Tag: m247

  • IVPN

    IVPN

    App Telemetry

    In our analysis, IVPN primarily establishes connections to its own domain, api.ivpn.net, which can be logically tied to the app’s core functionality. A notable feature is its lack of telemetry, reinforcing its standing as a true privacy-focused application. Additional connections to Apple’s ecosystem, namely inappcheck.itunes.apple.com and mzstorekit.itunes.apple.com, are indicative of routine in-app functionality rather than invasive tracking or advertising. Furthermore, domains such as apps.identrust.com and r3.i.lencr.org relate to certificate authorities and secure communications, which are essential components of any robust VPN service.

    Given that the connections are largely restricted to primary service domains and standard app functionality, IVPN maintains a strong commitment to user privacy. The absence of telemetry data adds to its credibility as a privacy-centric application. Thus, IVPN achieves an A rating on our privacy grading scale, serving as a benchmark for what a privacy-focused app can offer.

    Privacy Policy

    IVPN’s privacy policy is pretty much a gold standard if you’re looking for anonymity and data security. They collect the bare minimum of information needed to operate their service—no personal info like your name or email required at sign-up. Even better, they have a strict no-logging policy for your VPN activity. They’re also transparent about what little data they do collect, mostly for transactional purposes, and give you options for anonymous payments. On the legal front, they’re under EU jurisdiction, which has strong data protection laws. Overall, if you’re concerned about your online privacy, IVPN seems to tick all the right boxes.

    One of the most striking features of IVPN’s privacy policy is its commitment to collect the “minimum information required to operate our service.” The company explicitly states, “When you sign up for IVPN, you will not be asked for any personal information e.g. email address, name, etc.” By not collecting personal identifiers, IVPN makes it extremely difficult for any external entity to link VPN activity back to an individual user. This minimal data collection is a significant pro for those concerned about anonymity and privacy.

    IVPN’s no-logging policy is another cornerstone of its privacy-centric approach. The company states unequivocally: “We do not log any data relating to a user’s VPN activity.” This includes no traffic logging, no connection timestamps, and no DNS request logging. Without these logs, even if the company were compelled by legal authorities, it couldn’t provide information about user activities. This no-logging policy significantly enhances user security and privacy.

    IVPN sets itself apart by being transparent about what limited data they do collect, specifically for transactional purposes. They state: “When you add time to your account, the following information is stored: Payment ID, Account ID, Amount, Currency, Timestamp, Transaction ID.” While this data is necessary for transactions, the company also offers anonymous payment methods such as cash and cryptocurrency for those who wish to take extra precautions.

    On the legal front, IVPN is subject to European Union (EU) law, widely considered to have strong data protection regulations. The company assures users that “if it ever becomes required by law for us to keep a persistent log of our customers’ connections or any personal data relating to their network activity, we will immediately notify our customers and do everything in our power to move jurisdictions or close the service.” This commitment to privacy even in the face of legal challenges further strengthens the company’s standing as a privacy-focused service.

    Speed Test

    Speed tests, by their nature, are highly contextual. They depend on various factors, such as the user’s location, hardware configuration, and the quality of the network infrastructure. That said, they still serve as valuable frames of reference. For our tests, we chose a server located in the Seattle region. The results were impressive: IVPN delivered 516 Mbps on the download and 24 Mbps on the upload, with a latency of just 18.5 ms. Unlike many other VPN services that often suffer from server overutilization or speed throttling, IVPN showed no signs of either. The high-speed performance and low latency indicate a well-maintained and robust server network.

    Related Posts

  • Windscribe

    Windscribe

    Windscribe, a cross-platform virtual private network (VPN) service provider, was founded by Yegor Sak and Alex Paguis in 2016. Based in Canada, it has grown to operate internationally, supporting a broad range of operating systems and platforms, and providing services to personal computers, smartphones, routers, and smart TVs​1​.

    The company’s offerings include OpenVPN, Internet Key Exchange v2/IPsec, and WireGuard protocols in its applications, supporting peer-to-peer file sharing, and ensuring user privacy with a no-log policy. Additionally, Windscribe provides open source applications and encrypted proxy support, while allowing for unlimited device connections​1​.

