Many people will insist that you absolutely must use a VPN, but in this video I’m going
to offer my opinion, and this opinion comes from someone who has spent nearly a decade
working in the cyber security industry, and has not been sponsored to say a particular
provider is good. My opinion is that for the majority of people
VPN’s are a pointless waste of money.
VPN stands for a Virtual Private Network, it provides an encrypted tunnel from you to
the VPN server, and then onwards to the site you’re trying to visit.
Utilising the encrypted tunnel will slow the connection on both ends as your system has
to encrypt the network packets, then the server has to decrypt them. Then the process is repeated
again when data is sent back to you. It will impact your speed, but not necessarily
your bandwidth.
Your Internet Service Provider (ISP) will only see a volume of data transiting from
you to the IP address of the VPN. Any sites you’re connecting to will only see the IP
address of the VPN server. So it has the ability to mask the true source
and destination of a connection.
Pay for VPN services will most likely provide a dedicated server for you to connect to,
and have no interest in the data you’re viewing.
But free VPN services have to make their money somewhere, and in that case your data is most
likely the item that is paying for the service. Don’t think viewing sites over HTTPS will
help, since the connection is being decrypted at the VPN server and then re-encrypted and
sent back to you. Some free VPN providers won’t even provide
a dedicated server for you to connect to, instead your connection goes to another user,
and vice-versa. It potentially helps overcome geographic restrictions, but does nothing
for data integrity.
Much of the push of VPN’s is Privacy. Hiding your IP address and keeping your data private.
And in that respect VPN’s are a waste of time.
They even show that they know my IP when I view their site. So what! Of course they will
know my IP since we just did a three-way handshake and they sent the data that I requested.
I wonder if anyone using a VPN has ever logged into Facebook or Google, and then carried
on browsing the Internet with the mindset that their session is private. Well guess
what, with many sites utilising Google Analytics or showing Facebook like buttons they can
easily see where you have been.
If privacy is your concern then you will get better results by only allowing Cookies by
exception. Cookies being stateful files stored on your system to track session and settings
for each website. By setting your browser to only allow cookies
by exception for a very small number of sites will mean most sites will not be able to track
your usage. However, cookies aren’t the only method
of tracking, so you will have to utilise cross site blocking to prevent connection to 3rd
parties, or DNS blocking to prevent connections to known tracking websites.
But that can be done for free and is relatively easy to set up. There is no need for a VPN.
Now let's look at some scenarios where a VPN could be useful, and whether there are any
other mitigation options.
And the first option I’m going to discuss is Privacy.
But wait, didn’t I just say it wasn’t necessary for Privacy, well very true, although
the case I’m looking at is the snooper being your ISP.
Unfortunately your ISP can see everything you do. Despite most traffic on the internet
being encrypted via HTTPS, there are still enough clues within the data packets to get
a good idea of the sites you’re visiting. The type of information HTTPS will protect
is preventing someone from seeing how much money is in your bank account, but they will
still be able to see the bank you are with. Although if I was in that situation of having
a snooping ISP I would rather vote with my feet and change provider. It is easy to do
in the UK, although I appreciate in some areas on the United States you may be locked in
to a single provider.
Streaming Some services such as BBC iPlayer or Netflix
impose geographic restrictions to limit or outright deny service to people in certain
countries. In this instance where you’re paying for
a service but being denied it due to your location there isn’t really much of an alternative,
short of using less than legal method to obtain the media instead.
TOR (The Onion Router) wasn’t built for such high bandwidth demands, so realistically
VPN’s are the best solution.
Keeping with Streaming some ISPs have been known to throttle users bandwidth to certain
sites. Say you’re watching a HD video on Netflix, then all of a sudden it re-configures
and drops down to a standard definition video, well it’s most likely that was your ISP
throttling your bandwidth and connection.
VPN’s would certainly help in that situation as your ISP would only be able to see a volume
of data to an IP which isn’t Netflix. They have no idea where the high bandwidth data
truly originated from. Again in this situation I would seriously
look at changing ISP.
