A virtual private network (VPN) service provides a proxy server to help users bypass Internet censorship such as geo-blocking and users who want to protect their communications against data profiling or MitM attacks on hostile networks.
A wide variety of entities provide VPN services for several purposes. But depending on the provider and the application, they do not always create a true private network. Instead, many providers simply provide an Internet proxy that uses VPN technologies such as OpenVPN or WireGuard. Commercial VPN services are often used by those wishing to disguise or obfuscate their physical location or IP address, typically as a means to evade Internet censorship or geo-blocking.
Providers often market VPN services as privacy-enhancing, citing security features, such as encryption, from the underlying VPN technology. However, users must consider that when the transmitted content is not encrypted before entering the proxy, that content is visible at the receiving endpoint (usually the VPN service provider's site) regardless of whether the VPN tunnel itself is encrypted for the inter-node transport. The only secure VPN is where the participants have oversight at both ends of the entire data path or when the content is encrypted before it enters the tunnel.
On the client side, configurations intended to use VPN services as proxies are not conventional VPN configurations. However, they do typically utilize the operating system's VPN interfaces to capture the user's data to send to the proxy. This includes virtual network adapters on computer OSes and specialized "VPN" interfaces on mobile operating systems. A less common alternative is to provide a SOCKS proxy interface.
In computer magazines, VPN services are typically judged on connection speeds, privacy protection including privacy at signup and grade of encryption, server count and locations, interface usability, and cost. [1] [2] [3] [4] In order to determine the degree of privacy and anonymity, various computer magazines, such as PC World and PC Magazine , also take the provider's own guarantees and its reputation among news items into consideration. [1] [2] Recommendation websites for VPNs tend to be affeliated or even owned by VPN service providers. [5]
Users are commonly exposed to misinformation on the VPN services market, which makes it difficult for them to discern fact from false claims in advertisements. [11] According to Consumer Reports, VPN service providers have poor privacy and security practices and also make hyperbolic claims. [12] The New York Times has advised users to reconsider whether a VPN service is worth their money. [13] VPN services are not sufficient for protection against browser fingerprinting. [14]
In March 2018, the use of unapproved VPN services was banned in China, as they can be used to circumvent the Great Firewall. [18] Operators received prison sentences and were penalized with fines. [19] [20] [21] [22] Russia banned various VPN service providers in 2021. [23]
PC Magazine recommends that users consider choosing a provider based in a country with no data retention laws because that makes it easier for the service to keep a promise of no logging. [24] PC Magazine and TechRadar also suggest that users read the provider's logging policy before signing up for the service, [24] [3] because some providers collect information about their customers' VPN usage. [25] [26] PC World recommends that users avoid free services as a rule of thumb and said free services either sell their users' browsing data in aggregated form to researchers and marketers, or only offer a minimal amount of data transfer per month. [25]
Notes
Service | Leak Protection | Protocols | Obfuscation / Censorship Avoidance | Network Neutrality | Server | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
First-party DNS servers | IPv6 supported / blocked | Offers kill switch | Offers OpenVPN | Offers WireGuard | Supports multihop | Supports TCP port 443 | Supports Obfsproxy | Offers SOCKS | Linux support | Supports SSL tunnel | Supports SSH tunnel | Blocks SMTP (authent.) | Blocks P2P | Dedicated or virtual | Diskless | |
Atlas VPN | Yes | Yes | Yes | No | Yes | Yes | No | No | No | Yes | Some | No | Dedicated | No | ||
Avast SecureLine | Yes | Yes | Yes | Yes | No | No | No | No | Some [76] | Dedicated [77] | No | |||||