    Windscribe has been recognized for its social responsibility efforts, particularly in advocating for freedom of access to information in regions of political unrest. It has also developed transparency tools to shine a light on the relationship between corporate VPNs and their paid promoters​.

    Despite earning accolades from publications like Wired UK and Engadget for its reliability, cost-effectiveness, and range of server options, Windscribe has faced criticism related to security vulnerabilities. However, the company has demonstrated swift response to these issues, underscoring its commitment to user security​.

    Some users familiar with the name may be wary to trust their services, after the poor security practices were revealed in their 2021 data breach. The company has since promised to do better. You can read the original article, but here are the main highlights:

    • Windscribe left its VPN servers in Ukraine unencrypted and unsecured.
    • When Ukrainian authorities seized the servers, they also obtained Windscribe’s private key.
    • With the private key, Ukrainian officials could decrypt traffic and spy on Windscribe users.
    • Windscribe admitted that it does not follow “industry best practices” with its server network, but promised to change.
    • Windscribe is in the process of upgrading server security and hopefully undergoing a security audit.

    Based on data collected, when you are using Windscribe VPN you are predominantly using Quadranet, CDNext, Global Secure Layer, CDN77, or M247 servers.

    Global Coverage

    Windscribe showcases an impressive degree of geographic diversity in its server locations. It has a presence in 59 countries across multiple continents including North America, South America, Europe, Africa, Asia, and Oceania. This comprehensive global coverage provides users with extensive options for regional access and optimizes connection speeds. Key locations such as the United States, Canada, the United Kingdom, Australia, and the Netherlands host a significant number of servers, ensuring a robust and reliable service. Windscribe’s commitment to geographic diversity is also demonstrated by their notable presence in emerging markets. Given this extensive geographic spread, Windscribe earns an impressive score on our Global Coverage Index, receiving an 85 out of 100.

    WeVPN users acquired by Windscribe

    In 2023 VPN service provider WeVPN announced that it is shutting down due to unforeseen financial difficulties. In a statement, the company assured its customers that those with active subscriptions will be able to use Windscribe for the remaining duration of their subscription free of charge. Windscribe has agreed to offer free accounts to WeVPN users, which will provide them access to Windscribe’s network of servers, robust security features, and customer support.

    However, many are skeptical of this offer, as it appears to be a backdoor deal, and there is a lack of transparency regarding the relationship between the two companies. Windscribe and WeVPN have confirmed that Windscribe did not acquire WeVPN, but rather, it is a gesture of goodwill by Windscribe’s founder, Yegor. The company will cover WeVPN accounts for three months up to two years, but those who purchased their subscriptions from specific promotions such as lifetime deals will not be covered. Despite this offer, customers are disappointed by the lack of compensation from WeVPN and the lack of transparency regarding the closure.

    It’s super weird that they’ve removed theWeVPN founder’s and CEO information from the site, and there is so little information about them on the Internet. Specially when WeVPN founder claims to “have been running” Private Internet Access for years, and there’s a blog post saying that he used to be the President for PIA, and some other press releases saying he was the CEO.

    The cache for their “about us” section [0]:

      Jonathan Roudier
      Founder
      
      VPN Experience: 8 years
      
      Jon has nearly a decade of working in the VPN industry originally in Marketing and later in leadership and senior management. With his years of insight and customer knowledge gained from running Private Internet Access®, one of the world's biggest VPN providers, Jon decided to build his own VPN to ensure that the moral and ethics which he holds true are upheld and to provide an industry leader in transparency and accountability. Outside of WeVPN, He enjoys spending time at the gym and watching movies.
    

    Press release in PIA’s blog for when they bought Cypherpunk VPN [1]:

      Private Internet Access President Jon Roudier
    

    Press release announcing CES sponsor [2]:

      Jonathan Roudier, CEO of PIA, said “We, at Private Internet Access, are so thrilled..."

