{"id":349,"date":"2025-02-25T19:30:24","date_gmt":"2025-02-26T01:30:24","guid":{"rendered":"https:\/\/blog.unspecific.com\/?p=349"},"modified":"2025-02-26T19:01:54","modified_gmt":"2025-02-27T01:01:54","slug":"vpns-stating-the-obvious","status":"publish","type":"post","link":"https:\/\/blog.unspecific.com\/?p=349","title":{"rendered":"VPNs – Stating the Obvious"},"content":{"rendered":"\n

What They Can and Can\u2019t Do for You
What is a VPN, and How Can It Protect You?
Why did the government warn against using commercial VPNs?<\/strong><\/h4>\n\n\n\n

You’ve seen the ads\u2014\u201cProtect yourself from hackers! Stay anonymous! Stop government spying!\u201d<\/em>\u2014but how much of that is true? The reality is, most commercial VPNs aren’t the security silver bullet they claim to be. While VPNs can serve a purpose, their limitations are often misunderstood, and in some cases, they introduce more risks than they mitigate. In this article, we\u2019ll break down what VPNs actually do, expose common misconceptions, and explain why even the U.S. government has warned against using them. If you\u2019ve ever wondered whether a VPN is truly keeping you safe\u2014or just giving you a false sense of security\u2014keep reading.<\/p>\n\n\n\n

A VPN (Virtual Private Network) is a method of tunneling traffic from one point to another. The purpose of a VPN depends on its specific use case. There are many ways a VPN can be utilized, but let\u2019s focus on how it actually works and what it can<\/em> and can\u2019t<\/em> protect you from.<\/p>\n\n\n\n

Originally, I used VPNs to allow employees to access internal resources without exposing those tools directly to the internet. Today, new concepts like Zero Trust allow access without a full VPN. We\u2019ll cover that in a later post, but for now, let\u2019s look at how traditional VPNs work.<\/p>\n\n\n\n

A VPN is networking software that creates a private tunnel between a machine and a remote network or another machine. Modern VPNs rely on two main types of tunneling:<\/p>\n\n\n\n

    \n
  1. IPSec VPNs<\/strong> \u2013 A traditional method using various protocols and ciphers to establish a secure connection. These can be set up for site-to-site, client-to-site, or other configurations, depending on authentication and authorization settings.<\/li>\n\n\n\n
  2. TLS-based VPNs<\/strong> \u2013 Transport Layer Security (TLS) is the modern standard, replacing SSL for web encryption. It uses asymmetric encryption with public and private key pairs, offering the same security level as HTTPS websites.<\/li>\n<\/ol>\n\n\n\n

    Historically, VPNs were used to allow remote access to private networks. Then came the rise of personal VPNs<\/strong>, marketed aggressively as a must-have security tool. You\u2019ve seen the YouTube ads: \u201cProtect yourself from hackers! Stay anonymous! Stop government spying!\u201d<\/em> But most of these claims are pure FUD<\/strong> (Fear, Uncertainty, and Doubt), designed to sell a product to people who don\u2019t know better.<\/p>\n\n\n\n

    What a Commercial VPN Actually Does<\/strong><\/h4>\n\n\n\n

    A commercial VPN connects your device to a network owned by the VPN provider\u2014nothing more. It doesn\u2019t \u201csecure\u201d your internet. Your traffic is still crossing the internet, just through their servers instead of your ISP\u2019s. The same risks apply, just in a different way.<\/p>\n\n\n\n

    Not all VPN marketing is nonsense, but much of it is misleading. Most people use VPNs to break End User License Agreements (EULAs)<\/strong>\u2014bypassing Netflix region locks, for example. A VPN lets you appear as if you\u2019re in a different country, but this violates the streaming provider\u2019s terms. If that doesn\u2019t bother you ethically, fine\u2014but let\u2019s be clear about what\u2019s actually happening.<\/p>\n\n\n\n

    VPNs will allow you to hide your activity from your local network but may not be the best solution.<\/p>\n\n\n\n

    The Myth of \u201cPublic WiFi is Dangerous\u201d<\/strong><\/h4>\n\n\n\n

    A decade ago, public WiFi was insecure. Today, almost all websites and services use TLS encryption, meaning a VPN doesn\u2019t add any extra protection when using secure websites.<\/p>\n\n\n\n

    A VPN can<\/em> hide your browsing from your ISP, but unless you configure DNS over HTTPS (DoH)<\/strong> or DNS over TLS (DoT)<\/strong>, your DNS queries still leak valuable information. And remember\u2014whether you pay $2\/month or $100\/month, your VPN provider now has access to all<\/strong> your traffic.<\/p>\n\n\n\n

    The “No-Logs” Lie<\/strong><\/h4>\n\n\n\n

    VPN providers claim they don\u2019t keep logs. Many have been caught lying when subpoenaed. Even if logs are \u201canonymized,\u201d traffic patterns can still identify you. If an attacker (or government) controls a service you connect to, they can correlate VPN exit traffic and de-anonymize your connection. If you can identify the IP used from any service accessed, that IP can be used to see where else that IP was used. I understand there is a lot of complexity. Simplified concepts about identifying User <-> IP. Also, just because the VPN provider really does not log, their network providers most likely do have logs.<\/p>\n\n\n\n

    VPNs and Shady Business Practices<\/strong><\/h4>\n\n\n\n

    Many commercial VPNs bundle \u201csecurity tools\u201d that are just repackaged open-source software, often outdated or ineffective. The ones who do have their own tools, the tools are not the best of breed. Even if you only look for free anti-virus or endpoint protection, there are usually better options. Do you really trust a $2.99\/month company to protect your privacy and keep you “anonymous”? And why do they always have 80% off \u201climited-time\u201d discounts<\/strong>? Reliable security doesn\u2019t work that way.<\/p>\n\n\n\n

    What a VPN Can\u2019t Do<\/strong><\/h4>\n\n\n\n