Age and ID Restrictions I bring this subject up for the imminent change
to adult sites in the UK where proof of age, and therefore identity will have to be provided.
No way will I ever be handing out such details, because put simply I have no faith that any
company could look after such sensitive data without losing it through a data breach.
In this situation of not wanting to supply personal details, I would look for a free
solution of a proxy of TOR, in order to circumvent the UK age verification restrictions.
Free WiFi Free WiFi connections can be horrifically
abused with man in the middle sniffing, or tampering of the connections to insert crypto
coin mining scripts. This was actually a situation I had to deal
with at work recently where a few users were visiting a country in Africa and the only
WiFi hub they could use was inserting cryptocoin mining scripts on every site they viewed.
Well the client based antivirus wasn’t having any of it and blocked access to all websites.
Of course the security team were the bad guys - how dare we block access to rogue WiFi hotspots
and prevent corporate data from being stolen.
A VPN in this situation could mitigate the risks of the free WiFi. But is there an alternative?
Well maybe you could use a 3G or 4G mobile data connection instead. Although I appreciate
some people have limited data contracts, but if you can increase your data allowance for
less than the cost of the VPN then its an ideal alternative.
My current mobile contract is 30GB data per month, so I can happily sit watching HD videos
via the mobile network.
Downloading Files Now to the subject of certain downloads, best
I not speak the word though. It’s well documented that movie and adult
video producers have gone after users, for supplying their copyrighted media. (Seeding
a file to other people). Some ISPs will even throttle downloading of
these files, even for perfectly legitimate things like Linux distributions.
We also have the other issue of sites being blocked due to legal action taken against
ISP’s. A VPN will certainly mitigate the risk of
being caught, and will circumvent any ISP blocks.
A good alternative though is cloud downloading services. Let another IP be the one to download
and publicly seed the file.
Or you could be really careful what you choose to download, go for the largest files that
have the fewest seeders. It's more likely that the heavily downloaded files are the
ones being monitored. Blocks can be bypassed by choosing a small
ISP that has not been subjected to legal action of movie companies.
Government Restrictions The Internet in some countries is heavily
restricted, on one hand this could be an ideal solution for a VPN, but I wouldn’t be so
quick to choose this route. Governments in these countries will most likely
have the ability to monitor for well known VPN’s and may force providers to hand over
encryption keys. Thus completely unmasking your activities on the Internet.
A custom VPN solution or a smaller provider would be the only options worth considering.
Or even TOR.
Accessing Business or Home network while travelling VPN is a perfect use case for accessing business
or home networks while travelling. Businesses can also revoke access for staff when they
leave the company. Although in this situation it would be a purpose
built VPN server, rather than utilising a pay-for service.
So in conclusion the areas where a VPN could prove useful is preventing snooping by your
ISP, bypassing geographic restrictions on streaming services, and using free WiFi services
which may have been tampered with.
I’m not going to make any recommendation of a particular VPN service, but what I will
say you can setup your own OpenVPN server on a cloud hosting company.
Although if you want to go with an established provider, which would be simpler, then look
for one outside of the country you reside in, and preferably one in a country which
has no extradition with where you live. If you’re going to go for a VPN then make
it as damn hard as possible for anyone to requests logs of your activities.
Stay away from free VPN’s, there is no such thing as a free service, you will be paying
for it with your data.
And lastly don’t believe everything you see on VPN provider websites. I’m going
to cite what I believe is a fine examples of utter trash from NordVPN where they talk
about an ancient vulnerability from 1996, the Ping of Death, where by deliberately fragmenting
an ICMP Ping request packet so that when reassembled it exceeds the maximum size of 65535 bytes.
Nord suggest that using a VPN will protect you, as well as suggesting you update your
system. Considering every operating system made after
1998 is protected, there is absolutely nothing to worry about.
Thanks for watching I’ll see you later