It’s Time to Stop Paying for a VPN

Brian X. Chen makes a few good points, notably about the obliteration of trust by numerous VPN operators.

But he also commits a few errors, largely of omission:

- ISPs, broadband, and mobile Internet providers are all increasingly tracking and selling their subscriber's traffic patterns. Even where content is protected by SSL/TLS, the sites visited and timing of visits is visible through metadata. And as the CIA admits, "we kill people based on metadata".

- A cloud-based personally-operated VPN instance ... still relies on the cloud provider themselves. Both bare-metal and (far more likely) virtualised hosting are subject to monitoring and interception. Ironically, sharing that instance with a few others might at least provide plausible deniability over who is responsible for what traffic.

- VPNs are still useful for getting past geo-gated content. Content streamers and users of Samizdat publishers such as Sci-Hub, LibGen, and ZLibrary will be aware.

- Tor remains an option, though it is somewhat slower than direct Internet access (performance has improved massively), protection afforded remains limited (though surveillance costs are greatly increased), and many sites will limit or deny traffic (Captchas from Google and Cloudfront, Craigslist still blocks traffic entirely AFAIU).

Again, the point that VPN providers themselves are often hostile adversaries is well taken. It's not the full story.

Mid-way through the article:

”I learned this the hard way. For several years, I subscribed to a popular VPN service called Private Internet Access.”

Well, yeah, stop buying crappy VPN services built by Mt. Gox cofounder "tech" bros who conduct illegal hostile takeovers of IRC networks for the "lols".

Still, I guess Chen's writing is an upgrade over David Pogue...