    0: https://webcache.googleusercontent.com/search?q=cache:LVfIvHK77E4J:https://wevpn.com/about-us&cd=2&hl=es&ct=clnk&gl=es
    1: https://www.privateinternetaccess.com/blog/private-internet-access-london-trust-media-acquired-cypherpunk-vpn/
    2: https://www.businesswire.com/news/home/20151221005130/en/Private-Internet-Access-Top-Mobile-Sponsor-2016

    Windscribe pros & cons

    Pros

    • Free version with 10GB of data
    • Unlimited simultaneous connections
    • Unblocks various streaming sites
    • Supports torrenting
    • No DNS leaks
    • Highly configurable
    • Military-grade encryption
    • Lots of tunneling protocols
    • Reliable kill switch
    • Split tunneling on Android

    Cons

    • Potential speed issues
    • Not that many servers
    • WireGuard only on Android
    • No independent audit
    • Has had at least 2 unencrypted servers in Ukraine
    • Based in a 5-Eyes country
  • Surfshark

    Surfshark

    Surfshark VPN is one of the most popular VPN services in 2022. Its competitive price and unlimited simultaneous connections make it a very attractive VPN option for all kinds of users. But does this VPN live up to give the actual value for money that it claims? Surfshark also offers thousands of servers worldwide, excellent connection speeds, and next-gen AES encryption. However, users have been questioning its jurisdiction and whether it’s as private as showcased.

    Surfshark offers some really useful features like SmartDNS, the fast WireGuard protocol, P2P-optimized servers, and provides a selection of easy-to-use intuitive apps and platforms.

    So, when you’re connected to Surfshark – who’s servers are you really using? After completing my testing I have concluded that Surfshark uses 20% their own servers, 17% CDNext, 17% M247, 14% CDN77, 13% Host Royale, and the remaining few are Host Universal, Clouvider, and Hydra Communications.

    Surfshark Network Overview

  • ProtonVPN

    ProtonVPN

    ProtonVPN is a virtual private network (VPN) service provided by Proton Technologies AG, the company behind the email service ProtonMail. ProtonVPN was created to provide a secure, private, and censorship-free internet connection to people all over the world. It encrypts your internet connection and hides your IP address, making it difficult for hackers, ISPs, and governments to track your online activity. ProtonVPN is available on various platforms, including Windows, macOS, Linux, Android, and iOS. It offers a variety of subscription plans to suit different needs, including a free plan with limited features.

    What services are available when you’re connected to ProtonVPN?

    Nothing is more frustrating than connecting to your VPN, heading over to your favorite streaming service… Only to find out your connection is blocked. Unfortunately, it’s a never ending cat and mouse game. We decided to test our experience using ProtonVPN servers based in the United States as well as a few random foreign countries. Note: Registering an account while connected to a VPN may be blocked entirely, the tests below reflect establish a connection from an account that’s already logged in (to simulate someone traveling).

    ServiceBlocked / Restricted
    Amazon PrimeLimited; some IP ranges are blocked
    NetflixAccessible
    SpotifyAccessible
    PandoraLimited; some IP ranges are blocked
    YouTube MusicAccessible
    HuluAccessible
    Disney+Accessible
    Google SearchMay encounter CAPTCHA
    ChatGPTLimited; some IP ranges are blocked
    YouTubeAccessible

    When you are connected to ProtonVPN, who’s servers are you really using? I tested over 50 ProtonVPN servers and found that 36% use M247, 27% use Datacamp Limited, 10% use Datacamp Limited UK, 8% use Estnoc Global, 5% use FDC Servers, 5% use GSL Networks, and the remaining servers use Packet Exchange, and Intergrid. In a recent AMA on reddit, ProtonVPN stated the reason they utilize M247 so heavily is due to cost efficiency and being able to support the freemium model:

    Comment
    byu/protonvpn from discussion
    inIAmA

    ProtonVPN Network Overview

    Stealth Protocol vs WireGuard

    WireGuard and ProtonVPN’s Stealth protocol are both designed to provide security for internet users, but they have different features and levels of security.

    In terms of security, WireGuard uses the latest encryption standards, including the ChaCha20 encryption algorithm and the Poly1305 message authentication code (MAC). These encryption standards are considered to be highly secure and provide a high level of protection for users’ online activities.

    ProtonVPN’s Stealth protocol, on the other hand, uses the Secure Sockets Layer (SSL) encryption, which is commonly used to secure connections to websites. It also uses obfuscation techniques to make it appear as if you are accessing a secured website, rather than connecting to a VPN server. This makes it difficult for firewalls and censorship systems to detect and block your VPN connection.

    In terms of performance, WireGuard is generally faster than ProtonVPN’s Stealth protocol, as the latter adds an extra layer of encryption and obfuscation that can slow down the connection.

