Funnily, both ExpressVPN and NordVPN which you call out have been externally audited.

NordVPN had the clients audited by VerSprite last year, and their No-log policy audited by PwC in 2018 and 2020. And a bug bounty program on HackerOne. [1]

ExpressVPN - Windows Client was just audited by F-Secure in March, and server side audits by Cure54, and PwC in 2021 and 2019 respectively. And a bug bounty program on Bug Crowd. [2]

---

For comparison

Mullvad has been audited (Client security and Infrastructure (for privacy)) by Cure53 through 2020, and first was in 2018. Has no bug bounty, but they do still have a vulnerability disclosure program. [3]

ProtonVPN, audits of the no-log policy in April, and clients in 2020. And they run their own bug bounty program.[4]

---

I actually find it kinda interesting that while they've all had audits regarding privacy on the server side, only ExpressVPN has had a security audit of server side components. (Granted I've not look that deeply at this)

[1] Annoying, you can only download the audit reports if you Login then click Reports in the menu

[2] https://www.expressvpn.com/blog/?s=audit

[3] https://mullvad.net/en/blog/tag/audits/

[4] https://protonvpn.com/blog/?s=audit

What's is the concern about VPNs being "suspect" or "reliable"? I hear this a lot about VPN providers but not sure why. If the VPN is logging your activity/IP you'd have to be doing something super illegal for the police to want to get a search warrant for your data.

It's not just that they're suspect or unreliable. They're complete bullshit.

The actual use of VPN technology is to create virtual networks that are private (hence the name). It's a system level technology. There are several types of network topologies you can set up, when I was learning about this I found this article which is quite nice: https://www.procustodibus.com/blog/2020/10/wireguard-topolog.... You can proxy traffic through a VPN, but the only scenario I can think of in which it makes sense is if you are an OSINT researcher and you need a safe system on which to conduct your research.

If you need to proxy traffic and "hide" your IP, just use a flipping proxy. It's an application level technology (e.g. for torrenting, every torrent client under the sun supports a SOCKS5 proxy). If you don't have the patience to set up a VPS yourself, you can even use something like Outline (https://getoutline.org) which automates that (and it has a mobile client app as well).

If you need privacy (and to actually hide your IP), then use Tor.

Unfortunately that doesn’t fix the real reason most people use VPNs, which is torrenting. Nobody should be using NordVPN to hide from a nation state, but for torrenting they add one level of obfuscation.

I specifically mentioned torrenting, please re-read. There is no reason to have all the network I/O of your computer go through an extra hop just for one application (e.g. a torrent client) when that application can be configured to use a proxy instead. It increases the network latency, complexity and attack surface of your system.

If the main use case is torrents,

I think the reason why the method you mention isn't commonly used is that it is complicated to understand/set up and hard to verify.

I've seen more advanced users encapsulate everything in a VM so that non-VPN traffic can be blocked globally by the OS.

As always, the answer is it depends on your threat model.

> Most VPN providers you typically see pushed are very suspect at best.

Ironically (I hope?), Mullvad is by far the one I see pushed the most.

I don't think I've ever seen a Mullvad ad or paid promotion (eg sponsored YT videos). I mostly see happy customers praising them (including myself).

Between sponsorblock and ublock origin, I never see ads or paid promotions on youtube or any other website like that. That mostly leaves [presumably] unpaid promotion of Mullvad on sites like HN.