceptable source IP addresses. On a related note, some websites block access when using a VPN. Another advantage to a fixed IP address from a VPN company is that it may not be blacklisted the same way that their other servers are.
• Error Handling: When something goes wrong, how good is the app at reporting the details of the error? There are two parts to this. For one, reporting the problem should be part of the app and easy to use. And, the app should report all the data needed for the VPN company to understand the problem. One example:
  In November 2022 I was using a newly installed copy of ProtonVPN (app version 4.3.52.0) on a Chromebook and while the Internet connection was working fine, the app would not connect to any VPN server. There is an option in the app to display the log file, but the log text was too small to read and it was not possible to copy the log text anywhere. I was able to report the problem through the VPN app and the problem report included the log. However, when ProtonVPN responded, it was clear that the log did not provide nearly enough information to understand the problem. OVPN and Mullvad handle errors better, but no doubt, others handle it worse.
• FYI: Consider paying for a VPN monthly, at first. Once you are happy with it, then you can then change over to paying on a yearly basis which is likely to be cheaper than paying month to month.
• WRONG CRITERIA
  
  
  • Judging a VPN by speed tests is wrong. The purpose of a VPN is privacy, and for this, we give up some speed. Judging privacy is hard, running speed tests is easy. And, speeds vary all the time, you have to live with a VPN provider for a while before you can form an opinion on their speed. Finally, we all have different speed requirements.
  • Judging a VPN provider by the number of servers they have is wrong. Its like saying a Toyota is better than a Rolls Royce because there are more of them on the road. More is not better. And, as noted above, all VPN servers are not the same. Companies that own their own servers will have fewer than those that just rent a VPS or rent a server.
  • Cost: Picking a VPN because of the monthly cost is a mistake. Not that the most expensive VPN is the best either. Some things are worth paying for and, in my opinion, VPN service is one of those things.
  • Logging. Pretty much all VPN companies claim not to log and it is close to impossible to prove. That said, in Jan. 2020, Rae Hodge of CNet wrote: "... EarthVPN, Hide My Ass VPN and PureVPN have all been clocked by privacy advocates for handing over logs to authorities, as has IPVanish ... My beef isn't with any VPN company helping cops catch a child abuser via usage logs; it's with any VPN company that lies to its customers about doing so. The lie that helps law enforcement in the US catch a legitimate criminal is the same lie that helps law enforcement in China arrest a person watching footage of the 1989 Tiananmen Square protests."
  • In December 2021, Consumer Reports tested 16 VPN providers and published a large report: Mullvad, IVPN, and Mozilla VPN Top Consumer Reports' VPN Testing. Their recommendations are not bad but they are not the best either as, again, they used the wrong criteria. For example, they gave too much weight to open source software and marketing. And, they only evaluated on Windows.
• Not a criteria: Every paid VPN provider, that I have run across, offers unlimited bandwidth. Only a free VPN has a monthly or daily cap on data usage. Avoid the free services.
• Not a criteria: You can install the software from a VPN provider on an unlimited number of devices. I can recall only one VPN company where this was not true.
• That said, most VPN providers limit the number of concurrent connections to their service. A typical limit is 5 or 6.

There is more to choosing a VPN provider than just software features.

WHO OWNS THE VPN COMPANY?

