When should a VPN not be used?

What happens if you don't use VPN?

If you don't use a VPN for your web browsing, your web browsing history will be exposed.

You can easily turn on your VPN on all of your devices (phone, laptop, desktop) when you're at home and use it as a tunnel to your home network. This is the easiest way to protect your web browsing history and avoid the data leak problem.

You can also use your phone as a VPN server, as a router, or simply as a personal hotspot for your friends to use while you're on the go.

Should I leave my VPN on all the time on my phone?

I have a cheap VPN that I use when accessing some sites.

Usually it has 5 tabs open that I only access rarely. Some of these sites get pretty bad load times and I found that if I disable it the pages load more quickly. But will it affect my security or battery? And is it worth keeping on all the time?

There's a way to do this with apps like "WLAN Tether" but it's not as easy to just turn the connection off. I've often had to use a program like that and then turn it back on when I want to use the VPN again.

I use a router's built in DHCP client to get a local IP address, and I have my VPN on the router. This is for my home. A lot of ISPs (even good ones) block pings by default. If I was using an ISP with pings blocked, I'd be right back at the beginning.

Now, the big question is whether your VPN works well on different networks. In other words, your home network and an AT&T network. If your home network has a different DNS server than your office/work network, they may work great together. If not, you may run into issues. It's up to you if that's something you can handle.

Also, don't forget that the VPN won't work if you're using Tor. Yes, keep your VPN on all the time. Even if you don't use it, a VPN server has no problems sending your traffic through it.

If you go to an area with a known-to-be-flaw VPN, don't use it. I've seen many people get IP addresses from servers that have been compromised and now their IP is blacklisted. The best thing you can do is block the country in your firewall, the ISP in your phone, and avoid anything else that doesn't use HTTPS (which includes some VPN providers).

You may also be using your connection too much. You shouldn't be downloading multiple torrents at a time. That really kills you in terms of battery life. There are ways to limit it, but that's something you have to figure out.

For mobile connectivity, VPNs aren't that useful.

When should a VPN not be used?

I am a security researcher, and lately have been spending a lot of time investigating VPN services.

There is a problem with how they are reviewed, and in recent years I've come to believe that those reviews, while necessary, don't do a very good job.

This is due to issues relating to the peer review process: Not understanding why the VPN should exist. Getting things backwards: "I don't trust them, so I don't need one". Writing review scores in ways that are easy to game. There are lots of other problems, but the one thing I think is worse than all of those others put together is the idea that a VPN service can never be used in anything that is not in one's best interests. For that reason I am writing this post, which outlines some situations where it is perfectly reasonable for a VPN provider to give you false or misleading advice about using their service to communicate over unencrypted WiFi when what you want is to protect the security of your data.

One day someone will use my research to argue that we shouldn't trust any VPN service at all, because there isn't any situation in which we should trust one. When that day comes I don't think you'll like the argument you'll be defending.

I'm not going to explain VPNs in depth, because that's not what this post is about. The point of my posts in the past couple of years is just to explain how I came to feel that VPNs were being unfairly reviewed, and how I think they can be done better.

A VPN makes it easier to do something dangerous, or hard to do something important. Imagine that one day you are visiting a place where public WiFi is available. You don't trust what you're getting, but you don't want to make a call over insecure mobile networks either. That's useful for me right now, because a colleague has asked me to do this. (This, BTW, is part of why I think VPNs are often mis-sold, because they end up being used for the wrong purposes.