Is a VPN really helpful for privacy?

Aaron Rosenberg

— 3 min read

Heads up, I made this post way back in high school, I've learned a lot since then and while I have been updating this blog post, I think it's time I make a better one. I will be making an ultimate privacy guide soon, for now, I still consider the information here to be good, just incomplete. Keep an eye out for that!

You've seen a lot of people talk about how a VPN will help your privacy because it encrypts your traffic and masks your IP address, so obviously this is something you actually need... Right?

Let's start by looking at what a VPN IS: a VPN works by encrypting your traffic and sending it to a remote server. This server then decrypts the data and sends it to where you want to go. On paper, this sounds really helpful but there are multiple ways this can actually hurt you.

If the target server uses HTTPS, the data is already encrypted. Adding an extra layer of encryption doesn't really help that much. If it's already encrypted, it won't help against a Man-In-The-Middle attack, which is basically when someone will intercept the traffic and log it; The encryption is already there, and it doesn't help at all when the traffic needs to be decrypted before it's sent to the destination, so it still is transmitting with just https, it's just going somewhere else first. Not exactly helpful.

"But Aaron, I've seen a lot of reviews for this VPN and they said it was fine." A lot of these so called reviews are actually just advertisements for that VPN. It's super misleading and to back up my point, if you look at other reviews on those sites, they often say not to use other VPNs and to use theirs instead. There are legitimate VPN review sites out there, but those aren't the sites I have a problem with. If a company is going to make an advertisement, it has to look like an advertisement.

You can host a VPN yourself as well as you want to, but I don't see a purpose in doing so outside of some cases we'll go over later. Instead, this is what I recommend

  • Using a search engine with a decent privacy policy like Qwant or DuckDuckGo instead of Google. Search results aren't always as good but usually you can find what you're looking for. If you want to go extreme look into self hosting searx, I wish I could recommend public instances but they usually get IP banned from search engines pretty fast, making it not super helpful
  • Not using Google Chrome. Instead, use Librewolf or if you prefer chrome, Ungoogled Chromium
  • Check the privacy policy of everything you use. If you're not okay with what they collect, don't use it
  • if you want you can set up Pi Hole on your home network to block hosts and trackers, you can also do it with a browser plugin (we'll go over that later)

Notice how I mentioned not using Google a lot? They are notorious for data collection. Facebook is also just as bad. And Instagram is owned by Facebook so using it does not help you. Most social media tends to track you, it's just how the industry works (there are some dedicated to privacy like mastodon and they're great) There are also browser plugins that can help you block trackers. Here is a list of the ones I use

  • uBlock Origin with a custom block list imported. I use https://dbl.oisd.nl/
  • PrivacyBadger is a good addition to uBlock for trackers it might not catch.
  • CanvasBlocker, if you're not using a web browser that has resist fingerprinting (or turned it off since it breaks things like NoVNC)

Even if a VPN doesn't protect your privacy though, there are legitimate uses for them in a lot of cases.

  • You're on public WiFi, yeah ok this MIGHT be valid, but I recommend not doing that if you can help it, anyone messing around can access all the devices through the network, there is a lot of configs that do prevent this but you need to know that such a config is in place
  • You're doing anything involving P2P, since P2P exposes your IP address to everyone, there are cases you may not want that.
  • You live in a country that blocks websites and need to access that content
  • Avoiding Geoblocking on streaming services (if you're learning a language, this is a great way to access content in that language that may not be available in your country)

If you need a VPN for one of these reasons, make sure their advertisements actually look like advertisements, check their privacy policy, see if they have ever been hacked (this can show exactly what kind of data they log, as well as their security), see what company owns it and if they are known for their privacy, check if they've been audited before, and make sure any reviews are credible.

A VPN which does seem to do a good job checking the boxes is Mullvad because when you sign up, you are given an ID to log in with so they don't collect your email. I'll also give my approval to IVPN and ProtonVPN. You won't need it for everyday use, but they have their uses.