1. Kape: In September 2021, Kape Technologies purchased ExpressVPN. They already owned CyberGhost, ZenMate and Private Internet Access (PIA). See Former Malware Distributor Kape Technologies Now Owns ExpressVPN by Sven Taylor. Kape also owns VPN review websites vpnmentor.com and wizcase.com. Kape is not particularly trustworthy.
2. J2Global owns IPVanish, StrongVPN and PC Magazine and Mashable, both of which, review VPNs. They also own Ziff Davis which, in turn, owns the encrypt.me and Internet Shield VPNs.
3. Some VPN companies are very clear about their ownership:
   IVPN: Who owns your VPN? You should find out (March 2021)
   Mullvad: The ownership and future of Mullvad VPN (September 2021)
   ProtonVPN: Who owns ProtonVPN (undated)
   OVPN: Who are the people behind OVPN? (undated)
   Windscribe: Can a commercial VPN still offer true privacy? (Feb. 2022)
   AzireVPN: About Us (undated)
4. Clearly, security company F-Secure runs the Freedome VPN.
5. When I first wrote this (I did not save the date), the About Us page for Surfshark avoided the issue of ownership. As of January 2023, it says: "The founder of Surfshark is Vytautas Kaziukonis. In 2022, Surfshark and Nord Security merged under one holding company to form a cybersecurity powerhouse while still operating independently."
6. The About us page for Astrill says "We are a registered Seychelles company". It does not mention anything else about the company and it says nothing about any of the people involved.
7. The About Us page for TunnelBear has just cartoon pictures of bears. As of March 2018, TunnelBear was owned by McAfee. This despite McAfee offering their own VPN. In November 2021, McAfee agreed to sell itself to a group of Private-Equity investors (Advent International, Permira Advisers, Crosspoint Capital Partners, Canada Pension Plan Investment Board, GIC Private Limited and a subsidiary of the Abu Dhabi Investment Authority). As a rule, things go downhill quickly when a company is owned by private equity investors.
   February 3, 2023: the Tunnelbear About Us page has no information about who/what owns the company. It still has the cartoon bear pictures for each employee, along with their first name, last initial and a made-up joke of a job title. It is useless childish fluff.
8. NordVPN and SurfShark are both private companies. In February 2022 it was announced that they are merging, as per this article in PC Magazine: NordVPN's Parent Company Is Merging With VPN Provider Surfshark. Why are they merging? They said "...the merger will open new technical knowledge-sharing opportunities and enable more focused market diversification." Is that what you want in a VPN provider? It was unclear who will run the combined company which will be called Cyberspace. It was registered in The Netherlands.
   From the Atlas VPN website (as of Jan. 2023): "In 2021, Atlas VPN became part of Nord Security" and "Atlas VPN is a service of Peakstart Technologies Inc, a US company registered in Delaware and a subsidiary of Nord Security Ltd. which owns NordVPN and Surfshark VPN."
9. 3 companies control many big-name VPNs: What you need to know by Attila Tomaschek of CNet (Feb 2022)
10. Hidden VPN owners unveiled: 104 VPN products run by just 24 companies by Jan Youngren of VPN review website VPNpro (Oct 2021).

Many VPN companies rent their servers. It is more secure if the VPN provider owns their own servers. Many VPN companies use a VPS (Virtual Private Server). It is more secure to not use virtualization (called a bare-metal server or a dedicated server). It is also more secure if a VPN server runs totally in RAM and never writes to the hard disk (called RAM-disk mode). Most VPN companies are mum on these points. A good survey on these two points is at Restore Privacy. It says: ProtonVPN and VPN.ac use dedicated bare-metal servers, all ExpressVPN servers use RAM-disk mode, Perfect Privacy uses bare-metal servers running in RAM-disk mode, OVPN uses dedicated bare-metal servers running in RAM disk mode, that they own. Mullvad owns some of their servers but most are rented. AzireVPN also uses dedicated servers running in RAM disk mode, that they own. They blogged about this in September 2022: Why we Own our Own Servers.

Marketing honesty: Many VPN companies make vague promises of security, privacy and anonymity. This is stretching things. Look for a VPN company that is very clear about exactly what a VPN can and can not do.

Installation instructions: Most of the time, you have to install software to use a VPN. The instructions provided by the VPN companies differ greatly. I have seen companies that document every step of the install and others just say run the file you downloaded. You should be able to find the installation instructions on the website of the VPN company.

Canceling: How a VPN provider handles customers canceling their accounts can tell us something about the company. I have tried to cancel two VPN accounts before the time had run up. IVPN handled it very well, ProtonVPN did not. ProtonVPN accounts auto-renew and you can not tell them not to renew when your time is up. You can only tell them to cancel now. Right now.

