VPN ARE THEY SAFE

[ALF28]

I have a free VPN called  Proton vpn on my laptop.

I noticed today having started using the Firefox browser the browser did not like the vpn and made me do a robot check, it said unusual traffic, but did work after the robot check.

I then checked the VPN IP address and although not blacklisted it is identified as a vpn proxy used by hackers and has been used for hacking, spam, phishing, bad web bot etc.

I was concerned that the proton vpn has been used for these activities via a server based in the Netherlands and wondered if I am safe using this free VPN

The other disadvantage is the vpn usually  auto-selects a Netherlands server, so the browser switches to Dutch language which I can not read, although I can select to use a USA server, just tried that and that works OK.

Is it safe to use free VPN'S and is the data secure using unknown servers.???

I presume paid for VPN's may be safer?

Do I really need a VPN or is just hype by the companies selling them?

alf28

[Andrew-G · Accepted solution]

If you don't know whether you need a VPN, the probable answer is that you don't.  They can reduce the ability of advertisers to track your every move on the internet, they can allow you to access region-restricted content, and if you're paranoid about such things as state agency monitoring, or even VM's scrutiny and recording of your web browsing.  Those are ideal for a very few people, for most people they're nice to have, but not worth the hassle or cost of a VPN.  In addition to the cost, there's usually slower speeds and worse latency through a VPN.  One other possible use case is for gamers who have a knack of attracting the wrong sort of attention and getting denial of service attacks, in which case the VPN is an effective defence (almost as effective as not offending people enough to DOS them in the first place)..

When it comes to free VPN's, think about it - it costs money to provide the servers for a VPN, somebody is paying for that.  Who would pay, and why might they pay?  There has to be an ulterior motive.  Also think about who yanks the chain.  As an example, there's a free VPN built into the Opera browser.  Opera is owned by Chinese interests, given China's appalling record of spying and human rights abuse, what's the chance that they own Opera, and are entirely happy to let users have total anonymity through this "free" VPN?  In other cases the motives may be more base and commercial, simply to funnel your traffic through preferred DNS and routing, and to resell your browsing data to the highest bidder.  Or, like Proton, the free version is reduced capability and intended to encourage users onto the paid VPN.

Paid VPNs based in Europe are the nearest to doing what they say on the tin, people like Proton, ExpressVPN and Nord VPN.  But do you really need them?

[Roger_Gooner · Accepted solution]

You have no idea what logs are kept - and for how long - by any VPN provider regardless of what they declare on their website. And if you think that they will disobey a court order to hand over their logs you may be mistaken.

I feel that I have no need for a VPN. Whenever I access a website which requires sensitive data (such as a bank's) it's all done via HTTPS which provides end-to-end encryption.

[ALF28]

VPN

Thanks for the good advice from all the answers regarding the use of VPN. I do not think I need it, it was free with proton mail.

I agree that htpps should be good enough doing transcactions online and I go a step further sometimes and check the website certificate is valid and up to date. The servers that VPN uses are an unknown and a possible security risk, especially the free ones, and it does slow down the speed.

At least mine did work, I see many have issues with the hub3 and vpn.I have left it on my laptop but propably rarely need the vpn unless I need one for any reason.

alf28

[ravenstar68 · Accepted solution]

The problem for me is that VPN's weren't designed to anonymise your traffic.

The idea of belonging to a VPN is that you could connect to it from a remote location, and you would be treated as if you were connected directly to the network.

So when you are connecting to something like NordVPN etc, they are becoming your gateway to the internet.  But there is always the possibility that someone could sniff packets travelling through the VPN and out to the internet at large.

Tim

[MrHalfAsleep · Accepted solution]

So, basically it's like connecting to a "random (internet based) ISP".  Even if they don't keep logs (which I think is a highly dubious claim), if you're accessing a server via a HTTP(s) request, surely this has to be recorded for the data exchange to take place; so there is a record of something, otherwise it won't work.  Question is, if they don't keep logs, how do the FBI arrest folk who use their services?  If they're "legit", they're still bound by law to turn stuff over if you partake in nefarious activity.

Initiating server query ...
Looking up IP address for domain: google.co.uk
The IP address for the domain is: 142.250.178.3
Connecting to the server on standard HTTP port: 80
[Connected]  Requesting the server's default page.
The server returned the following response headers:
HTTP/1.1 301 Moved Permanently
Location: http://www.google.co.uk/
Content-Type: text/html; charset=UTF-8
Date: Sun, 27 Jun 2021 21:38:14 GMT
Expires: Tue, 27 Jul 2021 21:38:14 GMT
Cache-Control: public, max-age=2592000
Server: gws
Content-Length: 221
X-XSS-Protection: 0

[ALF28]

VPN- SHOULD I USE ONE.

