> In reality, they do nothing to improve security
This is a bad take. I don't have the energy/time to go too in depth at the moment, but I've commented in more detail in the past. The short version:
- HTTPS isn't perfect, sites sometimes support old encryption protocols that can leak resource information. Most users aren't checking packets from native apps to ensure they're being sent over HTTPS, and browsers don't mark sites that are configured for old SSL/TLS versions as insecure.
- Most people aren't currently using encrypted DNS, and even as browsers like Firefox and Chrome move to turn it on by default, there will still be tons of older devices and native applications that lag behind.
- VPNs only encrypt your connection from you to the provider, but the space between you and the provider is the part that's most likely to be targeted by attackers. You are far more likely to accidentally send a plaintext POST request to an infected router than you are to be targeted by a nation-state actor on the open web.
- VPNs aren't just for hiding what sites you visit from your ISP, they're also for hiding your IP address. The linked claim that IP addresses are irrelevant is just outright wrong, IP addresses are extremely helpful for doxing, and sites like forums don't always secure them[0]. If you know my IP address, you'll be able to get surprisingly close to my real address.
A VPN on its own will not protect you or provide you with a noticeable privacy increase. And a VPN should not be the first thing you reach for if you're trying to improve your privacy. But if you're already using an adblocker, if you're already taking steps to mitigate tracking in Firefox, if you're already disabling Javascript on most sites, if you're already avoiding native apps that break the browser sandbox or engage in hardware tracking, you do eventually reach a point where your IP address is a concern you will want to address.
Ask yourself a few questions:
- If IP addresses don't actually matter for tracking, then why is TOR wasting so much time and energy trying to mask them?
- If masking an IP address doesn't provide any extra privacy, why do some services like Google Captcha penalize shared IP addresses?
- If IP addresses don't matter for tracking, why are so many sites using IP bans at all?
The answer is that IP addresses do matter, they're just not the only thing that matters.
----
[0]: https://danshumway.com/blog/gamasutra-vulnerabilities/