July 18, 2020

Why should you trust *your* VPN???

VPN services sound like a great idea. Send all your traffic (encrypted) to a VPN server and they fan out to the internet at large. So someone snooping on your traffic (e.g. your ISP) won't see anything about you but traffic to and from your VPN.

But ... now you must trust your VPN provider, since they will have all your traffic flowing through them.

And a lot of VPN's are not local to the US. Many are hosted in unfriendly waters. They are obviously high value targets for state-sponsored (and random) hacking.

This article showed up today writing about several VPN services in Hong Kong. All of them advertise "no logs kept" ... and all of them are keeping logs. And even keeping them in publicly accessible places.

https://www.theregister.com/2020/07/17/ufo_vpn_database/

... seven Hong-Kong-based VPN providers – UFO VPN, FAST VPN, Free VPN, Super VPN, Flash VPN, Secure VPN, and Rabbit VPN – all share a common entity, which provides a white-labelled VPN service. And they were all leaking data onto the internet

... records of websites visited, connection logs, people's names, subscribers' email and home addresses, plain-text passwords, Bitcoin and Paypal payment information, messages to support desks, device specifications, and account info.

Security is hard, the fear is strong, and the combination makes VPN services a ripe field for fraud.