Change Log: It is nice to see a list of changes made to the VPN client software. If bugs are fixed, you want to know if they were in features you use. The log also includes new features, ones that you might not have otherwise known about. Some software releases are major, others are minor. Standard practice is to avoid the major releases for a while until the inevitable bugs are fixed. A change log shows which releases contain many updates and which just fix one or two bugs. Perhaps most importantly, it is a sign of professionalism to publish a Change Log. I publish one for this very website.
Examples: The Windscribe Change Log is here for their Windows, macOS and Linux software. Mullvad publishes their Change Log (and source code) on GitHub. IPVN maintains a Change Log for their desktop software (Windows, Linux, macOS) and there is a link to it on the page where you download the software. They have separate Change Logs for their iOS and Android apps but again, they link to it on the page where you download the apps. I could not find a Change Log for ProtonVPN on their website. I also checked their iOS app and there was no Change Log there either.

WARNINGS

• Avoid free VPNs. More specifically, avoid VPNs that are always free. Some commercial VPN providers offer limited accounts for free. If you can't pay, use the free service from ProtonVPN, TunnelBear or Windscribe. On iOS, there is also a free version of the Guardian Firewall + VPN app.
• A VPN based in the United States would be my last choice. After all, it the was the US that let ISPs spy on us in the first place. And, Snowden. Granted, this is a matter of opinion, but see too: Are US-based VPNs trustworthy? Here's why I don't recommend them by Rae Hodge for CNet (February 2022). Hodge also wrote "Any VPN based out of the US, UK, Canada, Australia and New Zealand -- the so-called " Five Eyes" intelligence community -- should generally be avoided if you're looking to max out your privacy. Five Eyes openly calls for what most people consider an end to online privacy ... "
• ExpressVPN: Edward Snowden urges users to stop using ExpressVPN (Sept. 2021). They sponsor the Security Now podcast with Steve Gibson (as of January 2023). One of their ads in the podcast was full of lies. The ad promised things that no VPN is able to provide.
• Android Owners, Watch Out for These 7 Shady VPN Apps by Rae Hodge of CNET (October 2022). The article focuses on Android VPNs that require more permissions than they actually need. The list: Yoga VPN, proXPN, Hola Free VPN, oVPNSpider, SwitchVPN, Zoog VPN and Seed4.Me VPN.
• 8 Bad VPNs You Must Avoid to Protect Your Privacy by Georgina Torbet for MakeUseOf (Dec 2021). The eight are: Hola, HotSpot Shield, HideMyAss, Facebook Onavo, Opera Free, PureVPN, VPNSecure and Zenmate.
• NordVPN Review: Feature-Rich and Speedy, But Privacy and Transparency Issues Need Attention by Attila Tomaschek and Rae Hodge of CNET (August 29, 2022). Quoting: "From a distance, NordVPN almost looks like the perfect VPN. But with a little digging, we uncovered some pretty major cracks in the facade ... Most notably, we found that NordVPN routes some user traffic through residential IP addresses supplied by a company with a questionable history. The company's overall efforts at transparency also leave quite a lot to be desired ... the company offers nothing in the way of an annual transparency report and [it] is cagey about its partnerships and corporate structure ... Nord operates its main offices physically out of Lithuania, processes payments through the US, maintains legal entities in the UK and Germany, and is owned by a holding company based in the Netherlands." I suggest also reading the section on the Threat Protection feature.