Avira Phantom VPN | Yes | Yes | Yes | Yes | No | No | Yes | No | No | No | No [78] | Dedicated | No | |||
ExpressVPN | Yes [30] | Yes | Yes | Yes [30] | No | No | Yes [30] | Yes [79] | No [31] | Both [80] [81] | Yes | |||||
Hotspot Shield | No | No | Yes | No | No | No | No | ? | ||||||||
IPVanish | Yes [82] | Yes [83] | Yes | Yes [42] | Yes [84] | No | Yes [85] | Yes [86] | Yes [42] | Yes [87] | No | No | No [42] | No [42] | Dedicated | No |
IVPN | Yes [88] | No [89] | Yes | Yes | Beta [90] | Yes; OpenVPN | Yes | Yes | Yes [91] | Yes [92] | No [93] | No [94] | Dedicated [95] | |||
Mullvad | Yes [96] | Yes [96] | Yes | Yes [96] | Yes [97] | Yes; WireGuard [98] and SOCKS5 | Yes [96] | No [99] | Yes [100] [96] | Yes [101] | Yes | Yes [96] | No [96] | No [96] | Dedicated [102] | Yes [103] |
NordVPN | Yes [104] | No [105] | Yes | Yes [106] | Yes; NordLynx based on WireGuard [107] | Yes; OpenVPN [108] and SOCKS5 | Yes [109] | Yes [110] | Yes [111] | Yes | No [112] | Dedicated | Yes | |||
PrivadoVPN | Yes | Yes | Yes | Yes | Yes [113] | Yes | Yes | No | ||||||||
Private Internet Access | Yes [114] | Yes [115] | Yes | Yes [116] | Yes [117] | Yes [118] | Yes [119] | No | Yes [120] | Yes [121] | Some [a] | No [123] | Dedicated [124] | Yes [125] | ||
ProtonVPN | Yes | No | Yes | Yes | Yes [126] | Yes | Yes | No | No | Yes [127] | Yes | Yes | Some [b] | Dedicated | ||
PureVPN | Yes | Yes | Yes | Yes [129] | No | No | Only through SSTP [130] | No | No | Yes [131] | No | Some [132] | Both [133] [81] | No | ||
Surfshark | Yes | No | Yes | Yes | Yes | Yes (WG, OVPN, IKEv2) | Yes | No | No | Yes | Some | No | Both | Yes | ||
TunnelBear | Yes [72] | Yes | Yes | Yes [134] [69] | No | No | No | Yes [135] [70] | Yes | Yes | No [136] | Some [137] | ||||
Windscribe | Yes | Yes | Yes | Yes | Yes [138] | Yes | Yes | No | No [139] | Yes (via Stealth protocol) | No | No | No | Dedicated [c] | Yes [141] | Yes |
Notes
Notes
The following definitions clarify the meaning of some of the column headers in the comparison tables above.
The Domain Name System (DNS) is a hierarchical and distributed name service that provides a naming system for computers, services, and other resources on the Internet or other Internet Protocol (IP) networks. It associates various information with domain names assigned to each of the associated entities. Most prominently, it translates readily memorized domain names to the numerical IP addresses needed for locating and identifying computer services and devices with the underlying network protocols. The Domain Name System has been an essential component of the functionality of the Internet since 1985.
In computer networking, a proxy server is a server application that acts as an intermediary between a client requesting a resource and the server providing that resource. It improves privacy, security, and possibly performance in the process.
Virtual private network (VPN) is a network architecture for virtually extending a private network across one or multiple other networks which are either untrusted or need to be isolated.
An open proxy is a type of proxy server that is accessible by any Internet user.
In computer networks, a tunneling protocol is a communication protocol which allows for the movement of data from one network to another. It can, for example, allow private network communications to be sent across a public network, or for one network protocol to be carried over an incompatible network, through a process called encapsulation.
DNS hijacking, DNS poisoning, or DNS redirection is the practice of subverting the resolution of Domain Name System (DNS) queries. This can be achieved by malware that overrides a computer's TCP/IP configuration to point at a rogue DNS server under the control of an attacker, or through modifying the behaviour of a trusted DNS server so that it does not comply with internet standards.
VPN blocking is a technique used to block the encrypted protocol tunneling communications methods used by virtual private network (VPN) systems. Often used by large organizations such as national governments or corporations, it can act as a tool for computer security or Internet censorship by preventing the use of VPNs to bypass network firewall systems.
TunnelBear is a public VPN service based in Toronto, Canada. It was created by Daniel Kaldor and Ryan Dochuk in 2011. In March 2018, TunnelBear was acquired by McAfee.
