We welcome this guest post from Top10VPN.com, an Organization Member of the Internet Society.
The search for online privacy has driven a quarter of the world’s Internet users to download a Virtual Private Network (VPN). VPN services are now an important tool for anyone concerned about security and privacy on public networks.
There’s a world of difference between VPNs,
though. Without clear and unbiased information many users are forced to
navigate their choice of VPN without much clarity.
Why is choosing the
right VPN provider so important?
Whenever you switch on a VPN you are
entrusting its provider with your personal data, browsing activity, and
sometimes even your security. For this reason, VPN providers must be held to a
higher standard than most products. It’s important you do your due diligence
when making a decision.
What
should I look out for?
A
good VPN will ensure that no one – even the VPN itself – can see what the user
is doing online. Consider the following qualities:
Technical
Security
The most secure VPN services will be transparent
about the measures they have in place to safeguard their users and their
business.
Any VPN worth its salt will offer the latest and
most secure levels of encryption, a wide selection of strong protocols, and a
range of additional security features including kill-switches, split-tunneling,
and Tor compatibility.
Look for features like AES-256 encryption, OpenVPN functionality, and products
that are independently audited by a respected third party. You should also look
for VPNs that accept anonymous payments, incorporate open source software where
appropriate, and have a clear policy for disclosing vulnerabilities.
Some VPNs can suffer from IP and DNS leaks.
These leaks can be seen and collected by your ISP or any other entity that’s
able to access your network. Needless to say, this renders the VPN effectively useless
in terms of protecting your privacy.
Ultimately, a secure service will have several
measures in place to protect user data and will actively offer the most
sophisticated security standards available. Be sure to test your
provider for leaks and ensure that
respected third-parties have validated your provider’s claims of security.
Privacy
Policy
Evaluating the privacy policy is one of the most
important stages in assessing a VPN. Unfortunately, there are some products on
the market with policies that leave room for improvement.
The best VPNs have ‘zero logs’ policies which,
if implemented properly, will not store any identifying data. However, many
providers use this term with very little substantiating evidence, and it can be
difficult to know with complete certainty whether a provider is logging or not.
Secure VPNs will only log a minimal amount of
basic connection data like bandwidth usage, server load, or server location.
This is used to optimize provision of the service, and can’t be used to
identify a user. Some VPNs, by contrast, have been found to log activity data
including the originating IP address, DNS requests, and even a user’s entire
online history – websites visited, files downloaded, and message contents
included.
To make matters worse, the logging policies of
some providers are often vague or unnecessarily complicated. It’s not uncommon
for some VPN services to avoid directly stating whether their policy applies to
connection logs, activity logs, or both. A provider might advertise ‘zero-logs’
or ‘minimal logs’ for one type of data, but continue to record the other.
It should be clear exactly what type of data your VPN creates and stores during or after a session. Look for VPNs that explain clearly what their logging policy is and VPNs that have a demonstrated history of inability to cooperate with legal data requests for this reason.
Make sure you read your provider’s privacy
policy in full, or consult a third party who can do this research for
you.
Location and
Jurisdiction
Jurisdiction is an important issue that’s often
overlooked. Every VPN provider is bound to local laws and regulations. It’s
crucial that you are aware of these laws and how they might affect your
privacy.
In theory, if a provider’s logging policy is
watertight, its jurisdiction shouldn’t matter. That being said, any legitimate
VPN provider will have clear procedures for responding to requests from law
enforcement regardless of its logging policy. These procedures, including a warrant
canary, should be publicly available along with any
measures in place to protect user data if a third party were to gain access to
their servers.
It’s wise to check the country your VPN is based
in, the laws of that country, and the company’s history in terms of cooperation
with law enforcement.
Ownership and Business
Model
VPN services can monetize your data in
unexpected ways. It’s expensive to develop and operate a reliable VPN, and many
services choose to subsidize these costs with income from other channels.
It’s possible that some form of data
collection, sharing, or sale is occurring in order to cover the cost of the
product. Many services also rely heavily on advertising, which is less than
ideal for privacy.
Providers should clearly explain how they make
money and how your financial details are processed. You should be able to
easily tell whether a service runs on user subscriptions alone or if it also
profits from the processing of personal data.
Before buying a subscription or reading a
review, make sure you understand who ultimately owns the VPN service and
whether or not it can be trusted.
You should be able to find the company’s legal
name if it differs from its brand name, along with information on any other
entities that control or invest in the provider’s services. Be sure to find out
if these groups have financial stakes in other VPN products, and if so, whether
they share information between them.
Determining your
standards
People use VPNs for many different reasons.
Whether you’re picking a service for streaming, torrenting, censorship
circumvention, or strictly for privacy purposes, it’s important to understand
whether your chosen provider offers all the necessary features you need.
Once you have an idea of how your VPN stands up
in terms of technical security, privacy, and business model, it’s worth
considering broader qualities like customer support, speed, and device
compatibility.
Some VPNs offer dedicated servers for specific
streaming platforms, while others can give you a connection specifically
optimized for torrenting. Check the company’s website and third-party reviews
to see if your provider will work with the platforms you need and provide
speeds that are sufficient for your purposes. You can also find out whether its
servers will work in heavily-censored countries.
Check to see if your provider has dedicated apps
for each of your devices. A lack of native support for your tablet, smartphone,
or streaming device means you could risk partial protection and a suboptimal
user experience.
Can you
trust your VPN?
At the most basic level, a trustworthy VPN will
never collect, share, or sell user data without appropriate legal precedent.
Make sure to consider its business model, location, technical security and
privacy policy. If it’s unable to provide clear answers to all of these
questions, it’s probably not worth your time.
Common
sense can save you a lot of trouble. Review your provider’s reputation and
never use a VPN you’re not fully comfortable with. Just like you wouldn’t give
a stranger unrestricted access to your home, you shouldn’t give unfamiliar
applications access to your personal data.
Ultimately,
if you’re really concerned about security and performance, you should be using
a VPN that’s independently tested and well-reviewed by unbiased experts.
A good VPN can be seen as an investment in your security, privacy, and freedom – to prevent costly data loss, open up your browsing capabilities, and protect your right to privacy.
Ready to do more? Read The Lazy Person’s Guide to Better Online Privacy.
The post What to Look for When Choosing a VPN appeared first on Internet Society.