• From Dong Ngo, in Virtual Private Network (VPN) Explained: Privacy, Security, and How to Get it Free. In responding to a September 2022 comment on the article, Ngo said: "NordVPN is evil ... it’s so popular because its affiliation pays well - each time you click on a link and sign up the owner of the article gets a cut."
• Windscribe VPN Security Breach: Servers and Private Key Seized by Sven Taylor for Restore Privacy (July 19, 2021). Quoting: "Windscribe, a popular VPN based in Canada, has suffered a major security breach. Ukrainian authorities seized Windscribe servers and also obtained Windscribe's private key, which allows them to decrypt traffic from Windscribe users. Windscribe staff has admitted they failed to properly encrypt their servers ... " See also the two blogs that Windscribe published on the topic: OpenVPN Security Improvements and Changes by Yegor Sak (July 8, 2021) and Ukrainian server seizure - a commentary and state of the industry by Yegor Sak (Aug 24, 2021). This was a bad thing, but does not strike me as a huge big deal. Exploiting the issue to spy on a Windscribe customer would have been very difficult. Also, they were very public about the problem, and what they are doing to fix it, which is all we can hope for from any company with a security problem. Mr. Taylor makes money from the VPN companies he recommends, which does not include Windscribe. Why not? Probably because Windscribe has no affiliates program, no one makes money by recommending them as the best VPN for left handed people with curly hair.
• One of the articles above, Ukrainian server seizure - a commentary and state of the industry by Yegor Sak of Windscribe (Aug 2021) is two things. First, it is an admission of a mistake they made and an explanation of the fixes they implemented. It also, has very technical details on similar mistakes that other VPN providers continue to make, when it comes to OpenVPN. Anyone considering using NordVPN should read the section on the NordVPN 2019 Hack. Likewise, anyone considering or using TorGuard, PIA (Private Internet Access), Surfshark, ExpressVPN and Perfect-Privacy should read the sections devoted to their OpenVPN configurations. The only company that gets a good grade is IVPN.
• Windscribe: I was a customer for a couple years and dealt with their tech support somewhat often. It is pretty bad. They have ducked questions and refused to consider that there might be an issue with their software.
• From the Wirecutter: "We ruled out some VPNs for trust issues. EarthVPN appears to have lied about its logging practices, while ProxySH confessed to spying on customer traffic in 2013. HideMyAss has handed customer information over to police. The Center for Democracy & Technology filed a 14-page complaint about Hotspot Shield with the FTC, alleging unfair and deceptive trade practices." (Last update Jan 2022)
• Also see the University of Michigan research in the Advanced Techie Stuff section for research that shows some bad practices by a few VPN providers.

