2023-05-24
One of the most advertised IT asset is Virtual Private Network or VPN. It seems that every other Youtube creator are sponsored by a VPN provider.
VPN's are used by employees to securely connect to the company's private network from anywhere in the world.
Using a VPN does have its benefits for privacy but its main use case would be hiding personal IP address, i.e., IP masking, not the advertised military grade encryption as nearly the whole internet uses HTTPS+TLS for encryption.
However there are certain risks involved in using VPN. Indian government has made user data collection mandatory for all cloud based service (which includes VPN). This could then be used to track the user's activities.
If VPN configuration is not properly managed then it could result in DNS leak i.e., DNS requests are sent to your ISP instead of to the VPN server revealing true IP address.
Another (not so often mentioned) risk is SSL stripping. VPN providers are in the sweet spot of performing Man-in-the-Middle Attack. A malicious actor in that position could strip away the (SSL+TLS) encryption, which would expose your data for third parties to see.
Setting up our own secure VPN server has become easy with Open Source Software like OpenVPN and WireGuard. There are lots of resources for the same. We could use this script or this one to install our own server in under 5 minutes. It could give you more control over your privacy & security and be sure that no one else has access to your data.
Here it is another reason not to use untrusted VPN provider. A popular VPN app from playstore was functioning as a DDoS Botnet. This VPN was sending a uniquely crafted URL request and combining with over 5 million devices, it acted as a perfect tool for DDoSing. OG Source.