No such thing. You would be better off renting an inexpensive VPS and running your own VPN on it.

Public VPN services have to be the one of the greatest lemon markets to have ever existed:

You want people's private data? People will pay you to give it to them. Go ahead and sell the service for less than it costs due to the boatloads of data that you get.

People realize this, so you end up getting a disproportionate number of customers that don't worry about you getting their data because they're only using the service to behave abusively... which drives up costs.

So an honest provider has to deal with dishonest competition selling below cost and a customer base that is saturated with problem customers because good customers are savy enough to avoid VPNs.

Running your own VPN provides no privacy, since you're the only user.

Of course other VPNs don't provide privacy either. The belief that they do is due to marketing, and misunderstanding what the "Private" part of VPN means: it means that two non-publicly routable IP networks (10/8, 172.16/12, 192.168/16) are virtually joined into one network. VPN companies took advantage of this (and that the connection is usually encrypted) to imply that they offer a privacy product.

The main use of a commercial VPN is to bypass region locks and other legal controls that depend on location. Pick a VPN provider (or VPS host) in a jurisdiction that won't cooperate with your home law enforcement. Assume the VPN provider spies on all your traffic.

This is such a deeply misleading statement.

Privacy fundamentally is about keeping things private ... from someone.

If that someone is everyone, then nothing is private. Any sufficiently powerful entity can just overpower you, torture you into submission, guarantee a backdoor into a system you thought was cryptographically private, etc.

I for one do pay for a VPN service, because it keeps my home traffic stream private from some people - namely my ISP - with high probability.

It also obfuscates various types of traffic I generate and makes it harder, though I agree not impossible, to collate my traffic into a usable form for spying agencies.

For me that’s easily worth paying ~$100/year for someone else to manage, and if they base their business reputation on not collecting logs, etc., there’s enough incentive to trust that while also staying vigilant to verify what I can and switch providers if they are shown to be lying.

Self-hosting a vpn is utterly not an alternative for my use case, not even for technical reasons as I am an engineer who works on production web services all day. Just from a cost effectiveness / value POV, third party vpn vendors are a good solution for me.

Right, I overspoke. It provides no extra privacy, against anyone except your ISP. If they're the threat, AND you're able to safely assume that the VPN provider is less of a threat, THEN it provides some privacy.

How does that help? If you're the only one with traffic from that IP, how does that give any privacy? Especially if you pay with something tied to your identity. And why does a VPS have any less likelihood of logging your traffic?

> Especially if you pay with something tied to your identity.

Then don't do that.

Though VPN are not really a strong solution for hiding your identity period. Tor is a more effective tool, but hiding your identity is extremely difficult to do effectively.

> And why does a VPS have any less likelihood of logging your traffic?

They may be too but at least you should expect their business to be viable without doing that, which is better than you can say for VPN services.

>Then don't do that.

You'll be stuck with the shadiest, slowest, most remote VPS in the world if you're unwilling to either give up your personal identity, or lie about it.

it's good for things like public wifi and other untrusted networks since your data is encrypted from your machine to the vpn server

it's 2020. if you're still relying on vpn connection to provide encryption, you are doing it wrong. (I understand there are certain cases you have to deal with unencrypted traffic, but those should be really rare now).

you don't have any control of what protocols your apps use and if they're encrypted or not

If you are talking about apps, recent versions of Android and iOS both deny apps to use unencrypted connections, with only a few exceptions (like browsers)

>You want people's private data? People will pay you to give it to them. Go ahead and sell the service for less than it costs due to the boatloads of data that you get.

The amount of "private data" as a VPN operator isn't a lot. Most sites nowadays are https, so at best you're getting browsing habits on a per-site basis. On the other hand, using a commercial VPN does confer advantages in some cases:

* geo restrictions: commercial vpn have servers in multiple countries, so you can easily switch to one that works. you can achieve the same with cloud servers, but you'll have manually spin them up/down, which isn't convenient

* anonymity: commercial vpns usually have dozens/hundreds of users on one server. You can also switch servers/regions to increase your anonymity set further. This is a much bigger anonymity set than your own private server, which is linked solely to you.