    In conclusion, both WireGuard and ProtonVPN’s Stealth protocol provide a high level of security, but they approach security in different ways. WireGuard focuses on fast and efficient encryption, while ProtonVPN’s Stealth VPN provides an extra layer of obfuscation to help users bypass firewalls and censorship systems. The choice between the two will depend on the specific security needs and requirements of the user.

    Audits

    ProtonVPN has undergone several independent audits to verify the security and privacy of its service. In 2018, ProtonVPN commissioned Cure53, a leading cybersecurity firm based in Berlin, Germany, to perform a security audit of its infrastructure and client software. The audit found that ProtonVPN’s security practices were in line with industry standards, and it did not identify any major security vulnerabilities.

    In 2020, ProtonVPN commissioned the independent cybersecurity firm X41 D-Sec to perform a comprehensive security assessment of its infrastructure and client software. The assessment found that ProtonVPN’s security practices were “exemplary” and that the company had “a clear commitment to the security and privacy of their users.”

    ProtonVPN has also undergone a transparency report audit by the firm KPMG, which verified that the company does not collect or store any personal information or metadata about its users.

    Overall, the independent audits of ProtonVPN have found that the service is secure and privacy-protective.

    Related Posts

  • AdGuard VPN

    AdGuard VPN

    AdGuard has offered ad-blocking and tracking protection software for over 10 years, so my expectations of its VPN were reasonably high.

    On AdGuard’s website, there are several promises. It boasts about providing you with high speeds, the ability to virtually teleport you around the world, and keep you safe online. It also promises you the ability to watch “anything from anywhere”.

    While all this sounds amazing, I took AdGuard VPN for a spin to make sure it can deliver excellent performance and live up to its word. The VPN pleasantly surprised me in many ways. While not as good as top-tier VPNs, AdGuard has a lot to offer.

    AdGuard VPN offers a wide selection of over 100 servers in 44 countries with a kill switch to block internet access if the connection drops. This is a valuable feature for those concerned about privacy, as AdGuard has a no-logs policy, meaning the company can’t provide information about its users even if asked. However, this policy hasn’t been independently verified, so you’ll just have to take their word for it. The jurisdiction of AdGuard is in Cyprus, which provides better privacy protection under European GDPR rules compared to companies based in, say, the USA.

    Unfortunately, AdGuard doesn’t offer the “double VPN” feature that some other VPN services do, where your connection is routed through two servers for added security and anonymity. But, on the bright side, AdGuard does allow BitTorrent traffic, so you can anonymously download those “sensitive” files.

    During our testing, we were impressed by AdGuard’s security measures. When our colleague attempted to access the account from a different location to run speed tests, AdGuard’s system temporarily locked the account. This is a rare and reassuring extra layer of protection that we haven’t seen before.

    In conclusion, AdGuard VPN is a solid choice for those looking for a VPN with a kill switch and no-logs policy. The lack of a “double VPN” feature and independent verification of the no-logs policy may be drawbacks for some, but the BitTorrent traffic allowed and the added security measures make up for it.

    Related Posts

  • CyberGhost VPN

    CyberGhost VPN

    CyberGhost VPN was founded in 2011 in Bucharest, Romania, and initially began as a free VPN service. By the following year, it had gathered around 1.7 million users​. In 2017, a notable change occurred when Kape Technologies (then known as Crossrider) acquired CyberGhost VPN. This acquisition brought about concerns among observers due to Crossrider’s background as an ad-tech firm known for concealing spyware within its apps, which seemed to present a conflict of interest given CyberGhost’s focus on privacy. However, these concerns were largely allayed as Crossrider rebranded to Kape Technologies and positioned itself as a “privacy-first digital security software provider.” Following this, Kape Technologies went on to acquire other well-known VPN brands such as ExpressVPN and Private Internet Access, though these continue to operate independently. As of 2023, CyberGhost VPN has grown significantly with around 38 million users, making it one of the more popular VPNs available​.

    The company faced a minor hiccup in 2020 when a breach involving Typeform affected around 120 of its users. However, no evidence has emerged to suggest improper use of subscriber data by Kape, its subsidiaries, or any third parties. Despite past skepticism due to its history, CyberGhost VPN has maintained a strong reputation for privacy, continuing to provide valued services to its global user base​.

