Proton
best vpn service

How to choose the best VPN service

As the world’s largest encrypted email provider(nuova finestra), people have frequently asked us what is the best VPN service. In this article, we discuss what to be aware of when choosing a VPN service, and our recommended VPN security requirements.

What is a VPN?

A Virtual Private Network (VPN) is a tool to secure your internet connection by masking your device’s IP address and encrypting your traffic. When your computer connects to a VPN, all your online activity passes through the Virtual Private Network, which in theory can shield you from surveillance or prevent your identity from being revealed.

Why use a VPN?

The primary use cases for a VPN service are the following:

  • Prevent your internet browsing from being monitored
  • Bypass censorship – VPNs allow you to access content that might be blocked in your country by the government or the content provider
  • Provide higher connection security when connecting to the internet from insecure locations (public wifi hotspot for example)

Whether or not a VPN service can actually accomplish this however depends significantly on the service in question. In fact, the vast majority of VPN services suffer from one or more security problems, which is why great care must be taken when selecting the best VPN service.

VPN Security Problems

About a year ago, we started to analyze VPN services more deeply in response from user inquiries. As we dug deeper however, we found numerous security and privacy flaws with most existing VPN services. This actually was the impetus that drove us to start working on VPN (more about this later). Below is a summary of the main VPN security issues.

VPN Security Vulnerabilities

  • Using pre-shared keys – A number of mainstream commercial VPNs have their preshared keys (PSKs) posted online; these include PureVPN and IPVPN(nuova finestra) . If an attacker knows the PSKs for a VPN service and has access to the network a user is using, the attacker can stage a man in the middle attack and decrypt all of the user’s traffic.
  • Insecure protocols and encryption – Many VPN services use PPTP protocol as a basic way to tunnel and encapsulate data packets. However, PPTP is fundamentally insecure due to using short length encryption keys and password hashes that can be easily cracked by a well resourced state actor. L2TP/IPSec is another popular VPN protocol. However, the NSA has already succeeded in tampering with it(nuova finestra). Furthermore, many VPN services which use more secure protocols such as OpenVPN remain vulnerable because of the use of insecure ciphers.
  • No Forward Secrecy – Most VPN services do not require use of Perfect Forward Secrecy ciphers, so VPN network traffic can be saved, and decrypted later if the encryption keys or algorithms are compromised.
  • DNS Leakage – Whenever a web connection is made, a computer will first translate a domain name into an IP address. This lookup is done via DNS servers. Thus, DNS lookup records(nuova finestra) also contain a log of all websites visited. While VPN services usually will protect web traffic, many do not protect DNS lookups, meaning that user’s browsing history can still be reconstructed from DNS lookups.
NSA PPTP IPSec
Leaked NSA files showing PPTP and IPSec VPN compromises.

Methods of VPN Compromise

Even if a VPN service is not vulnerable to the internal problems listed above, they can still be compromised externally. Common problems that can lead to a VPN service being compromised include the following:

  • Jurisdiction – VPN providers are subject to the laws of the country that they operate in, and these laws (like the Investigatory Powers Act(nuova finestra) in the UK and the Foreign Intelligence Surveillance Act in the US) can force VPN providers to compromise their users. This means VPN providers with significant US and UK presence are compromised by default. These include HideMyAss (UK), VyperVPN (operated from the US), Strong VPN (US), HotSpot Shield (US), IP Vanish (US) and many others.
  • Compromised servers – VPN providers cannot maintain physical control and supervision over all servers, especially servers in countries that are not privacy friendly. This creates opportunities for state actors to compromise VPN exit servers, sometimes with the collusion (forced or not) of the companies providing servers to VPN operators. In a typical VPN setup, compromise of the exit server completely compromises the browsing activity of VPN users.
  • Correlation Attacks – Even if the exit server itself is not compromised, network based correlation attacks can still compromise a user. By seeing who is connecting to an VPN exit server at a given instant, and what sites the VPN exit server is connecting to, a user’s browsing can be reconstructed. Such an attack is easily within reach of most state actors as they can request assistance from ISPs.

What is the best VPN service?

It is clear that it’s not easy to build a VPN service that adequately protects users. In particular, some of the methods of VPN compromise are extremely difficult to defend against. Proton Mail’s mission has always been to protect freedom online, and to provide security and privacy to everyone. Today we protect diverse groups ranging from journalists and activists, to business professionals.

Having a secure VPN is an important part of this, which is why we are also developing Proton VPN(nuova finestra). With the Proton VPN project, we hope to bring to the public a secure and trustworthy free VPN service(nuova finestra) which addresses many of the security shortcomings which impact existing VPN services.

We believe that Proton VPN is able to meet a much higher standard for VPN security(nuova finestra), and the only VPN service which properly addresses all the shortfalls mentioned above. Most importantly, it meets the important conditions for VPN trust(nuova finestra).

Is it safe to use a VPN service?

If privacy is your only objective, the best VPN actually isn’t a VPN at all, but a free software known as Tor. Proton Mail has actually recently rolled out improved support for encrypted email with Tor(nuova finestra) through our new onion site. While Tor does provide a great deal of anonymity and security, there are still many reasons why you might still want to use a VPN service.

For one, Tor’s privacy comes at the cost of performance, and Tor is notoriously slow compared to the best VPN services out there. Furthermore, Tor is now increasingly being targeted by state actors(nuova finestra), so a trusted VPN service could be safer. VPN also has strong use cases for bypassing censorship and content blocks, or for obtaining better security from insecure locations like public wifi hotspots.

Thus, VPN remains an important security and privacy tool, just make sure that you properly understand what VPNs can and can’t protect against(nuova finestra).

Proteggi la tua privacy e la tua sicurezza online.
Passa gratis a Proton VPN(nuova finestra)

Articoli correlati

how to write a professional email
en
Easy steps and examples for writing a professional email. See how Proton Mail can make your emails stand out.
Email etiquette: What it is and why it matters |
en
Find out what email etiquette is with key rules and examples, why it is important, and how Proton Mail can help.
A cover image for a blog about how to create an incident response plan that shows a desktop computer and a laptop with warning signs on their screens
en
Do you have an incident response plan to protect your business from financial and reputational damage? Find out how Proton Pass for Business can help you stay safe.
Shared with me in Proton Drive for desktop user interface
en
  • Per le aziende
  • Aggiornamenti dei prodotti
  • Proton Drive
We've improved Proton Drive for Windows to make it easier to securely collaborate with others from your desktop.
Smart glasses that have been modified for facial surveillance and dox you in real time, finding your personal information after seeing your face.
en
Students modified smart glasses to find someone’s personal data after just looking at them. This is why we must minimize data collection.
The cover image for a blog explaining what password encryption is and how Proton Pass helps users with no tech experience benefit from it
en
Password encryption sounds complicated, but anyone can benefit from it. We explain what it is and how it’s built into Proton Pass for everyone to use.