VPN Report – Reviews of the top VPNs

As someone living in China, a VPN provider that doesn't provide direct download links to their Android client is completely useless. The only way for me to install an app from Google Play store is to flash a custom ROM and install the Google Play Store, install another VPN (?!!) to access the Play Store, and then download the app in question.

Furthermore, the fact that Apple has just pulled VPN apps from its App Store and the unfortunate fact that you can't sideload apps makes iOS an untenable OS choice.

lololol. Half of these VPN vendors show up on Kenn White's VPN Hall of Shame for offering unsafe configurations:

https://gist.github.com/kennwhite/1f3bc4d889b02b35d8aa

For anything actually sensitive, you're better off not using a VPN than using a VPN which provides an unsafe configuration.

If you'd rather not do your own pager duty for something like Algo, here's a recommendation I put together a while ago:

https://free-dissociation.com/blog/posts/2017/03/quick-and-d...

> ... Apple has just pulled VPN apps from its App Store and > ...you can't sideload apps makes iOS an untenable OS choice.

I'm pretty sure you can still install VPN apps (e.g. Potatso 2) from the iOS App Store, although perhaps they're not available if you're logged in with a China iTunes account. iOS allows you to install apps from multiple iTunes accounts on the same device, though, so this doesn't seem like much of a limitation.

(Not sure if they're also blocking by IP address.)

> Use something like Algo to run your own VPN if you have to.

This might be good advice for tech-savvy people, but too hard for most folks.

Also, Algo is targeted at only security/privacy, and not censorship resistant. The last time I checked, it didn't offer any protocols that work well behind GFW.

Also, where are you going to run your VPN? Assuming you don't have your own hosting infrastructure (or domestic broadband connection in another country), then you're renting a server from someone else. Perhaps your assumption is that a random VPS provider is more trustworthy than a random VPN provider?

> If you must use a commercial VPN to get to Netflix or whatever, > do it from inside a virtual machine that you use for nothing but that.

Again, good advice for tech-savvy people, but not practical for most folks, particularly for the times when they're on mobile devices.

I don't disagree with your overall sentiment (I don't use commercial VPN providers for the same reasons), but for many folks these serve a useful purpose, and there are no practical alternatives.

Hi mobitar. Thanks for the highest score in regard to the objective measures. Regarding the subjective impression and experience, I'd like to let you know what's going on. If you feel that this changes your impression, it would be great to update accordingly!

The HTTP connection upon startup is for the region data request which is signed and verified upon receipt. It's tamper proof, but you can read it. It's something that anyone with the client can read, and the client is free to download.

Arguably, it's more secure to entrust the communication from PIA to the client software itself than to blindly entrust it to HTTPS which has provably been compromised due to bad actors in the past.

We're in #privateinternetaccess on irc.freenode.net to discuss anytime as well!

Thanks for everything mobitar and for taking the time to produce this report.