VPNs aren't a guarantee of privacy, just the best we've got

[Len]

SO BETWEEN the newly-announced Data Protection Bill and the expected destruction of net neutrality, you're probably feeling a bit vulnerable right now.

You've got nothing to hide as such, you're just someone who appreciates the boundaries of what 'the man' knows about you. You accept it'll break Cortana, but you know… that's just a bonus.

All the conventional wisdom seems to be to get a hosted VPN. The idea is that it will divert all your traffic to somewhere anonymous… somewhere far away… and encrypt it.

But, just as we are now realising that the "wife anniversary present mode" in browsers is really not that effective, perhaps we need to start taking a closer look at VPNs too. And there are two reasons.

Firstly, when we agree to a VPN we're putting our trust in the hands of that VPN provider. And there are a lot. Some, for example, offer fantastic deals on "lifetime access".

But are they really doing what they say? The short answer is, in a lot of cases, no. RestorePrivacy took a look and found that quite often data that was supposed to be carried anonymously simply wasn't, and in many cases, where you pick a country that you'd like your IP to show in, quite often you'll find, under the hood, you're connected to a completely different one.

HideMyAss, one of the more popular services, openly admits that some of its country specific servers have been "virtualised". Others, like ExpressVPN, were claiming to connect to countries all across Asia, which were in fact, actually all in Singapore.

PureVPN meanwhile, actually hosts its Azerbaijan server in Edinburgh, says the study.

It's not just about honesty. It's about the safety of your data. If you are running your data through one country's servers because of its stance, and in fact, you're using another, you could be completely violating the wrong set of laws.

Take the PureVPN example - the consequences of using the Pirate Bay in the UK rather than Azerbaijan are more serious, if you were found out, of course.

All of which makes choosing a VPN something of a risky business. Firstly, let's make it clear - no free ones. They're bound to be shonky. You get what you pay for. We're not in the business of recommending anyone in this article, but we'd say that often if the deal sounds too good to be true, it probably is.

But wait. There's a second issue. We talk about how VPNs stop you leaving footprints. Well, they don't. They just make it a damn sight harder.

Take, for example, you want to look at some nudey-pics on your phone. You turn on Incognito Mode. You switch your VPN to a country that will keep it nice and anonymous. But there's a Telltale Heart and it could give you away.

Your phone's apps are churning out (mostly M2M) background data all the time from your IP address to servers all over the world.

When you turn that VPN on, that heartbeat disappears, and pops up somewhere else in the world and continues. And then when you've erm… finished… you might turn off the VPN and suddenly that trail follows you back.

A determined adversary could easily join the dots from that "heartbeat" of background data that you aren't even aware you are sending. It might be encrypted - but then it might be in the country you thought it was. And it might... not.

Yes, there's a lot of "what ifs" to the scenario. There's a lot of "they'd have to really, really want to". But yeah. They could. If they could get you before VPNs, they can get you now, especially this new breed of too-good-to-be-true ones. 

We're not saying VPNs are bad. But remember, they're not foolproof. The data may be anonymised, but your unique heartbeat simply moves. You're never completely off-grid.

It's not about to affect our privacy tomorrow, but there's a danger that VPNs are seen as a holy grail. They're not. They're not even close. So let's not get complacent. µ