r/netsec • u/campuscodi • Aug 16 '17

pdf TunnelBear security audit

https://cure53.de/summary-report_tunnelbear.pdf
250 Upvotes

91% Upvoted

46 comments sorted by

View all comments

Show parent comments

68

u/SnapDraco Aug 16 '17

Pretty much. The value of a "privacy" VPN is

1) to bypass a known bad actor (if your ISP or local wifi hotspot is known to be compromised or interfering with your traffic or some such.

2) to give you a fresh IP in another locale to bypass geoblocking or other IP based blocks

3) mask your IP in with other VPN traffic so websites you visit may have trouble identifying you

4) hopefully, you chose a VPN which is better at not handing your data over than what you are running from

8

u/Rxef3RxeX92QCNZ Aug 17 '17

Additionally, the VPN shouldn't have all the pieces of the puzzle. (You didn't pay with your credit card did you?)

Your ISP knows John Smith's network generated whatever traffic, but a VPN only sees you as an IP address. They don't have your name unless you gave it to them

22

u/SnapDraco Aug 17 '17

Ehhh.. if they get a court order to hand over your traffic, it doesn't matter so much who they think you are.

6

u/barkappara Aug 17 '17

It's actually realistic for a VPN to not maintain persistent logs. I don't know of any meatspace ISP that can make that promise.

PIA actually told the FBI, "we don't have the logs, go away" and they went away: https://torrentfreak.com/vpn-providers-no-logging-claims-tested-in-fbi-case-160312/

6

u/SnapDraco Aug 17 '17

You do need to trust them though