Finally: You don't see this every day. In April 2022, the Windscribe blog featured a puff piece on the founder of the company: Who is Yegor Sak? The Man Behind The Meme by Catt Garrod. The article included this: "I started using VPNs in 2009 for my daily Internet activity ... This led me to learn all about what VPNs can and cannot do ... The one that stood out as different and I personally used for years was IVPN. Windscribe was very much inspired by how that company was operated: solid apps, no marketing speak, brutally honest information on capabilities and limitations.".

As a rule, the job of blocking ads and/or trackers falls to your web browser and its extensions. But some VPNs can do this too. One advantage of VPN blocking is that it applies to the entire operating system, not just one web browser. If you connect to one of these VPNs from a router, it can block ads/tracking on any device connected to the router. The downside of any such blocking (in a browser or a VPN) is carving out exceptions to the rules.

These VPNs do blocking:

1. IVPN calls their tracker blocking feature AntiTracker.
2. ProtonVPN calls their ad/tracker blocking feature NetShield. It uses DNS filtering to protect you from malware, blocks ads, and prevent website trackers from following you around the web. It is only available to paid customers.
3. Mullvad added support for custom DNS server configuration on macOS, Windows, Linux and Android in April of 2021. This can be used with an assortment of DNS providers that block ads/trackers. In May 2021, they introduced ad blocking How to set up ad blocking in our app. In June 2021, ad and tracker blocking was a new feature in their iOS app (How we’re knocking down ads and tracking). In March of 2022, they added malware blocking. See Adding another layer: Malware DNS blocking. Their customers can enable or disable each type of blocking individually. They also offer ad blocking for free to anyone, not just their customers, via their secure DNS service. DNS over HTTPS and DNS over TLS (last updated November 2021).
4. OVPN added ad/tracker blocking to their Android and iOS apps in November 2021.
5. At Perfect Privacy, their TrackStop feature blocks ad-tracking and phishing.
6. The Disconnect Privacy Pro SmartVPN blocks trackers on iOS. Their Premium VPN blocks trackers on iOS, Android and macOS.
7. Windscribe VPN offers what they call a "One-of-a-kind customizable server-side domain blocking tool" that blocks ads and trackers. And, you can customize it. They call the feature R.O.B.E.R.T. Their big advantage is that you can easily customize the blocking with your own block list and allow list - much like NextDNS.
8. The Freedome VPN from F-Secure blocks trackers on iOS, Android, Windows and macOS.
9. The Guardian Firewall + VPN app on iOS "blocks digital trackers from secretly collecting your information." It is from the Sudo Security Group. For free, their VPN service alerts about tracking but does not block. I wrote about it in August 2019.
10. On Android, there are three versions of the Blokada ad-blocker. The free version that blocks ads is not allowed in the Play Store. It installs a VPN, but only to block ads by intercepting DNS requests. There was a trivial version in the Play Store that also installed a VPN but all it did was modify the DNS servers. Currently (Feb.2020) the version in the Play Store is called Blokada Slim and it combines the older DNS changer with a fairly new, real, VPN called Blokada Tunnel which costs 5 Euros/month (roughly $5.50 in US dollars). Great feature: customized white and black lists.
11. Coming: AdGuard VPN (Jan 2020). They are writing a new VPN protocol, which is not a good sign.
12. Android 9, 10, 11 and 12: There is an interesting conflict between a VPN and the Android Private DNS feature. Each wants to be in charge of the system-wide DNS. In a test of Android 10 with three VPN providers, Private DNS won out every time. This was not a DNS leak, the DNS requests went through the VPN tunnel and the Private DNS resolver sees requests coming from the VPN server, not from the VPN client. However, in a test with Android 9, the VPN DNS won out. Beats me why. If Private DNS wins, and you use NextDNS, then any VPN can be used alongside the ad and tracker blocking from NextDNS. The best of both worlds. I tested with multiple DNS testers on my RouterSecurity.org site.

All VPNs claim to hide your physical location and/or let you appear to be somewhere else. This stems from the fact that, with a live VPN connection, all data going to/from the Internet passes through the VPN server. Your pubic IP address is that of the VPN server not your home or office. In the old days this was sold for the anonymity it offered. Later, it was sold so that people in the US could listen to the BBC.

But the claim predates smartphones, spy machines that they are. A smartphone can locate itself using GPS, Wi-Fi, cell tower location and probably even Bluetooth (not sure). I have tested Wi-Fi based locating and found it extremely accurate. So, if the phone knows where you are, who is to say whether it leaks this information to the outside world. And the outside world, on a phone or a desktop computer, is not just websites. Modifying your public IP address is not the be-all and end-all that it used to be. It is still a good thing, but it may no longer be sufficient.

The June 2022 issue of Unredacted Magazine had a story about this. The anonymous author is a privacy enthusiast. He uses a router with VPN client software, and the router makes a VPN connection that all LAN side devices pass through. One of the LAN side devices is an Xbox that is Ethernet connected to the router. You might think that the outside world only knows about the physical location of the VPN server. That's what the author of the article thought ... until he checked his Xbox Account Settings page and found a picture of the apartment complex where he lives with a pin in it indicating his apartment. It turns out that the Xbox uses Wi-Fi and that it can not be disabled. The Xbox was spying on him. It listened to all the SSIDs and MAC addresses being broadcast by the routers of his neighbors and calculated his location. VPN be damned.

If hiding your location is really important, it is best to use a device without Wi-Fi or GPS or Bluetooth. On a smartphone or tablet, disable them and hope the phone operating system honors your request. On a cellphone, airplane mode should prevent it from contacting cell towers. I say "should" because I don't know how to verify this. Even if you can not make or receive a phone call, that does not insure that the phone is not communicating with a cell tower. After disabling Wi-Fi, GPS and Bluetooth, re-boot the device to insure that it is not still using a recently detected location.