    Can I torrent with CyberGhost?

    One of the most popular reasons why people use VPNs is to encrypt their traffic and mask their IP while using P2P or BitTorrent services. CyberGhost even offers P2P servers to enhance your experience. However, right in section 8 of their Terms of Service is this alarming statement:

    We reserve the right to take appropriate measures when CyberGhost Products are being used contrary to these Terms and applicable laws, including cooperating with public or private authorities as provided by law.

    The “terms and applicable laws” are so broad that it essentially means anything illegal based on your local laws, wherever you may be. For DMCA violations generally they will just terminate your account and offer no refund. That being said, intellectual property companies rarely bother to file DMCA complaints for IPs associated with VPNs, especially when that company is registered outside of the United States.

    What services are accessible when connected to CyberGhost?

    ServiceBlocked / Restricted
    Amazon PrimeAccessible for browsing; streaming blocked
    NetflixAccessible for browsing; streaming blocked
    SpotifyAccessible; CAPTCHA during registration
    PandoraAccessible
    YouTube MusicAccessible
    HuluAccessible
    Disney+Accessible; no restrictions
    Google SearchCaptcha
    ChatGPTSome IPs blocked
    YouTubeAccessible

    Data collection

    Like almost every VPN, CyberGhost does collect some maintenance-related data, but it claims to not log your server location choices, your total amount of data transferred nor your connection timestamps. As with any VPN, it’s nearly impossible to independently verify the company’s no-logs claim. Even so, CyberGhost does log certain user hardware data in what is likely a bid to enforce the company’s limit of seven simultaneous connections per account. 

    According to the spokesperson CNET spoke to in August of 2019, CyberGhost does have the ability to help law enforcement by activating a limited user-tracking feature.  

    “The only way to do it is if that user is still in the system and if the law enforcement knows the IP and could provide also a warrant to track that IP,” the spokesperson said. “We can activate a special feature like a logging feature for that IP, but we have that ability to prevent malicious actions when using our service. But only if that user is still active and we have proof of what exactly is wrong, what IP he is using, and so on. So we’ve got to bring that in order to activate that, to be sure we don’t activate it on a regular user. Otherwise, we can not help any law enforcement company.” 

    In 2016, however, CyberGhost was called to the carpet by ProPrivacy when the company was discovered to be quietly requesting potentially dangerous, root-level access to customers’ computers — a function the software hasn’t included for about three years now. The service was also caught logging the unique identifiers of each of its user’s computers. Similarly, other reviewers have also expressed wariness after CyberGhost appeared to remove some threads from its forum which may have detailed a critical 2016 malfunction and potentially revealed log-keeping practices within its free proxy service.

    Speaking of revelations, in March 2019, CyberGhost took a small hit when the customer-survey company it contracted, Typeform, was breached. The company said 120 email addresses and 14 CyberGhost usernames — but no passwords — were included in the two forms involved in the compromised data. 

    The bigger concern for me is that CyberGhost still uses a method of ad-blocking that’s considered at best ineffective and at worst insecure. Most VPNs block ads by filtering out requests from websites identified as suspicious. Not CyberGhost. The company instead uses a method which inspects and modifies — rather than filters out — those requests. The method is twice as risky and only half effective since it only works on sites with an HTTP URL and not those with HTTPS. 

    CNET asked Beyel in June this year about this method of ad-blocking and the criticism it’s received. 

    “We know this is not very effective. That’s why we’re already working on a better solution which is working on the process,” he said. “We need to completely move this kind of technology on the client side because in the browser you can, of course, do that.” 

    In its suite of features, however, CyberGhost does offer an option (enabled by default in its MacOS client) which forces your browser to redirect away from sites not secured by HTTPS. 

    Beyel also said that CyberGhost will be releasing a new suite of privacy modules in the coming weeks which go beyond its VPN to include tools for optimizing your computer and preventing vulnerable apps from affecting your privacy.[2]

    See also:

  • Aloha Browser VPN

    Aloha Browser VPN

    The Aloha Browser is one of the up-and-coming new browser apps for mobiles which targets one of the most important aspects of modern browsing — privacy. The Aloha Browser is the only browser (to our knowledge) that comes with a built-in VPN and encrypts user data at all levels. 

