It's not just free VPNs, these premium services may be bad for your privacy

Date:
Wed, 20 Nov 2024 18:00:00 +0000

Description:
New research unveils the risks of paid Android VPNs, from data leaks to
weaker encryption and dubious data sharing. Here's all you need to know.

FULL STORY ======================================================================

Not all premium VPN services protect your privacy equally, with over half of the most popular services suffering some form of data leak. At least three apps also shared your personal information "in a way that put user privacy at risk."

These are the main findings from new research conducted by Top10VPN based on the 30 most popular premium providers for Android devices. These include some of the best VPN apps on the market, such as NordVPN , ExpressVPN , Proton VPN , and Surfshark .

"I dont want to exaggerate the level of risk. For most users, it is fairly low, but it does depend on your threat model," Simon Migliano, Head of Research at Top10VPN, told TechRadar, noting Avira Phantom VPN and FastestVPN as the paid Android VPNs to "absolutely" avoid. Paid Android VPN apps'
privacy fails

As mentioned, Migliano conducted testing on the 30 most popular paid Android VPNs to identify potential safety issues within the apps you can find the full list of services analyzed here .

These tests focused on different areas, namely DNS and other data leaks , VPN encryption, VPN tunnel stability, risky app permissions, risky use of device hardware features, and data collection and sharing.

The most surprising result for Migliano was that half of the top paid VPNs tested (15) failed to ensure SNI (Server Name Indication) was encrypted for all server connections the apps make. SNI is an extension to the TLS protocol that a client needs to indicate the hostname of the server its trying to connect to during the handshake process.

While this leak may be relatively minor for most people, "Its an oversight that could land someone in trouble with their school or workplace if VPNs arent allowed on the network, or even in legal trouble somewhere like Turkey or China, where VPNs are heavily regulated," he added.

According to Migliano's data, Surfshark, Private Internet Access (PIA) and PrivadoVPN were some of the apps still overlooking SNI encryption. Did you know? (Image credit: Shutterstock) A virtual private network (VPN) is
security software that encrypts your internet connection to prevent third parties from accessing your data in transit and snooping on your online activities. At the same time, it also spoofs your real IP address location
for maximum anonymity, granting you access to otherwise geo-restricted content.

At least seven Android VPNs also leaked DNS requests meaning the device's request to a Domain Name System server to provide an IP address for a given hostname.

Again, these data leaks aren't critical and happen only under very specific circumstances, so it won't be a big issue for most users. That said, Migliano believes that "a properly configured VPN should terminate all existing
network connections to prevent this from happening."

This is why, if private browsing is crucial for you, he suggests avoiding the VPNs impacted by this issue, namely HMA!, Private VPN, Mozilla VPN, Privado, VyprVPN, X-VPN, and Avira Phantom.

FastestVPN was another big no for Migliano on this front. He said: "I could never recommend FastestVPN after it exposed my email address in clear text in the headers of a server request to a geolocation API, which is unforgivable."

While way better than free VPN apps, data collection and sharing may also be an issue for some providers. Migliano found seven apps out of 30 analyzed to pose a potential privacy risk due to embedded tracking code from advertisers and data brokers. Yet, only two VPNs (VPN Unlimited and Hotspot Shield) were found guilty of actually sharing data in practice, while X-VPN employed poor data-sharing practices.

VPN encryption for paid services was good overall. Yet, while seven apps failed to use the latest version of TLS to establish the VPN tunnel
(AES-256), Avira Phantom made use of the deprecated SSLv2 protocol which, Migliano noted, has long been considered insecure.



======================================================================
Link to news story: https://www.techradar.com/pro/vpn/its-not-just-free-vpns-these-premium-service s-may-be-bad-for-your-privacy


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)