I’ve never completely understood this, but I think the answer would probably be “no,” although I’m not sure. Usually when I leave the house I turn off wifi and just use mobile data (this is a habit from my pre-VPN days), although I guess I should probably just keep it on since using strange Wi-Fi with a VPN is ok (unless someone at Starbucks is using the evil twin router trick . . . ?). I was generally under the impression that mobile data is harder to interfere with than Wi-Fi, but I could well be wrong and my notions out of date. So, if need be, please set me straight. 🙂
Commercial VPNs as a security measure are pretty much a scam, at least in the way they are marketed.
These days, basically any web traffic is encrypted through HTTPS. Even on an untrusted network, nobody will be able to see the actual content (passwords, personal data) of what you’re doing. DNS spoofing isn’t viable either as any fake site they would send you to would lack the right certificates to establish a convincing HTTPS connection. So all someone can see is what servers you’re connecting to, either by logging your DNS requests (can be prevented by using some form of encrypted DNS like DNS over HTTPS) or the IP addresses you connect to. And honestly, how much value does one get out of knowing that there’s someone on their network who browses beehaw.org, supergreatbank.com and bigtiddygothgfs.to with no information to connect that to an actual person?
Unless you routinely use shady open Wi-Fi networks - and I’m talking about something that may have been setup on purpose by a malicious actor, not your local supermarket - to do security-critical stuff, you don’t need a VPN. Also, if you trust your mobile data provider less than a company that tricks people into thinking you absolutely need their product to secure your data, you should get a different mobile data provider.
Now, there are use cases for VPNs but those are more along the lines of accessing stuff that’s not available in whatever region you’re currently in.
Edit: there is of course also the use case of hiding illegal stuff. In that case, I will not give any advice. Put some onions on top of your router or something, that’s probably cheaper and more reliable.
Edit 2: just to make this entirely clear, I’m talking about commercial VPNs like NordVPN, Surfshark and whoever else pays YouTubers to advertise for them. If you host your own VPN, some of the downsides may not be as relevant. Though I would assume that anyone who even considers hosting their own VPN has enough technical knowledge about how networking works to know about the pros and cons.
Do you want a random third party looking at all of your mail before you pick it up? Even if they can’t open the envelope, having somebody else write down every message that comes in who it’s from and who it’s too and how frequent it is, that creep me out.
If you’re uncomfortable with a third party looking at your mail, it’s very reasonable to not one third party’s looking at your internet traffic. It’s the same thing.
You get to choose them. You can research them. They don’t have a geographic monopoly on your internet connection. That gives you more control, and then more incentives to do the right thing
If you pay for your VPN using crypto, then they can’t tie it to your name, when they’re reselling the traffic it’s harder to tie it to an identity
Hiding your traffic from only your Internet Service Provider.
Hiding your downloads (such as torrents) from your ISP and anti-piracy organizations.
Hiding your IP from third-party websites and services, helping you blend in and preventing IP based tracking.
Allowing you to bypass geo-restrictions on certain content.
VPNs can provide some of the same benefits Tor provides, such as hiding your IP from the websites you visit and geographically shifting your network traffic, and good VPN providers will not cooperate with e.g. legal authorities from oppressive regimes, especially if you choose a VPN provider outside your own jurisdiction.
If you pay for your VPN using crypto, then they can’t tie it to your name, when they’re reselling the traffic it’s harder to tie it to an identity
Surely that only works if you have personally mined the crypto yourself.
And if you only use that wallet for paying for the same VPN service.
Crypto isn’t anonymous, the ledger of all transactions (IE the Blockchain) can be read by anyone.
HTTPS, sure. But your ISP can and will create a pretty comprehensive social graph about you using only metadata (server IPs or hostnames). Where I live, all home networks basically have a static IP. Also, besides a commercial incentive, ISPs are also mandated to log your connections. VPNs are not.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !technology@beehaw.org
A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.
Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.
Commercial VPNs as a security measure are pretty much a scam, at least in the way they are marketed.
These days, basically any web traffic is encrypted through HTTPS. Even on an untrusted network, nobody will be able to see the actual content (passwords, personal data) of what you’re doing. DNS spoofing isn’t viable either as any fake site they would send you to would lack the right certificates to establish a convincing HTTPS connection. So all someone can see is what servers you’re connecting to, either by logging your DNS requests (can be prevented by using some form of encrypted DNS like DNS over HTTPS) or the IP addresses you connect to. And honestly, how much value does one get out of knowing that there’s someone on their network who browses beehaw.org, supergreatbank.com and bigtiddygothgfs.to with no information to connect that to an actual person?
Unless you routinely use shady open Wi-Fi networks - and I’m talking about something that may have been setup on purpose by a malicious actor, not your local supermarket - to do security-critical stuff, you don’t need a VPN. Also, if you trust your mobile data provider less than a company that tricks people into thinking you absolutely need their product to secure your data, you should get a different mobile data provider.
Now, there are use cases for VPNs but those are more along the lines of accessing stuff that’s not available in whatever region you’re currently in.
See also Tom Scott’s video on the topic. It’s a few years old but still relevant.
Edit: there is of course also the use case of hiding illegal stuff. In that case, I will not give any advice. Put some onions on top of your router or something, that’s probably cheaper and more reliable.
Edit 2: just to make this entirely clear, I’m talking about commercial VPNs like NordVPN, Surfshark and whoever else pays YouTubers to advertise for them. If you host your own VPN, some of the downsides may not be as relevant. Though I would assume that anyone who even considers hosting their own VPN has enough technical knowledge about how networking works to know about the pros and cons.
Do you want a random third party looking at all of your mail before you pick it up? Even if they can’t open the envelope, having somebody else write down every message that comes in who it’s from and who it’s too and how frequent it is, that creep me out.
If you’re uncomfortable with a third party looking at your mail, it’s very reasonable to not one third party’s looking at your internet traffic. It’s the same thing.
A commercial VPN provider is just another random third party.
You get to choose them. You can research them. They don’t have a geographic monopoly on your internet connection. That gives you more control, and then more incentives to do the right thing
If you pay for your VPN using crypto, then they can’t tie it to your name, when they’re reselling the traffic it’s harder to tie it to an identity
https://www.privacyguides.org/en/basics/vpn-overview/
Surely that only works if you have personally mined the crypto yourself.
And if you only use that wallet for paying for the same VPN service.
Crypto isn’t anonymous, the ledger of all transactions (IE the Blockchain) can be read by anyone.
Monero solves this problem. Monero is the digital cash we were promised in cyberpunk. Not a open ledger, fungible money.
https://www.getmonero.org/resources/moneropedia/fungibility.html
And Mullvad takes monero directly!
That, unlike your ISP, isn’t obligated by law to log the connections you make (‘data retention’). Depending on the jurisdictions.
HTTPS, sure. But your ISP can and will create a pretty comprehensive social graph about you using only metadata (server IPs or hostnames). Where I live, all home networks basically have a static IP. Also, besides a commercial incentive, ISPs are also mandated to log your connections. VPNs are not.
As a gay pirate assassin I encourage everyone to watch that Tom Scott video