    When you are using Aloha VPN Browser, just who’s servers are you really using? According to our research their servers are 38% M247, 16% IPXO, 16% Ghost, 10% CDN77, 7% Server Stadium, 7% Creanova, and 7% ZenLayer.

    Privacy Policy

    Upon reviewing the provided privacy policy for Aloha VPN, several areas of concern or potential anti-privacy practices can be identified. The points highlighted below may have implications on user privacy and security based on the information provided in the policy:

    1. Collection of Non-Personal Information:
      • The policy mentions the collection of standard information typically made available by web browsers. While this is framed as non-personal information, combined data could potentially be used to identify individuals, especially when correlated with other data.
    2. Manual Entry of Personal Information:
      • Manually entered information for accessing certain services, getting in touch with Aloha VPN, or participating in surveys may expose users to privacy risks, especially if the collected information is sensitive in nature.
    3. Information Protection:
      • The policy acknowledges that no method of transmission over the internet or electronic storage is 100% secure. This honest disclosure reflects a potential risk to user data, despite the measures in place to protect personal information.
    4. Use of Collected Information:
      • Personal information is used for a variety of purposes including improving services, marketing, and promotional purposes. This broad usage could be concerning depending on the exact nature and sensitivity of the collected information.
      • Mention of providing personal information to third parties if obligated by law implies a potential privacy risk in legal or governmental scenarios.
    5. Sharing with Service Providers:
      • Sharing personal information with third-party service providers may pose a privacy risk, especially if these third parties have differing privacy practices or less stringent security measures.
    6. Disclosure in Legal and Other Situations:
      • The policy outlines several scenarios where user information might be disclosed, including in response to legal processes, investigative demands, or during significant business transactions like mergers or asset sales. These disclosures could potentially expose users to privacy risks, especially in adversarial legal scenarios or if the acquiring entity has different privacy standards.
    7. Opt-Out Options:
      • While there is mention of opt-out options regarding updates, promotions, or surveys, the extent and ease of these opt-out mechanisms are not detailed, which could potentially affect user control over their data.
    8. Public Sharing of Aggregated Data:
      • The policy mentions sharing aggregated but non-personally identifiable information publicly. However, the effectiveness of the anonymization process and whether the aggregated data could be de-anonymized is not addressed.
    9. Notification of Legal Process:
      • The policy mentions the possibility of notifying users about legal processes compelling disclosure of their information but doesn’t guarantee such notifications. This can potentially leave users unaware of legal actions involving their data.

    The points above highlight some potential areas of concern regarding privacy and security within Aloha VPN’s privacy policy, and users should consider these factors when deciding whether to use this service, especially if they are concerned about maintaining a high level of privacy and security.

    See also:

  • TunnelBear

    TunnelBear

    TunnelBear is a virtual private network (VPN) service that is known for its user-friendly interface and its commitment to privacy and security. The company was founded in 2011 and is headquartered in Toronto, Canada.

    TunnelBear offers a range of VPN services that are designed to protect users’ online privacy and security by encrypting their internet connection and hiding their IP address. The company’s VPN services are available for a variety of devices, including computers, smartphones, and tablets, and are suitable for both personal and business use.

    TunnelBear is known for its easy-to-use VPN software, which is available for a variety of platforms, including Windows, Mac, iOS, and Android. The software is designed to be user-friendly, with a simple interface and clear instructions for connecting to the VPN.

    In addition to its VPN services, TunnelBear is also known for its commitment to privacy and security. The company has a strict no-logs policy, which means that it does not keep any records of users’ online activities. TunnelBear is also independently audited to ensure that it is in compliance with its privacy and security policies.

    Overall, TunnelBear is a well-respected and trusted VPN service that is known for its user-friendly interface and its commitment to privacy and security.

  • VPN – Super Unlimited

    VPN – Super Unlimited

    Just about everyone knows what a VPN is these days, or at the very least, they’ve heard of them. And businesses keen on making a quick dollar have caught on to the recent surge in VPN users. A quick glance at the iOS App Store shows over a dozen VPN apps, all with their own unique names and branding. Many purport to be the best and many are free. Unfortunately, many of these VPNs are immensely popular due to their free or inexpensive services.

