As a frequent contributor and daily reader of r/VPN on Reddit, I see a lot of consumer VPN questions for vendors like NordVPN, ExpressVPN, OpenVPN, and Private Internet Access (PIA). Let’s look at a few use cases for these and a few things to consider when looking for consumer VPNs.
A couple of the primary use cases are either “hiding/disguising” and “establishing” your location.
Hiding/disguising your location
For the truly security-conscience, some might even call paranoid, they do not want to be tracked for various reasons from various tracking entities, such as ISPs, governments, or advertisers. These folks want to appear to be coming from all over the world with their location (and even identity) changing often. For these folks, using browsers such as Tor, is not enough. These folks are trying to hide or disguise their location for privacy purposes.
Establishing a location
Other folks are trying to establish a location for various reasons from various entities. For example, person A may be using a consumer VPN to appear to be geographically located in the U.S. to allow them to stream content from streaming companies such as Netflix. Person A may also be in a particular U.S. market but wants to watch a local sports event that requires them to be in another market. Person B may be trying to appear to be in a location for “work from home” reasons. They have been allowed to remotely but need to be near a regional office. This may be due to organizations adjusting salaries based on home address after folks moved during the Covid pandemic.
The more severe use case for establishing a location is trying to circumvent country-based firewalls like The Great Firewall of China or accessing blocked sites in countries like Iran and Thailand.
What you should know
For those that are concerned about privacy, know that most of these consumer-grade VPN providers basically act like an ISP. They can and do track your domain name system (DNS) requests. They can and do track your traffic and usage patterns. And since you signed up for an account and they assign you an IP address, they know exactly who you are and where you’re coming from. So, what do they do with this info? If you’re lucky, they ONLY sell it to advertisers. They may also be sharing it with government (and maybe even nefarious) entities.
For those trying to establish a new location to access streaming platforms, you may be lucky and get access for a while, but the streaming platforms quickly learn about the new IP addresses and block those. How, you may ask? NordVPN has an estimated 14 million users. Let’s say 10% are connecting to servers in the U.S. to access Netflix. Even with 1,000 servers in the U.S., that’s 14,000 users coming from a single IP address. That sets off suspicion quickly and Netflix knows to block the IP address. With consumer VPNs promoting great 2-year deals, there are lots of unused accounts because the intended purpose no longer works.
Moreover, there are other ways for companies and governments to find your true location. A mobile device has GPS information that is much more reliable and granular than IP-based geo-location. General whereabouts can also be determined by time zone information gathered from browsers or other software such as the Outlook email client.
Consumer-grade VPN vendors also limit functionality by throttling and blocking certain types of traffic. You’re not going to get the bandwidth you expect, and you may not be able to do things like download pirated software or movies (yes, people still do that).
Lastly, consumer-grade VPN clients may conflict with your enterprise VPN client. They may be both trying to give you an IP address in the same subnet. They may be providing conflicting routing information. This further limits how consumer-grade VPNs may be used and how difficult it may be do what you intend to do.
Hopefully this helps answer some of your questions on consumer VPNs and if it doesn’t, you can always ask on r/VPN. Safe browsing in 2023! If you’d like to learn more about how you can possibly set up your own home-based VPN using Banyan Team Edition, visit https://www.banyansecurity.io/get-started/.