How Does a VPN Protect Your Online Privacy?

TL;DR

A VPN protects privacy by encrypting traffic before it crosses a public network and routing it through a VPN provider, which hides the user's source IP address and destination from local observers. It does not eliminate trust or guarantee anonymity, because the provider can see traffic details after decryption and may expose records through data sales, hacking, or legal demands.

Transcript

A VPN or virtual private network provides a way to send sensitive information over the public internet. You've probably seen the ads for them in all sorts of websites, apps, yes, and even YouTube videos. Well, let me put your mind at ease. I'm not trying to sell you one. That said, what about the claim that they protect your privacy? Do they really... Read More

Key Insights

• A VPN is a method for sending sensitive information across the public internet through an encrypted connection. It can reduce exposure to people who might otherwise inspect traffic while it travels through local Wi-Fi, an internet service provider, or other parts of the internet.
• An evil twin is a malicious Wi-Fi network that uses the same name as a legitimate network at a coffee shop or hotel. A user who connects to it may send packets through an attacker before the traffic even reaches the broader internet.
• A typical personal VPN encrypts network traffic on the user's system and sends it first to a VPN provider. The provider decrypts the traffic to determine its destination, then sends it onward, while return traffic follows the corresponding path back to the user.
• A VPN hides the user's source IP address from the destination website because the website sees the VPN provider instead. The user's internet service provider and nearby eavesdroppers can see encrypted traffic going to the VPN, but not where it travels afterward.
• VPN privacy is a transfer of trust rather than the removal of trust. Depending on the arrangement, users must trust an internet service provider, an employer, a third-party VPN company, themselves, or the software used to operate a self-hosted VPN.
• A corporate VPN is designed primarily to protect company security by creating a secure tunnel between a remote system and the employer's network. It is not necessarily intended to protect employee privacy, even when split tunneling sends some traffic directly to the internet.
• A third-party VPN provider can observe destinations, IP addresses, traffic frequency, and other details because traffic is decrypted at its service. The provider therefore replaces internet intermediaries as the organization that must be trusted with information about the user's activity.
• A free VPN may monetize user data because the user is not paying for the service. Even a well-intentioned provider may expose records if hacked, and a provider may be legally compelled through a court order to disclose records connected with a suspected crime.

Questions & Answers

Q: How does a VPN protect internet traffic?

A VPN encrypts network traffic before sending it across the public internet to a VPN provider. Local Wi-Fi observers, an internet service provider, and potential eavesdroppers can see encrypted traffic going to the provider, but they cannot see its later destination. The provider decrypts the traffic, determines where it should go, and sends it onward to the requested website.

Q: Does a VPN make internet activity completely private?

A VPN does not make internet activity completely private because it transfers trust to another party. A third-party VPN provider decrypts traffic and can see destinations, IP addresses, traffic frequency, and related information. Privacy therefore depends on the provider's conduct, security, and legal circumstances. If identifying information is submitted to a website, the user also gives up anonymity to that destination.

Q: What is an evil twin Wi-Fi attack?

An evil twin is a malicious Wi-Fi network configured with the same name as a network that users expect to find, such as one at a coffee shop or hotel. When someone connects to the attacker's network, the attacker may inspect packets before they reach the public internet. Encrypting traffic before transmission helps limit what such an observer can read.

Q: What can a website see when someone uses a VPN?

A website generally sees the VPN provider as the source of the connection rather than the user's original IP address. As a result, the site does not receive the user's exact source IP or apparent location from that connection. However, anonymity can disappear if the user sends identifying details, such as a credit card number, Social Security number, or another form of identification.

Q: Why does using a VPN require trusting the provider?

Using a third-party VPN requires trust because the provider receives encrypted traffic, decrypts it to identify the destination, and then sends it onward. At that point, the provider can observe where traffic goes, its frequency, relevant IP addresses, and other records. The VPN reduces visibility for the internet service provider while concentrating that visibility at the VPN service.

Q: Are free VPN services a privacy risk?

A free VPN can create a privacy risk because the provider still needs a way to support its service. The transcript warns that when users do not pay, their data may become the product and may be sold to others. This means the provider's business incentives might conflict with privacy, even though the VPN encrypts traffic between the user and its service.

Q: What is the purpose of a corporate VPN?

A corporate VPN creates a secure tunnel between a remote user's system and the employer's network, allowing work from home or another location. Its primary purpose is to protect the company's security, not necessarily the employee's privacy. Some corporate configurations use split tunneling, where selected traffic enters the company network while other traffic goes directly to the internet.

Q: Is running your own VPN more private than using a provider?

Running your own VPN places control of the server, client, and supporting infrastructure with you instead of a third-party service. A remote device can tunnel into your server before accessing other destinations. This arrangement shifts more trust to you, but it does not remove trust completely because you must still rely on the VPN software, including any downloaded open-source components you use.

Summary & Key Takeaways

• A VPN creates an encrypted connection that routes internet traffic through a VPN provider. Local Wi-Fi attackers, internet service providers, and other observers can see encrypted traffic going to the provider, but they cannot see its later destination. The destination website sees the provider's IP address instead of the user's source address.

• VPNs transfer trust rather than eliminate it. Without a VPN, users trust their internet service provider and parties along the internet path. Corporate VPN users trust their employer, third-party VPN users trust the service provider, and self-hosted VPN users trust themselves as well as the software supporting their private infrastructure.

• Third-party VPNs can improve privacy by hiding a user's IP address and apparent location, but the provider becomes a central point of visibility. It may inspect destinations, traffic frequency, and other records after decrypting traffic. Privacy can still fail through data monetization, security breaches, or legally compelled record disclosure.