    After all, all VPNs are the same… right? In theory. All mechanics are indeed mechanics. But that doesn’t mean you should bring your car to any old mechanic with out at least doing some research or reading reviews. Every city has the shops to avoid because they will do unauthorized work or will exaggerate the severity of your cars work to get an easy Buck out of you. Blinker fluid, anyone? VPNs are no different exempt you are entrusting these companies with some of your most personal, sensitive data.

    Our opinion: Thumbs down

    Website: https://www.mobilejump.mobi/

    Mobile Jump is based in Singapore, but according to Top10VPN, the company’s roots are in mainland China. And it’s the risk of user data being transferred to China that has prompted Top10VPN’s head of research Simon Migliano to issue a warning to U.S. users. “It’s certainly a surprise to see a Chinese VPN grow so rapidly in such a short space of time,” he told me. “There are two main risks. First, it collects unusually large amounts of personal information, including location data. Second, not only does it use that information for advertising, but it explicitly states it will share that data with authorities around the world, including those in China.”

    https://www.forbes.com/sites/zakdoffman/2019/12/03/top-ios-security-app-shares-user-data-with-china-8-million-americans-impacted/?sh=2481a89454d7
    • LA 38.75.137.21 as63023
    • Russia 146.185.215.81 AS210756
    • Dallas 38.68.134.247 AS63023
    • Seattle 169.197.143.20 AS63023
    • Germany 64.225.110.152
    • NY 38.91.101.107 AS63023
    • London 37.120.198.174
    • Mexico 103.14.26.33
    • Spain 195.206.107.242
    • Netherlands 185.200.119.110
    • Portugal 94.46.171.166 AS24768
    • Canada 217.138.213.106

    And, in fairness, Mobile Jump’s privacy policy should leave users in no doubt as to the risks being taken. For a VPN it’s extraordinary small print: “We regularly collect and use information that could identify an individual, in particular about your purchase or use of our products, services, mobile and software applications and websites… We use various technologies to determine [your] location, including IP addresses, GPS, and other sensors.” An app whose primary purpose is to anonymise users, collects and stores personal information that could identify and locate those users. And there’s worse. The company says it might share data with “regulators and law enforcement or investigation agencies in the EU, U.S., China, and around the world.”

    https://www.forbes.com/sites/zakdoffman/2019/12/03/top-ios-security-app-shares-user-data-with-china-8-million-americans-impacted/?sh=2481a89454d7
  • Private Internet Access

    Private Internet Access

    Private Internet Access (commonly known as PIA) is a capable VPN provider, now owned by Kape, which also owns CyberGhost, ZenMate and ExpressVPN.

    PIA has servers available in just about every single state in America, which is great if you want to encrypt and protect your connection but don’t want to get locked out your account for suspicious activity. Choosing a server in a remote country for instance can have some benefits but it is not always the most practical choice.

    Privacy Policy

    PIA’s privacy policy is a classic example of a company trying to paint itself in the best possible light regarding privacy and legal compliance. They talk a big game about scrutinizing legal requests and standing up for user privacy, emphasizing their commitment to the “spirit” and “letter” of the law. This is meant to reassure you, the user, that they’re on your side, ready to shield your data from the prying eyes of the law—unless absolutely necessary of course.

    But here’s the rub: when push comes to shove, the majority of companies, especially those anchored in the U.S., have a breaking point. The notion of a corporate David going toe-to-toe with the Goliath that is the federal government and emerging unscathed is, frankly, more fairy tale than fact. It’s not just about being bullied into submission; it’s about survival. Companies operate under the jurisdiction of local and federal laws, and while they might resist or push back on requests initially, the potential consequences of outright defiance—legal battles, hefty fines, or worse—make compliance the path of least resistance.

    What often goes unsaid in these polished statements is the scale and intensity of pressure a company can face behind closed doors. Yes, they might question or attempt to narrow down overly broad subpoenas, but these are tactical moves within a game where the house always wins. The promise to not participate with unconstitutional or illegal requests is noble but navigating the complex web of legal interpretations and potential repercussions makes this a tightrope walk at best.

    And let’s not gloss over the part where they say they’ll give users a chance to object to disclosures “when it is possible and a valid option.” That’s a lot of leeway packed into a few words, suggesting that this opportunity is more of an exception than a rule.