A public recursive name server is a name server service that networked computers may use to query the Domain Name System (DNS), the decentralized Internet naming system, in place of name servers operated by the local Internet service provider (ISP) to which the devices are connected. Reasons for using these services include:
Mullvad is a commercial VPN service based in Sweden. Launched in March 2009, Mullvad operates using the WireGuard and OpenVPN protocols. It also supports Shadowsocks as a bridge protocol for censorship circumvention. Mullvad's VPN client software is released under the GPLv3, a free and open-source software license.
ExpressVPN is a company providing online privacy and security solutions, including a virtual private network (VPN) service and a password manager. Since September 2021, ExpressVPN has been a subsidiary of Kape Technologies, a company wholly owned by Israeli billionaire Teddy Sagi.
NordVPN is a Lithuanian VPN service with applications for Microsoft Windows, macOS, Linux, Android, iOS, Android TV, and tvOS. Manual setup is available for wireless routers, NAS devices, and other platforms.
IVPN is a VPN service offered by IVPN Limited based in Gibraltar. Launched in 2009, IVPN operates using the WireGuard, OpenVPN, and IKEv2 protocols.
DNS over TLS (DoT) is a network security protocol for encrypting and wrapping Domain Name System (DNS) queries and answers via the Transport Layer Security (TLS) protocol. The goal of the method is to increase user privacy and security by preventing eavesdropping and manipulation of DNS data via man-in-the-middle attacks. The well-known port number for DoT is 853.
IPVanish VPN is a US-based VPN service owned by Ziff Davis.
HMA is a VPN service founded in 2005 in the United Kingdom. It has been a subsidiary of the Czech cybersecurity company Avast since 2016.
PureVPN is a commercial VPN service owned by GZ Systems Ltd. Founded in 2007, the company is based in the British Virgin Islands.
1.1.1.1 is a free Domain Name System (DNS) service by the American company Cloudflare in partnership with APNIC. The service functions as a recursive name server, providing domain name resolution for any host on the Internet. The service was announced on April 1, 2018. On November 11, 2018, Cloudflare announced a mobile application of their 1.1.1.1 service for Android and iOS. On September 25, 2019, Cloudflare released WARP, an upgraded version of their original 1.1.1.1 mobile application.
Surfshark VPN service is a digital privacy tool provided by the cybersecurity company, Surfshark. It also offers a data leak detection system, a private search tool, an antivirus and an automated personal data removal system.
Windscribe is a commercial, cross-platform virtual private network (VPN) service provider based in Canada.
It's important to keep a few things in mind when evaluating which VPN service is right for you: reputation, performance, type of encryption used, transparency, ease of use, support, and extra features.
We were looking for features, value, and clear and honest pricing. Free ways to learn more about a service - free plans, trial periods, refund periods - were important, and we also looked for companies which maintained your privacy when you signed up (no email address required, trials available without credit cards, Bitcoin available as a payment option).
{{cite web}}
: CS1 maint: numeric names: authors list (link)Information about your use of our website the Cookie generates is usually transferred to a Google server in the USA and saved there. However, before this happens, Google shortens and anonymizes your IP address [...] if located within a member state of the European Union or in other contracting member states to the Agreement on the European Economic Area. The entire IP address is transferred to a Google server in the USA and saved there only in exceptional cases. [...] Information about your use of our website (including your IP address) that Cookies generate is transferred to a CrazyEgg server in the USA and stored there.
We do not collect logs of your activity, including no logging of browsing history, traffic destination, data content, or DNS queries. We also never store connection logs, meaning no logs of your IP address, your outgoing VPN IP address, connection timestamp, or session duration.
We collect information about whether you have successfully established a VPN connection on a particular day (but not a specific time of the day).
We may know, for example, that our customer John had connected to our New York VPN location on Tuesday and had transferred an aggregate of 823 MB of data across a 24-hour period.
Continue below to buy VPN with Bitcoin.
When you use Hotspot Shield to access the internet, we collect only anonymous, aggregate data about which websites you visit and which apps you use.
Your IP address may be collected when you visit our websites.