* bandwidth: if you're a heavy traffic user, you'll probably end up paying more. most cloud providers only give you around 0.5TB for a cheap server (within the price of a vpn subscription)

* DMCA/abuse: they handle the DMCA/abuse letters for you. With a self hosted server you'll have to at the very least respond to the ticket they sent otherwise they'll take down your server.

Practically all traffic over a VPN is encrypted because most traffic going over them is encrypted, so I'm not sure how much traffic a VPN provider is really going to be able to sell. They aren't really going to be see very much of what you do if you take even some basic precautions like using HTTPS websites, or using SSL newsgroups, etc. Maybe bittorrent isn't encrypted? I can't imagine that it wouldn't be encrypted but I am not as familiar with how that works.

Your proposed alternative does not address the threat model that most people have when looking for a "VPN".

The threat model you're referring to is, I assume, mostly DMCA warnings. (As in: You want your service to not get disconnected in response to them)

It does address it, when you factor in an appropriate choice of non-US VPS provider.

Not just DMCA warnings, but full extortionary lawsuits. From what I can tell, these exist in most countries. Jurisdiction hopping won't protect you from a determined attacker.

Most VPS providers generally insist on recording your identity, probably with government ID, to limit abuse that would otherwise fall onto them. Whereas VPN providers have already made the choice to weather mild abuse complaints.

I have looked into bulletproof VPS providers. They're drastic overkill, expensive, and getting in bed with the wrong sorts of people.

I second Mullvad also. They don't even have usernames, emails or passwords. All you use to log in is a random number for your account. Can't get much more anonymous than that. And they financially sponsor wireguard, have a bunch of wireguard servers. Can't recommend them enough.

I found Mullvad pitifully slow, even with Wireguard.

Mullvad nodes are all over the place for me; same geo-location can provide ~300kb/s down -- a few hours later multiple mb/s.

I get close to my native bandwidth (80-90 Mbps for a 100 Mbps connection) when using a local wireguard server.

Mullvad, ProtonVPN, and IVPN are recommended by https://www.privacytools.io/providers/vpn/

PrivateInternetAccess has fought and won in US court, but they're also US-based.

(I use Mullvad.)

Impossible for me to verify their no logging claims, but Mullvad have worked well for me in the past, and you can pay in cash using a randomly generated numerical user ID, which strictly limits what they directly know about you. The fact that they accept these payments, and that Mozilla work them with them for Mozilla VPN and presumably have done at least _some_ due diligence, give me some level of confidence that they are sincere about their other claims.

I personally trust Mullvad because of their generally good reputation (built through independent audits), super clean user interface and very fair pricing (5€/month flat fee, no crazy long-term contracts).

Mullvad is also the provider Mozilla is using for their new VPN service (with fewer features).

I have been using Mullvad for the last few years: https://mullvad.net/en/

I don't have much to base it on but they seem trustworthy, and I've seen them recommended here before.

I also use Mullvad and I pay by sending an anonymous envelope of cash to Sweden with a random number scribbled on a bit of paper. So far all of the cash I’ve sent has been added to my accounts. There’s obviously no way to know whether they follow through on their no-log claim but my sense is they’re pretty trustworthy. At the very least the person who opens their mail is.

I can't tell if this is real or not. Do you actually send cash to Sweden?

I do indeed! I’ve sent USD, GBP, and Euros from all over the world - Europe, North Africa, South America, and the US. (I was a “digital nomad” pre-pandemic.) They even give you a one-time-use token for cash payments so you can maintain the anonymity of your account number if the letter is intercepted.

Other than the letter I sent from Morocco, I never included a return address.

That is one of they many ways in which you can add money to a Mullvad account. You should try creating an account; it only takes one click.

I just signed up with Surfshark but I'll definitely check out Mullvad.

When he says it's just one click to generate an account, he means it.

https://mullvad.net/en/account/create/

That link automatically creates a new account. No names, no email address (except if you set up a PayPal subscription), not even a password. Your account number is literally all you need. They even have a FAQ that provides a generalized database schema.

https://mullvad.net/en/help/no-logging-data-policy/#numbered

It is possible (and yes, I tried it!), although other payment methods are available, including some more conventional methods.