    In essence, while the statement aims to reassure you of the company’s steadfastness in protecting your privacy, the reality is often shaped by legal and political pressures that can turn those assurances into well-intentioned but ultimately hollow promises.

    Terms of Service

    As far as Terms of Service go, PIA’s is boilerplate industry standard. If you violate law they reserve the right to terminate your service. They don’t include any of the vague terms and phrases like some other providers due like “inappropriate conduct”.

    You must conduct yourself in a way that complies with law and would not violate these rules of conduct.

    Log Policy

    In the book Resistance, Liberation Technology and Human Rights in the Digital Age author Giovanni Ziccardi shares this response from Private Internet Access:

    “We absolutely do not maintain any VPN logs of any kind. We utilize shared IP addresses rather than dynamic or static IPs, so it is not possible to match a user to an external IP. These are some of the many solutions we have implemented to enable the strongest levels of anonymity amongst VPN services. Further, we would like to encourage our users to use an anonymous e-mail and pay with Bitcoins to ensure even higher levels of anonymity should it be required.” Q2: “Our company currently operates out of the United States with gigabit gateways in the US, Canada, UK, Switzerland, and the Netherlands.

    We chose the US, since it is one of the only countries without a mandatory data retention law. We will not share any information with third parties without a valid
    court order. With that said, it is impossible to match a user to any activity on our system since we utilize shared IPs and maintain absolutely no logs.”

    Torrenting

    Private Internet Access (PIA) beats around the bush when it comes to using their VPN services for BitTorrent. While their terms of service explicitly prohibit copyright infringement, their Frequently Asked Questions page delicately navigates the subject of torrenting. PIA suggests that utilizing their VPN can enhance online privacy and prevent ISPs from potentially labeling a user’s activities as suspicious. However, this stance is somewhat disingenuous, as ISPs generally do not actively monitor their customers’ web traffic. The primary concern with torrenting, particularly in the context of piracy, is the risk of receiving DMCA takedown notices, which is a more direct consequence of copyright violation than mere ISP scrutiny.

    Torrenting with PIA is a breeze, however. After I connected to a Canadian server about 1,200 miles away I fired up QBitorrent and within seconds was connectable. I was able to achieve speeds of 10Mbps down and 1.4Mbps up. Not too shabby. It’s important to remember that torrenting is a completely subjective experience and these results are only indicative of my experience. Yours may differ wildly.

    According to my research, PIA VPN predominantly uses CDNext, GTT, and M247 servers depending on where you are connecting to.

    Use of virtual servers

    While it’s not uncommon for VPN providers to use location virtualization, some do see it as dishonest and another deceitful marketing technique. During our testing, we discovered that PIA does in fact use location virtualization. For instance, 100% of the servers advertised as being in the Philippines were actually located in Singapore.

    IP                Advertised Country   Actual Country  ISP    ASN      
    188.214.125.131   Philippines          Singapore       M247   AS9009	

    ASN Diversity

    In the realm of Virtual Private Networks (VPNs), diversity is a key indicator of network resilience. A significant measure of this diversity can be evaluated using the Shannon Diversity Index (SDI), a concept borrowed from ecology to measure the biodiversity in a given community. In the context of VPNs, the SDI offers a quantitative assessment of the diversity of Autonomous System Numbers (ASNs) among VPN servers. Theoretically, a higher SDI correlates with increased network diversity, indicating a more resilient network structure less prone to single-point failures.

    An examination of Private Internet Access (PIA), with its SDI value of 1.8, reveals a comparatively lower network diversity in relation to other VPNs. For instance, Windscribe, Surfshark, and NordVPN have reported SDI values of 3.6, 2.88, and 2.75 respectively. This suggests a potential susceptibility in PIA’s network to failures or targeted attacks, owing to its relatively less diverse network.

    However, it is crucial to emphasize that SDI, while informative, is not the sole determinant of network performance and resilience. Several other factors, including the choice of Internet Service Providers (ISPs), geographical server distribution, total network capacity, and VPN service management practices significantly influence a VPN’s overall performance. Thus, while PIA’s SDI value may not place it at the pinnacle of network diversity, it is important to consider the holistic context when evaluating VPN performance and resilience.

    See also: