Recommended VPNs

Due to the recent events¹ and increased internet censorship in Russia, there has been a big increase of interest in VPN services. With most popular social networks, such as Instagram, being censored, I see a lot of well-intended, but, honestly, bad advice floating around. I want to share my perspective on which VPNs to use, and which to avoid.

This post is purely based on my opinion and experiences; and is not intended to be an all-around guide. If my ramblings take too long to read, and you would like to blindly trust me, you can check recommendations.

I won’t want to argue that you need a VPN. If you routinely use public networks in cafés or airports, I believe you should use a VPN. If you are in Russia right now, you need a VPN.

How would you choose one?

There are three main criterions that I would use when choosing a VPN. First, VPN service should have long and untainted history. Second, it should be fast and feature-rich. That meand WireGuard support and port forwarding for torrenting and other applications. Third, it should allow anonymous payments and allow registration without email.

History & Ownership

The VPN industry should built around trust; however it may be hard to find reliable evidence of such reputations—companies routinely pay for ads and paid reviews; many reviewing platforms are owned by VPN companies (see also this article). The main umbrella company in the market is Kape Technologies. Kape was previously known as Crossrider, a company that profited from malware that installed software and changed your homepage back in 2006. You don’t want your security to be dependent on the company that was changing the homepage of your grandma.

A short list of Kape-owned VPNs include ExpressVPN, Private Intenet Access (PIA), CyberGhost, and ZenMate. They also own VPN “review” sites like VPNmentor, which is extremely shady.

NordVPN is known for their extremely aggressive marketing campaigns and shady business practices. Its parent company Tesonet has also recently acquired SurfShark. ProtonVPN likely belongs in the same group.

WireGuard & port forwarding

You want your VPN to be fast and useful.

WireGuard is a new open-source VPN protocol that is designed to be simple, fast, and safe. WireGuard is built around the Noise Protocol framework and relies on a select few, modern, cryptographic primitives: X25519 for public key operations, ChaCha20-Poly1305 for authenticated encryption, and Blake2s for message authentication (source). WireGuard is 20-60% faster than OpenVPN, and written in <7,000 lines of code. In comparison, OpenVPN and IPSec have >400,000 lines of code. A modern VPN solution that cares about your privacy should support WireGuard.

Now, to port forwarding. When you eventually have an application that needs an open client port, such as torrenting, it’s best to have a VPN service that support that. VPN services that offer port forwarding are generally more expensive, as there is a limited amount of ports that can be open per server.

Anonymous payments & no registration

If you are in Russia, you likely don’t want the state to know you are using a VPN. Sure, email-based registration is easy and convenient. Sure, PayPal payments are easy². These are not anonymous; these are not secure.

Services that are focused on your privacy should offer cash or Bitcoin payment.

Recommendations

IVPN and Mullvad are the only options that respect the desiderata outlied above. I strongly believe in each criterion, and I have faith in these VPN services.

IVPN offers a free subscription for Ukrainians and Russians. While the free access is not available due to abuse, I personally want to sponsor a service with strong ethical principles.

Mullvad offers a no-bullshit 5$/month payment model and extremely transparent relationship with the community.

When you don’t need a VPN?

When you only want to temporarily route traffic from a single country, it may be easier to buy a server route the traffic via SOCKS proxy, for example though SSH. While it is more detectable than a VPN, you may already rent a server that can be used for that matter.

A lot of VPN providers are way shadier than your average government agencies. Research has found that 84% “Free” Android VPN apps will leak your IP address, 82% will attempt to access your sensitive data, 75% utilize third-party tracking, 38% contain malware, and 18% don’t encrypt your data at all. If you don’t want to pay and do your homework, not using VPN may actually be safer.

I hope I didn’t scare you too much.