It’s not just free VPNs, these premium services can be bad for your privacy

Not all premium VPN services protect your privacy equally, with over half of the most popular services suffering from some form of data leakage. At least three apps also shared your personal information “in a way that puts users’ privacy at risk.”

These are the main findings from new research conducted by Top10VPN based on the 30 most popular premium providers for Android devices. These include some of best VPN apps on the market, such as NordVPN, ExpressVPN, Proton VPNand Surfshark.

“I don’t want to exaggerate the level of risk. For most users it’s pretty low, but it depends on your threat model,” Simon Migliano, head of research at Top10VPN, told TechRadar, noting Avira Phantom VPN and FastestVPN as the paid Android VPN to “absolutely” avoid.

Paid Android VPN apps fail privacy

As mentioned, Migliano conducted tests on the 30 most popular paid Android VPNs to identify potential security issues within the apps – you can find full list of services analyzed here.

These tests focused on different areas viz DNS and other things data leaksVPN encryption, VPN tunnel stability, risky app permissions, risky use of device hardware features, and data collection and sharing.

The most surprising result for Migliano was that half of the top paid VPNs tested (15) failed to ensure that the SNI (Server Name Indication) was encrypted for all server connections the apps make. SNI is an extension of TLS protocol that a client needs to specify the hostname of the server it is trying to connect to during the handshake process.

While this leak may be relatively minor to most people, “It’s an oversight that could get someone in trouble with their school or workplace if VPNs aren’t allowed on the network, or even in legal trouble somewhere like Turkey or China, where VPNs are heavily regulated,” he added.

According to Migliano’s data, Surfshark, Private Internet Access (PIA) and PrivadoVPN where some of the apps still bypass SNI encryption.

Did you know that?

VPN that encrypts a data stream — (Image credit: Shutterstock)

A virtual private network (VPN) is security software that encrypts your Internet connection to prevent third parties from accessing your data in transit and snooping on your online activities. At the same time, it also spoofs your real IP address location for maximum anonymity, giving you access to otherwise geo-restricted content.

At least seven Android VPNs also leaked DNS requests — meaning the device’s request to a Domain Name System server to provide an IP address for a given hostname.

Again, these data leaks are not critical and only happen under very specific circumstances, so it won’t be a big problem for most users. That said, Migliano believes that “a properly configured VPN should terminate all existing network connections to prevent this from happening.”

That’s why, if private browsing is essential to you, he suggests avoiding VPNs affected by this problem, namely HMA!, Private VPN, Mozilla VPN, Privado, VyprVPN, X-VPN and Avira Phantom.

FastestVPN was another big no for Migliano on this front. He said: “I could never recommend FastestVPN after it exposed my email address in plain text in the headers of a server request for a geolocation API, which is inexcusable.”

While much better than free vpn apps, data collection and sharing can also be a problem for some providers. Migliano found that seven apps out of 30 analyzed pose a potential privacy risk due to embedded tracking code from advertisers and data brokers. Still, only two VPNs (VPN Unlimited and Hotspot Shield) were found guilty of actually sharing data in practice, while X-VPN used poor data sharing practices.

VPN encryption for paid services was generally good. Still, while seven apps failed to use the latest version of TLS to establish the VPN tunnel (AES-256), Avira Phantom used the outdated SSLv2 protocol, which, Migliano noted, has long been considered insecure.

Carnevalestoricocivitonico

It’s not just free VPNs, these premium services can be bad for your privacy

Kaneb

Kaneb

Related Posts