VPNs are often sold as a “privacy silver bullet,” but that framing causes more confusion.

A VPN does not make you anonymous.

It does not stop cookies, logins, browser fingerprinting, or payment-based identification.

What a VPN actually does is much narrower and more technical:

  1. It encrypts your internet traffic in transit
  2. It prevents your ISP or local network from seeing which destinations you connect to
  3. It makes websites see the VPN server’s IP instead of your real one
  4. That’s privacy at the network level, not identity hiding.

I wrote a detailed blogpost. Check it out.

all 28 comments

sorted by: hot top controversial new old
[–] 40 points 8 months ago (1 child)

That's just about all I need. Vpn + privacy browser is as much effort as I'm willing to put in. Beyond that it gets really frustrating.

  • source
  • hideshow 1 child comment
  • [–] 30 points 8 months ago (6 children)
    1. It encrypts your internet traffic in transit

    Note that most sites use TLS these days, so your data is already encrypted in transit.

  • source
  • hideshow 6 child comments
  • [–] 30 points 8 months ago* (last edited 8 months ago) (3 children)

    True, however TLS does not encrypt the hostname/IP address of the servers that you are connecting to, so your ISP can monitor the servers you visit. A VPN provides an encrypted tunnel for your traffic, so your ISP can only see that you are communicating with the VPN server. However, the VPN provider can see the hostname/IP of the servers in order to forward the traffic to its destination.

    Ideally the VPN provider does not monitor or keep logs of the connections, but this is not always the case. A VPN offers privacy from the ISP or from other clients connected to the local network when using public WiFi.

    It can also provide some level of anonymity, because the server that you are connecting to will only be able to see the VPN IP address connecting to them, instead of your home IP address. It is possible to still be identified by other means besides your IP address, like using cookies or browser fingerpinting.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 8 months ago* (2 children)

    The hostname will be encrypted eventually (ESNI) but you're right that the IP address is visible.

    Destination IP is starting to mean less and less these days, given there's a large amount of sites that use shared IPs rather than dedicated ones (for example, if they use Cloudflare, Vercel, Netlify, AWS CloudFront, etc.)

  • source
  • parent
  • hideshow 2 child comments
  • [–] 27 points 8 months ago (2 children)
    1. It means you're letting a different company (VPN provider instead of ISP) see everything you do. In countries with sane privacy laws (i.e. not the US) this is very often a net negative for your privacy, as your ISP will be bound by your country's privacy laws and most VPN providers are foreign (and often based in the US).

    Good blog. You touch on this point in the blog but IMHO it should be one of your main talking points.

  • source
  • hideshow 2 child comments
  • [–] [S] 13 points 8 months ago (1 child)

    Not all VPNs are fraud. Purchasing a good VPN plan should be done after a lot of research. Because the most popular or cheaper could be the worst one.

  • source
  • parent
  • hideshow 1 child comment
  • I often VPN to my home network while on the go. The overall web experience is so much worse without DNS level ad blocking.

  • source
  • [–] 7 points 8 months ago (1 child)

    Great article! I've been trying to explain VPNs to my family members for years and it just doesn't stick. I'll send this their way next time.

  • source
  • hideshow 1 child comment
  • [–] 5 points 8 months ago (4 children)

    Ill always use a vpn as theres no other way to stop advertisers seeing your local host ip.

    Its not sufficient to stop them tracking, by miles, but its necessary.

  • source
  • hideshow 4 child comments
  • [–] [S] 1 point 8 months ago (3 children)

    Yes VPNs are necessary. At least when using a public network.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 3 points 8 months ago (2 children)

    Even your home network can be comprimised,

  • source
  • parent
  • hideshow 2 child comments
  • [–] -1 points 8 months ago* (1 child)

    Practically speaking, not really. And at that point the state has a warrant and been in your home or someone highly technical in your home is there and there isn't really shit you can do except block physical access to everything.

    The odds that someone is intercepting and mitm your TLS/SSL behind your edge is absurdly low.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 4 points 8 months ago
    1. It encrypts your internet traffic in transit

    It encrypts it in part of the transit, the part between the VPN server and the target is the same as it would have been without a VPN

    1. It prevents your ISP or local network from seeing which destinations you connect to

    True but now your VPN provider can see everything your ISP would have. Depending on the jurisdiction of your ISP and VPN, that could make it better or worse

  • source
  • [–] 3 points 8 months ago* (last edited 8 months ago) (1 child)

    Not everything is good about VPNs, you should check your DNS configuration also.

  • source
  • hideshow 1 child comment
  • [–] 1 point 8 months ago

    It does, however, make a certain level of anonymity at least possible as long as you scrub your cookies regularly, never log into the same accounts over the VPN that you were using without it, and never buy anything over the VPN.

    In the end, you have to sit down and ask yourself what information you're trying to protect from whom, and how much trouble protecting it is worth. You don't want your nosy cousin who works at your ISP to know you look at furry porn, well, a VPN should be good enough for that (provided you don't use the ISP's DNS). If you're trying to conceal your actions from a nation-state-level observer, you've got a lot more work to do.

  • source
  • [+] 1 point 8 months ago* (last edited 6 months ago) (2 children)
  • [–] 4 points 8 months ago

    Your internet traffic is already encrypted in transit, that what the “s” in https means.

    You don't get the "s" until you have the "https". Your DNS request which turns www.TheWebsiteYouDoNotWantKnown.com into its IP address happens before you have the "s" in "https". By default, that request is sent in plaintext, and frequently by default, to your internet service provider. So an outside monitor may not be able to see the contents of the website once you establish your https connection, they likely know that you went there and have a good idea how long you stayed on it.

    While its also possible to encrypt the DNS request with DoH or DoT, its not on by default and requires the user to take configuration actions in their browser. If they're looking at VPNs for the first time, they likely don't know this and are sending their DNS requests in the clear.

  • source
  • parent
  • [–] 0 points 8 months ago

    Yes, security is layered. Vpn is a layer.

  • source