Clearly, Ethernet is your friend here. iPhones and iPads can use Ethernet with an appropriate adapter. Likewise there are USB type A and USB type C adapters for Ethernet that can be used with any computing device with a USB port.

To put this in perspective, the strongest option is preventing the operating system from knowing where it is. If this is not possible, then you need to try and prevent the operating system from giving the location to applications and to web browsers. In the case of browsers, there are probably configuration options in both the browser and the operating system for this. For more on this, see the Location Tracking topic on the main page.

Windows 10, for example, offers OS level configuration options for Location in System Settings -> Privacy -> Location. In the resulting panel, insure that everything is off. On a lower level, Windows users should probably disable the Windows Geolocation service (a.k.a. lfsvc). The description says that it "...monitors the current location of the system and manages geofences (a geographical location with associated events). If you turn off this service, applications will be unable to use or receive notifications for geolocation or geofences." There may be a down side to disabling this service, I have not tested this extensively. But, I doubt it.

As an example of browser location settings, consider the Location settings for the Chrome browser (the screen shot is from Chrome 93 on Windows). You can access the location settings directly at chrome://settings/content/location. Here is where you control whether the Chrome browser is allowed to tell websites the location of the computer/phone/tablet. This assumes that the operating system and the browser already know the location. One slip-up in configuring this and a VPN can no longer hide your location from a website.

An article on this: How does my browser know my real location when I'm on a VPN? by pcwrt (January 2021).

I have yet to see any VPN provider mention that location blocking should be configured in both the operating system and the web browser that you use. That would burst their marketing bubble.

Fighting with the operating system and the browser is complicated, error prone and, even if done right, involves some trust that the software is doing what its told. The safer approach is to insure the operating system can not learn its location in the first place. Ethernet is your friend.

You can increase your anonymity by using a VPN inside a VPN. Start with a normal Operating System level VPN. Then, while it is connected, use a web browser that has a VPN extension for a different VPN provider.

How does this protect you? The OS level VPN company will only know that you connected to the Browser VPN company. They can not see anything that you do in the browser. The Browser VPN company can see what you do (like any VPN provider) but they do not know where you are. They see you as a customer of the OS level VPN provider. They may, however, know who you are.

If you can be anonymous to the Browser VPN company, all the better. Perhaps the Browser VPN has a limited free tier or a free trial that can be used without providing personal information. Or, you can pay for some VPNs with cash or a gift card. I would avoid any VPN provider that only offers a free service.

Not all VPN companies offer a web browser extension.

NordVPN calls theirs a VPN proxy extension and it works with Chrome, Edge, and Firefox.

Microsoft's Edge browser will soon have a free VPN called the Edge Secure Network. The free tier limits data to 1 gigabyte per month. Worse, however, is that Microsoft requires users to be signed in to a Microsoft account to use the VPN. So, no anonymity there.

TunnelBear has extensions for Chrome and Firefox. It is a paid service with a limited free tier.

Windscribe has extensions for Firefox and Chrome. It too, is a paid service with a limited free tier.

The Opera browser has its own free VPN as part of the browser itself, no extension needed.

The Epic browser includes a free VPN and it can be installed on Android, iOS, Windows and macOS. That said, I am not familiar with it at all.

Not all browser VPN extensions are limited to just the browser, some work at the Operating System level and thus can not provide a VPN inside a VPN. This is true for the ExpressVPN browser extension and the Mozilla VPN. On Android and iOS, Brave includes a VPN (powered by Guardian) that also works at the operating system level.

Another option for double protection is offered by the desktop (Windows, macOS, Linux) versions of the Brave browser which includes access to the Tor network, no need to install an extension. The option is called "New private window with Tor".