We collect your IP address [...]. We may also use your IP address to derive your approximate location [...]. Your true IP address is stored only for the duration of your VPN session and is cleared after your session is closed.
We do not store any connection logs whatsoever. In addition we do not log bandwidth usage, session data or requests to our DNS servers.
We accept all major credit cards, Paypal, Bitcoin and cash. However paying with cash is only available when purchasing an annual subscription.
We log nothing whatsoever that can be connected to a numbered account's activity: no logging of traffic; DNS requests; connections, including when one is made, when it disconnects, for how long, or any kind of timestamp; IP addresses; user bandwidth [or] account activity except total simultaneous connections [...] and the payment information detailed in this post.
Mullvad accepts Bitcoin, cash, bank wire, credit card, PayPal, and Swish.
You do have the option of sending an encrypted email to us using PGP. Mullvad's PGP key is found on our website.
PrivateInternetAccess.com does not collect or log any traffic or use of its Virtual Private Network ("VPN") or Proxy.
We do not impose any restrictions or limitations on usage and/or bandwidth consumption.
None of the following records are stored by PureVPN' ... Browsing activity ... Browsing history ... Sites visited ... Content or data accessed
None of the following records are stored by PureVPN' ... DNS queries generated by the user
None of the following records are stored by PureVPN' ... Connection timestamps
We keep track of the total bandwidth consumed by a user to make sure everybody is getting the highest speeds and the best possible experience from our product.
From here on forward, we do not keep any records of anything that could associate any specific activity to a specific user.
Since we are huge believers in anonymity, we have included Bitcoin and Gift Cards – 100% anonymous payment methods – in the payment methods accepted by us.
Every time you connect to TunnelBear, your DNS requests are directed to TunnelBear DNS servers, so your ISP can no longer see what websites you're visiting. And because we don't keep any records of your DNS, you're the only one that knows your browsing history.
Understanding how much data people are using is a critical metric for TunnelBear. [...] We felt that overall usage would respect individual user privacy (i.e. no login timestamps [...]) [...].
We support peer-2-peer (P2P) networking in some of our server locations.
All of our VPN gateways run on dedicated hardware servers.
Our network is SSL-secured
Similar to PureVPN, ExpressVPN says it uses virtual servers in certain locations due to infrastructure issues.
No, but we are planning to add the support of IPv6 in 2018.
For OpenVPN TCP connections - port 443.
Yes, we do support Socks5 proxies as well as HTTP proxies (1 HTTP and Socks5 proxy at each of our VPN server destinations).
{{cite web}}
: CS1 maint: numeric names: authors list (link)We use our own private DNS servers for your DNS queries while on the VPN.
IPv6 leak protection disables IPv6 traffic while on the VPN. This includes 6to4 and Teredo tunneled IPv6 traffic.
This is used in conjunction with the OpenVPN protocol [...]
Although quite different from a VPN, we provide a SOCKS5 Proxy with all accounts in the event users require this feature.
Any VPN provider that does not retain logs must block outgoing SMTP traffic due to rampant spam associated with usage of VPN services. With that said, we can whitelist (allow) any outgoing email server that a) require authentication, and b) is correctly setup so as not to be an open relay.
In addition, any blocked software by your ISP including P2P and other various software applications will be unblocked and unrestricted on our systems.
10 Multi-Logins per Household
Furthermore, we have blocked P2P on some of our servers as per changing Global Web Policy. We don't allow p2p/filesharing where it's illegal by law named United Kingdom (UK), United States (US), Canada, Australia etc.
PureVPN has never denied using virtual servers. To make matters simpler, an update on our Server Location page will state which servers are virtual and which are physical.
When you turn GhostBear on, it changes your VPN traffic signature to look like a different kind of traffic. To do this, GhostBear uses a technology called Obfsproxy.
TunnelBear does not block SMTP on our network.
Turning Hotspot Shield on encrypts all of the traffic between your device and our servers using TLS 1.2 with perfect forward secrecy (ECDHE), 128-bit AES data encryption.
We encrypt all of the traffic between your device and our servers using TLS 1.2 with perfect forward secrecy (ECDHE), 128-bit AES data encryption, and HMAC message authentication.