The impossible task of creating a “Best VPNs” list today

[Batu69]

At the local cafe, hackers can get a cup of coffee and rogue access to the network. Who needs a VPN; what could go wrong?

 

For the security minded, one of the scariest revelations from the now three-year-old Snowden leaks had nothing to do with accommodating ISPs (shocking) or overreaching and often vague anti-terrorism practices and policy (an even bigger shock, right?). Instead, when news trickled out about matters like the National Security Agency’s Vulcan data repository or its Diffie-Hellman strategy, online privacy advocates found themselves quaking. Suddenly, seemingly everyone had to re-evaluate one of the most often used tools for maintaining a shred of anonymity online—the VPN.

 

VPNs, or virtual private networks, are typically used to obfuscate users’ IP addresses and to add a layer of security to Web browsing. They work by routing traffic through a secure, encrypted connection to the VPN’s server. The reasons for using VPNs vary. Some people use VPNs to change their IP address so they can access location-specific media content in a different geographic location or download things on torrent that are less likely to be traced back to them. Others hope to minimize online tracking from advertisers, prevent the negative effects of rogue access to Wi-Fi networks, or even just obfuscate their IP address to specific sites they visit.

 

Not all VPNs are alike, however. In fact, poorly configured VPNs can make users more vulnerable in various ways. Some ban torrenting altogether. Others log information, either for maintenance reasons, to track abuse, or in accordance with their local data retention laws.

 

Last year, I set out to put together a list of the best current VPNs for Ars. Although there are multiple “top VPN” lists available online, they are often riddled with affiliate links, making it hard to ascertain their accuracy. An independent online VPN comparison chart outlines VPN business practices, logging, service configuration, and other features, pinpointing contradictory policies and misleading claims that various services are 100 percent effective. But much of the information is still likely compiled from the actual VPN websites, meaning some misleading marketing claims could sneak in.

 

Several months of research later, I have failed. Today, I still can’t make good faith recommendations for VPNs that guarantee the safety and security of interested users. Instead, the reporting process has only complicated my view of modern VPNs. Evaluating what works and what doesn’t isn’t always straightforward, and verifying the accuracy of this stuff isn’t easy either (especially when it comes to logging). So rather than a simple list of services to use, all I can offer are a handful of guidelines to keep in mind when determining if a VPN can be effective for you in 2016.

VPNs are not for anonymity

One common misconception about VPNs is that they provide user anonymity—even in the face of nation-state actors. “If the objective is to limit exposure to mass surveillance from governments, a VPN is likely not adequate,” said security researcher Kenneth White. In fact, VPNs claiming to offer users anonymity are “inept, irresponsible, or both,” Jeremy Campbell, creator of DNSleaktest.com, told Ars in an e-mail. “Using public VPNs for anonymity is foolish and potentially dangerous, no matter how securely it’s configured, simply because the technology was not designed at all for anonymity. VPN services require that you trust them, which is a property that anonymity systems do not have.”

 

White didn’t insist on abandoning VPNs altogether at this point, but he cautioned that they should be thought of as a single, supplemental tool and not as a privacy solution. “Instead, the use of strong privacy tools such as the Tor Browser (possibly coupled with a reputable VPN) is a must,” he said. “Not only because of the anonymizing properties, but because the bundled browser has been heavily modified to maximize Web privacy (via cookies, Flash, and Java plugins).”

 

Tor has a distributed network that attempts to preserve anonymity by running traffic through multiple relays. But this is also hard to verify, and nobody knows for certain whether or not Tor can be reliably successful. The browser’s recent high-profile encounter with the US Department of Defense only heightens such caution. And some critics in fact argue that Tor makes people more susceptible due to its reliance on an outdated version of Firefox. The takeaway? Tor and even the Tor Browser are not entirely foolproof, either.

 

“There have been some malicious Tor exit nodes in Russia that have actually been modifying binaries, so if you download a piece of software through Tor and you happen to be unlucky enough to get one of these Tor exit nodes, they’ll actually modify it so it becomes malware,” said Matthew Green, a cryptography professor at Johns Hopkins University.

 

Although Green has never heard of that happening with a VPN, he pointed out the same attacks are possible. In contrast to most VPNs, however, Tor and the Tor Browser are used in incredibly high-risk situations, meaning engineers work incredibly quickly to patch security vulnerabilities. The same may not be true for all VPNs.