A third approach is to run a normal Operating System level VPN on your computing device, while it is connected to a router that has its own VPN connection. This is most secure when each VPN connection is to a different VPN company.

The below is very technical, scholarly research into VPNs.

UNIVERSITY of MICHIGAN

The paper, VPNalyzer: Systematic Investigation of the VPN Ecosystem by researchers at the University of Michigan is long and dense and looks at a number of criteria never found in the tech press. They wrote their own software to perform assorted technical evaluations of VPNs. Their software ran on Windows, macOS and Linux, so nothing in the paper applies to iOS or Android. They studied 80 different VPN providers. Some findings (there is much more) are below.

• IPV6: Only 11 providers out of the 80 tested supported IPv6 connectivity. I have no need for IPv6 specifically for what this research found: four VPN providers leaked IPv6 traffic. Put another way, these four VPNs do not block the user's IPv6 traffic and thus leak IPv6 data to the ISP. The four offenders: Astrill VPN, Norton Secure VPN, Turbo VPN and SurfEasy VPN.
• They looked at the behavior when the VPN tunnel dies and they found 18 VPN providers leaking all user traffic during tunnel failure. Yikes. This is why there are kill switches. Of the 18, four are free VPN providers which no one should opt for anyway. One was their own University. The remaining 13 are: Encrypt.me, Hide My Ass!, IPVanish, Ivacy VPN, Pure VPN, Speedify, Trust.Zone, Strong VPN, Astrill VPN, Norton Secure VPN, SurfEasy and Turbo VPN.
• They looked for malicious behavior such as TLS interception and found evidence of manipulation in Betternet (on both MacOS and Windows) and Turbo VPN (Windows)

ARIZONA STATE UNIVERSITY

Researchers from a number of different universities looked into hacking VPNs. This is an introductory article about their research and findings: Are virtual private networks actually private? by Annelise Krafft of Arizona State University (October 2022).

• Blind In/On-Path Attacks and Applications to VPNs by William J. Tolley and Beau Kujath, Breakpointing Bad/Arizona State University; Mohammad Taha Khan, Washington and Lee University; Narseo Vallina-Rodriguez, IMDEA Networks Institute/ICSI; Jedidiah R. Crandall, Breakpointing Bad/Arizona State University. This was an August 2021 presentation to Usenix. The page has links to both slides and a PDF. Quoting: "... we demonstrate attacks to infer the existence of, interfere with, or inject data into TCP connections forwarded through the encrypted VPN tunnel. In the server-side threat model, we also demonstrate an attack to hijack tunneled DNS queries and completely remove the protections of the VPN tunnel ... Server-side attacks have not been addressed and are still feasible with all operating systems and VPN servers that we tested. "

UNIVERSITY of MICHIGAN (again)

OpenVPN is Open to VPN Fingerprinting by Diwen Xue, Reethika Ramesh, and Arham Jain, University of Michigan; Michalis Kallitsis, Merit Network, Inc.; J. Alex Halderman, University of Michigan; Jedidiah R. Crandall, Arizona State University/Breakpointing Bad and Roya Ensafi, University of Michigan. This was an August 2022 USENIX presentation. The page has both a PDF and slides. Quoting: "To investigate the potential for VPN blocking, we develop mechanisms for accurately fingerprinting connections using OpenVPN ... We identify three fingerprints based on protocol features such as byte pattern, packet size, and server response ... we identify over 85% of OpenVPN flows with only negligible false positives, suggesting that OpenVPN-based services can be effectively blocked with little collateral damage ... Although some commercial VPNs implement countermeasures to avoid detection, our framework successfully identified connections to 34 out of 41 'obfuscated' VPN configurations."

 

The experience of using a VPN varies drastically, not only from company to company, but also from operating system to operating system with the same VPN provider. With that in mind, this haphazard section offers some insight into the user experience on a handful of operating systems with a few VPN providers (Windscribe, OVPN, ProtonVPN, Mullvad).

See my user experiences

Copyright 2019 - 2023