I have non-technical friends and relatives that have fully bought into this and when I asked why they use a VPN I got non-specific answers like "you need it for security", "to prevent identity theft", or my personal favorite: "to protect my bank accounts".

Not a single person has said "I pay to route my traffic through an unknown intermediary to obscure its origin" or "I installed new root certificates to increase my security."

On the other hand, as far as privacy from the end point is concerned, users can be identified regardless of IP addresses. Visit fingerprint.com, you will get an identifier, then connect to a privacy VPN and change servers once in a while. The website will identify you, tell you are the same user visited last week from such location, and the number of times you visited.

Browsers (except Tor) send so much data that accurate identification is possible without IP address. And services could refuse to work if users don’t provide the required information, although that info could be randomized.

It greatly improves on the existing VPN trust model by separating the "who" (connecting IP, potential payment info, etc.), from the "what" (IP traffic). You no longer have a trust a single entity not being malicious or compromised.

Disclaimer: I run obscura.net, which does exactly this with Mullvad (our partner) as the Exit Hop.

This makes me feel a little uneasy of their unstated longterm goals (corner the entire market), but I do think they are the most trustworthy out there right now

VPN providers all run the same two or three VPN protocols, all with similar security guarantees and privacy limitations.

I've been playing with MASQUE relays over the last year. Apple's iCloud Private Relay is a MASQUE relay (two, actually). MASQUE can offer genuine privacy improvements via traffic separation, preventing any single party from correlating the traffic source and destination.

Some of the privacy concerns of VPN users can be mitigated with better technology. And relays are built into Apple operating systems today. I'm surprised that they aren't very widely deployed yet.

I assume similar Wikipedia entries will appear in the future about some, if not most of today's VPN providers.

[1] https://en.wikipedia.org/wiki/Crypto_AG

[2] https://en.wikipedia.org/wiki/Operation_Rubicon

Like reverse VPN :) on one side makes client look like he's accessing internet from VPN exit location, and on the other end allowing for money someone to pretend that he's a residential client.

Must be that these so-called "tech" companies have no problem figuring out who is the ad target behind each VPN IP address, fingerprinting them and tracking their online behaviour acrosss every computer they use

TIL VPNs actually have _no impact_ on the data collection and ad services "business model"

Almost everyone I know use VPNs only to bypass restrictions, not for fear or privacy.

[1] https://www.anonymous-proxies.net/products/

IPSec perhaps less so since it is more complicated and open to insecure configurations (transport mode).

The evil regime doesn't need to have a popular evil VPN that everybody uses... it may be enough to operate (or hack) a smaller VPN which can unmask enough dissidents that their friend-groups can be found by other means.

That said, the few implementations I have test before seemed leaky and not as useful as they claim.

https://docs.google.com/spreadsheets/d/1ijfqfLrJWLUVBfJZ_Yal...

Consider-- people bring their traffic to you to monitor, and particularly people who are trying to conceal their identity or activities. They pay you for this, which means that if you get collateral benefit you can run at a small loss and undercut any legitimate players (if there are any!) or run levels of advertising that a legitimate business couldn't sustain. -- while its simultaneously one of the most cost effective surveillance plays you could imagine, since it's still primarily funded by the victims.

VPN services also have good deniability for their surveillance. Although (maybe!) your ISP can't surveil the VPNed traffic the VPN provider's ISP can as well as your counterparties ISP (and any other parties brought into the mix by things like third party content). And like any other electronic surveillance, parallel construction can be highly effective.

They can also be stood up by anyone, you can run any number of services. They don't require extremely extensive physical infrastructure, investment, large numbers of employees like running an ISP. You can even target particular actors or populations by using targeted advertising, though it's still most effective as a data hoovering operation.

Particularly for the intelligence actors they also have the benefit that issues like getting harassed by the state are among the complications of this business, but that is potentially less of an issue if you are the state.

And if there were an actually honest provider, they'd be a prime target for infiltration... all that interesting traffic in one place.

Operates more transparently. No concerning findings identified.

• Mullvad (Mullvad)

• TunnelBear (TunnelBear)

• Lantern (Lantern)

• Psiphon (Psiphon)

• ProtonVPN (Proton VPN)

Operates more anonymously. Potentially concerning, but no definitive findings.

• HotVPN (HotVPN)

• LetsVPN (LetsVPN)

• Astrill VPN (Astrill VPN)

• CookieDevs (Cookie, Ciao Proxy Pro)

• VPN Super Inc (VPN - Super Unlimited Proxy)

• PureVPN (PureVPN)

• Potato VPN (Potato VPN)

Concerning and suspicious findings (users should avoid).

• Innovative Connecting (Turbo VPN - Secure VPN Proxy, Turbo VPN Lite - VPN Proxy, VPN Monster - Secure VPN Proxy)

• Autumn Breeze (SnapVPN, Signal Secure VPN - Robot VPN)

• Lemon Clove (SuperNet VPN, VPN Proxy Master Pro, VPN Proxy Master Lite)

• Matrix Mobile (Global VPN)

• ForeRaya Technologies (Melon VPN)

• Hong Kong Silence Technology (Super Z VPN)

• Yolo Mobile Technology (Touch VPN - Stable & Secure, VPN ProMaster - Secure your net)

• Wild Tech (3X VPN - Smooth Browsing, VPN Inf, Melon VPN - Secure Proxy VPN)

I mean, this seems like the company name equivalent of the yellow and black stripes on a wasp. It is a _warning_.

i mean, those companies are so popular they’re almost normie household names. the couple i looked at from the papers list have a small fraction of downloads compared to the above.

i agree that we absolutely need a deeper dive and a lot more transparency on who owns these companies but i’m curious why they chose to avoid the elephants in the room.

[1] https://vp.net/l/en-US/blog/Don%27t-Trust-Verify