I don't use any VPN for security or anonymity

NordVPN, a VPN service provider, got hacked some time in 2018. In their official response, they say that only one server was affected due to an insecure remote management system left on the machine by the datacenter provider. Private keys got leaked (bad), some other VPN providers were also breached (bad) but that's not what I want to write about (good) because there are better places to read about it.

I don't use any VPN (Virtual Private Network) for security. I don't even use any VPN for anonymity. The VPN providers can't guarantee one anyway, a VPN provider is just another Internet Service Provider. Having researched some “VPNs”, I can safely say that the VPN landscape has turned into a VPN minefield with pseudonymous companies leading the market, with some browser extensions redirecting to spam sites, while others don't even encrypt the traffic.

Instead, I push sites to move to HTTPS and implement things like HSTS – HTTP Strict Transport Security (which will tell the browser to auto-upgrade the request to https:// even when you click a http:// link or don't type https:// in the address bar because why would you) so everyone gets better security. I push services to move to encrypted protocols and not even offer unencrypted versions – I like what for example Gmail does and I hate when major local email providers offer plaintext email protocols (but at least they now say these are not recommended). I don't buy anything from sites that don't do HTTPS.

However, I use a VPN provider to bypass stupid geo restrictions, to check location-based pricing, to allow me to google for weird stuff without the rest of the devices on the same network getting CAPTCHA'd because of unusual bot-like queries. But I don't use a VPN for staying safe online.

For some increased browsing security, install the EFF's HTTPS Everywhere extension to auto-upgrade more sites to HTTPS. But you don't need a VPN-as-a-service to stay safe even when on public networks like the Internet. (For the sake of completeness, I'm talking about consumer VPN providers, not some enterprise Cisco and whatnots.)

I did recommend using a VPN provider a few years ago, however, but I no longer do. The web (and the Internet in general) has moved on and more and more sites are using HTTPS now 🎉 This is the progress we have made for the last 3 years:

Of course, you can build your own VPN server using Algo or Streisand and be your own provider but for me, it would be yet another separate machine to secure, and I'll rather bug others to secure theirs 😜

Own VPN server might not be the best solution for you either, because then your traffic won't be coming from you but from your server (and only from your server and only your traffic, see the problem?) Of course it all depends on what you do and need. But for staying safe online, for security and anonymity, don't use a VPN provider. For anonymity, use Tor Browser but staying anonymous is not an easy task long-term so maybe don't get yourself in a situation that requires it, ok?

---

Recommended reading

• Encrypted email traffic to and from Google: 91% outbound, 93% inbound emails are encrypted at the end of October 2019