Depending on your intentions, you may need more than that one middleman for Internet safety.

VPNs are not necessarily safe for torrenting

Some VPN providers do not permit peer-to-peer sharing and would even turn over user names to a copyright holder if necessary. Others issue warnings on behalf of the copyright holders and may cancel the accounts of repeat offenders. Anyone wishing to use a VPN for private torrenting and streaming can look for a provider that doesn’t disclose information when served with a DMCA notice (or one that doesn’t retain logs), though the same issue comes up again.

“However, there’s no way for users to verify what VPN providers say,” Campbell said. “They must judge providers by reputation, relying on news reports, discussion in online forums, and so on.”

VPNs do not offer robust protection from ad tracking

Although VPNs mask your IP address, they won’t necessarily protect you from spying ads and invisible trackers. “VPNs alone provide negligible protection against ad network tracking, because an IP address (which the VPN is masking) is a weak identifier,” Campbell said. “Ad networks prefer browser cookies, supercookies, and browser fingerprinting techniques ( https://panopticlick.eff.org) that VPNs cannot protect against.”

To protect against ubiquitous ad tracking, ad blockers (like uBlock or uBlock origin) and tracking blockers (like PrivacyBadger or Disconnect) provide some level of protection. Disabling JavaScript or using tools like NoScript for Firefox can offer some protection from fingerprinting. Advanced users can use virtual machines or multiple browsers isolated in sandboxes. Using the Tor Browser can protect against browser fingerprinting as well.

VPNs could put you at risk

The best use case for consumer VPNs is local network security, especially on public Wi-Fi networks in airports, hotels, cafes, and even on airplanes (especially since GoGo has been caught issuing fake HTTP certificates for YouTube, which could expose all user traffic—including users’ YouTube passwords—to the inflight broadband provider).

 

Since VPNs create a tunnel between a user and the VPN provider’s server, though, it’s again important to have trust in the VPN provider. That provider can essentially see all of your traffic, log all of your traffic, and even modify your traffic. An improperly configured VPN could potentially give others direct access to your private local LAN, which is likely significantly more dangerous than shady people sniffing your traffic at the coffee shop.

 

“You’re really putting yourself at their mercy if they’re not honest,” said White. “Your fear may be that you’re going to get hacked by someone on the local network, but [by using a sketchy VPN] you’re basically putting yourself in the hands of your worst possible attacker. All of your traffic is going through the worst coffee shop access point in the world if you pick the wrong VPN service.”

 

Page - 2 >>

[steven36]

1 hour ago, Batu69 said:

Tor has a distributed network that attempts to preserve anonymity by running traffic through multiple relays. But this is also hard to verify, and nobody knows for certain whether or not Tor can be reliably successful. The browser’s recent high-profile encounter with the US Department of Defense only heightens such caution. And some critics in fact argue that Tor makes people more susceptible due to its reliance on an outdated version of Firefox. The takeaway? Tor and even the Tor Browser are not entirely foolproof, either.

Also  the FBI  has a  former Tor developer who helps them exploit it . While what White said is totally opinion and not based on facts .  Tor has been exploited to the point it really cant be trusted anymore and always in the news . The only people who got in trouble using VPNs  were a few hackers who used a VPN that stated they logged and will turn you in if you do evil but they never turned no one in for normal use . Also there was one case of a vpn who used a CDN  for DDOS protection and a guy made a serous threat on the internet and the CDN truned him in but that CDN has been removed from there VPN service since then. Other than that its never made the news other than opinion articles like this one. The FBI  hacked a 1000 people in one whack using TOR so how could you really trust it?

 

The biggest problem with privacy software nowadays is the browser vendors leave holes in there software and  the newer the browser is the more holes Firefox has  it's not getting any better . You can score a 100% on anonymity test using a vpn  using the right addons in palemoon or a old version of Firefox .But you cant do it in Firefox 45 ESR  or newer tell its been fixed  and  Stock TOR browser has always been whacked there's certain factors in it that makes it impossible to score 100%  And its impossible to score 100% in chrome browser without using a ip on a vpn from the same country you're from without changing you're clock .