Thanks for the replies/answers.

I agree that using a VPN probably does leave some records. I think VPN's are encrypted but still use unknown severs in UK , USA  or other countries.

I often get blocked if I use a VPN, some websites will not connect or require security checks, as the VPN -IP address may have been abused by others so have to switch off the VPN in order to connect to the website.

The only advantage is that it is supposed to be a more secure method of connection by creating a tunnel and shields your own IP address so you are anonymous, even from your ISP.

Some may use VPN for other reasons for streaming or hiding their location or just protecting their computers while browsing or protection generally.

I rarely switch mine on for known websites, unless I am browsing generally, and clicking on searches or using unknown websites or you wish to remain private, but may help to provide some protection. All websites will log your IP address, it can be then used to communicate with your computers etc. and hackers can use IP addresses so they are best kept private. I do not need a VPN most of the time, and still unsure when to use one, and why they are often blocked by websites with a warning of unusual traffic.

The increasing TV adverts tell use to use a VPN for privacy and to protect bank details etc from being stolen., but I am not convinced I need one all the time, and do not use one for banking, shopping online etc. and preume the virgin broadband/ISP is secure and does not need a VPN.

alf28

[ALF28]

MY free VPN- unexpected expiry

My free vpn just expired, so I will remove it now, not sure why it has done this after using it for months, requires a log in to renew it.

The Ip addresses used by my vpn are often blacklisted, and used for spam and hacking and using unknown servers in many countries, so not sure how they can be secure?

alf28

[MrHalfAsleep]

I went a bit mad on spam a few years back, where I mined data to find out where the servers were.  I posted a lot my findings on here at the time.  It was also quite exciting as I was learning as I went, and it was something I hadn't remotely considered doing before.  What I found out was how easy it was for spammers to chop and change poorly configured severs around the world.  VPN's make it easier still for them.

Like VPN's, they were dotted around world and spammers could quite easily change the servers used to ones in other countries.  So you have exactly the same setup as you do with VPN's.  If you're mirroring spammers (behaviour) by using them, why would you have a need to do that?  Yes, VPN's aren't illegal, but spamming is.  Your ISP doesn't know because you're not connecting to their servers.  So in our case VM IS NOT RESPONSIBLE in any way shape or form if you are arrested for dodgy activity by foreign authorities if dodgy activity on the "VPN" server is being carried out.  Another thing is that if VPN's are so great, why doesn't VM offer them as a service?  If there were a business/security case, they would.

This thread exposes them for what they are.

[ravenstar68]

I think people need to take a step back and understand the what the terms private and public mean in a networking sense.

A public network is a network that anyone is allowed access to.
A private network is a network that has access limited to specific users or groups of users.

It's never about how visible the data is.  In fact some VPN's use GRE tunnels which have no encryption on them at all.  Nor is it really about the IP addresses used.  RFC1918 and NAT were bought in to make a specific set of IP addresses available to all private networks in order to deal with the recognised shortfall in IPv4 addresses.

If you look at Windows Firewall you'll see it has a 3 different sets of rules

Domain - rules for computers using the same domain
Private - rules for computers on private networks
Public - rules for computers on public networks

The former two are less restrictive, for example File and Printer Sharing is enabled for private networks but disabled for public one's.  Windows defaults to seeing a network as a public network until you specifically tell it that the network you are on is a private one.

However the idea of VPN's is to allow you to extend YOUR private network across the internet.  Thus I set up a VPN server on my home network, then when I am out and about, I can connect my VPN client to the server and my machine effectively joins my home network from across the internet.

THIS IS WHAT VPNS ARE DESIGNED FOR!!

Commercial VPN's are a complete **bleep**isation and rely on the publics misunderstanding of what the words 'private network' actually means.

Excluding TLS for a moment, while your data might be encrypted between your PC and the VPN server.  Once it's on the VPN network, it's in the clear, and can be sniffed by the VPN provider.

So while commercial VPN's can be useful, if you want to say watch American Netflix content in the UK (and note that Netflix do lock out VPN networks where they can), I'd be very wary of sending traffic such as email or banking traffic over them.

Tim

Edit - Also note that the anonymisation aspect means that VPN's appeal to spammers and other ne'er do wells as well.  At least one VPN provider that I know of blocked outbound email traffic from traversing their VPN for this very reason.