Instead of a VPN subscription, I'd recommend a self-managed VPN solution. One can easily fire one up thanks to Streisand (https://github.com/jlund/streisand)
Its important that you dont host any domains on the VPS you run the VPN on.
Security might not be top priority at the VPS provider.
All your requests come from the same IP address (and the VPN provider might very easily give out your private info).
I think a VPN from a reputable provider (like f-secure) is better for most users.
Why is that is I may ask? I have the impression that the great firewall blacks a lot of domains by default and they are allowed/blocked after a review after somebody tries to access them the first time. I may be paranoid but often I try to open an obscure site. It is blocked. I have to use a VPN. A few days later the site can be accessed. Why not use a VPN sever with a nice website that makes it look harmless?
- You might forget private whois and expose your identity. - There might be issues with the private whois that exposes your identity. - The contents of the website might expose you.
I think a reputable VPN provider offers the better tradeoff, but there are legitimate reasons for self-hosting a VPN.
My Streisand hosted on AWS looks to the outside like anybody else's Streisand hosted on AWS, doesn't it?
Similarly, my f-secure egress looks like anybody else's f-secure egress, so what's the difference?
I don't really know, I don't use a VPN. Really asking.
They certainly let law enforcement and intelligence agencies know, often without a warrant.
Please read my comment as if the threat model includes panopticon governments, not common skids running aircrack-ng.
(I'm not saying you're wrong; again I've not really thought about having to thoroughly anonymize my own traffic.)
To leverage this, it's fairly easy to detect you're on a self-hosted VPN: your IP is in an IP range assigned to a hosting/colocation provider, is not a TOR proxy (there is a public list of those) and doesn't belong to any remotely popular VPN (easy to enumerate for a little money, lots of lists exist).
In exchange for that you have eliminated your ISP (or public wifi) as a threat but instead added the hosting provider to the list of threads. And for any adversary that stands above the law, the routing infrastructure of your hosting provider is already a valuable target.