Mullvad also happens to be Firefox's choice of vpn provider.

Why not just use Bitcoin or gift card?

Not the person you're responding to, but bitcoin isn't that anonymous. Much more than a credit card, but less so than cash.

Bitcoin ATM/local bitcoin -> sell for monero/mixer -> buy monero.

I generally trust Mozilla/Firefox and they just released a VPN. It is nice to be able to outsource my VPN research to them as well, since there aren’t many orgs I trust like that. It works well so far.

Im starting to trust Mozilla less since they discovered the camera in Firefox keeps recording even when you lock your phone and that they wont fix it until October....

As it should?

You're on a call. You lock the phone. You expect the call to continue right?

This bug is in their new browser. Its in a very early stage. So these bugs are expected

No, I dont expect the camera to stay ON (even for a video call) if I lock the phone.

Do you expect the call to continue, or to drop, when you lock the phone mid-call?

They should definitely have to ask the permission to be able to run the microphone or camera in the background, specially in Firefox (as opposed to native apps).

They already asked permission, and you're still on the call.

Firefox is using Mullvad for their VPN product.

Commercially I’d say ProtonVPN or PrivateInternetAccess.

Best is to make your own, checkout https://github.com/StreisandEffect/streisand for an easy way to set that up.

I would never do business with Private Internet Access.

https://news.ycombinator.com/item?id=21584958

(you can google to find more-- this was just a quick result)

Despite this, they claim to be working on a way to verify their privacy claims. I don’t understand how, but if they succeed it will be noteworthy and might redeem them a fair bit

They could get a security researcher, or three, to look over their systems? Then maybe invite large consumer groups to send an expert to take a look (they could come armed with info on users, that they could check up on, in order to try and confirm they weren't being fed a whole fake server?

SwissVPN. Without going into detail, I'm aware how they respond to all kinds of information requests due to my previous type of work. That earned my business.

Cryptostorm is up there, but I'll back ProtonVPN as well.

I already trust ProtonMail for my emails, so in my case ProtonVPN would be a the good choice. But I still have an active subscription with IPA, and as far as I know they proved in courts that they don’t have logs, which is a strong claim.

I use a registrar called Njalla[1] for many of my domain names and they are soon also launching a VPN option. They are privacy focused so they provide whois privacy, crypto payment and login via xmpp/e-mail only.

In their faq they state that they have previously worked on projects such as ThePirateBay... (this is a legit business and service though).

I hope I get to try their VPN soon. Other than that I usually just use a systemwide tor proxy. It's actually quite entertaining how my netflix feed randomly changes based on the current exit node.

[1]https://njal.la

We are building a VPN-like service that solves the logging problem:

- Cash-in-Envelope Payment.

- Chains multiple servers with onion encryption. If there were any logs, they are useless.

- Custom built for privacy, similarities to Tor. Open Souce.

- Multi-Identity: Exit at multiple servers simultaneously.

- No Blockchain! Ie. no distributed and immutable log ;)

- Based in the EU, Austria.

- Public availability within the next months.

Check it out at https://safing.io/spn/

FoxyProxy. Dedicated servers for each customer so speed is really good (at least for me). Video streaming sites are guaranteed not blocked. And here's US Secret Service subpoena for logs that was handled well:

https://blog.getfoxyproxy.org/2017/11/04/secret-service-subp...

For a VPN provider to actually be trustworthy, you'd have to be able to verify their policies. But that's impossible, so VPN providers just fall into "might be doing bad things" and "confirmed to be doing bad things".

I'm surprised nobody has mentioned airvpn yet. They're run by hacktivists and they're great. Mullvad is the other one with a good reputation, but everyone's mentioned that already.

Piggybacking on this, can anyone comment on Mozilla’s new VPN service?

It's Mullvad with a different UI. That's it.

The most trustworthy is one which you setup yourself imho.

I am giving each of my family in various locations a raspberry pi 4b with wireguard setup.

They are aware of/benefit from this cross country VPN thing too.

Tor?