DEV Community

Osama Tahir
Osama Tahir

Posted on

A maze called VPN logging policies

It would be an understatement to say that online privacy is a big issue today. Facebook-Cambridge Analytica, NHS handing over patient data to machine learning companies, and the list goes on and on.

It's almost as if our private information is a free giveaway that companies obtain from us, often under false pretense, only to be sold to third-party companies to learn about us and throw personalized ads our way. Or for more nefarious purposes like influencing voter behavior in general elections.

In these state of affairs, it is natural to search for measures for improving your online privacy. VPN services are on the frontline of privacy protection tools and their usage is getting more popular everywhere in the world.

The unfortunate conundrum here is that VPNs can often be complicit in keeping logs of your data and even sell them to third-parties. The very tool that people rely on to stay safe on the web can actually be the culprit violating their privacy.

Every VPN service provider has a privacy policy page where they must specify if they keep logs. But the question that should immediately arise is: what kind of logs does a VPN keep?

This is where things get a little complicated. Most providers advertise themselves as being a "no-logs" service. But if you dig deep and read their privacy statements, you realize that they do keep logs, which may or may not be that big of a deal.

It is impossible for any software tool like a VPN to work without keeping some user information such as payment IDs, transaction history, and in many cases IP addresses of users.

What needs to be remembered is that not all data is equally hurtful to your privacy. Information about your bandwidth usage alone can't reveal all that much. But if that information is combined with other pieces of data such as your DNS, IP address, traffic, and connection timestamps, that's probably a situation that you need to worry about.

So, how can you decide if a VPN isn't keeping any more tabs on you than it absolutely needs to operate business?

VPNs should not keep logs about your timestamps, IP address, DNS, and traffic. Period. Some providers keep none of these logs while others may retain some of this information.

To see logging details of popular VPN services at a glance, I created a VPN comparison spreadsheet.

You can find this sheet here: https://www.vpnranks.com/vpn-comparison/

Further reading
https://www.vox.com/policy-and-politics/2018/3/23/17151916/facebook-cambridge-analytica-trump-diagram

https://www.independent.co.uk/life-style/gadgets-and-tech/news/google-nhs-health-app-deepmind-artificial-intelligence-ai-privacy-streams-app-a8633316.html

https://hackernoon.com/what-vpn-services-arent-telling-you-about-data-logging-4ce15e4c90f0

Top comments (3)

Collapse
 
jeddevs profile image
Theo

Interesting read and cetainly is a major issue in life at this point in time and I cant see it decreasing any time soon.

While I agree that this is an issue with VPNs and I have certainly had to search and check thoroughly to find a VPN which works for me but I do feel as if you missed out on some other issues that they are raising, such as how some are claiming to be a full free VPNs like Opera VPN when in truth they are infact just proxies which are not nearly as secure as OpenVPN and the missbranding can really hurt peoples privacy, especially when they are unaware of such missbranding.

Collapse
 
otahir92 profile image
Osama Tahir

Hi Theo,

Painfully sorry for the late reply. I totally agree with you. The issue that I have raised is only one of several that are gradually eroding away the trust of customers. Many free VPNs are proxies and branded falsely. In fact, many free VPNs have also been caught selling our bandwidth and monetizing our private information. I didn't raise these particular issues because there are already some great articles on the issue. I felt that ambiguous logging policies is a problem that needed more attention, so I put more emphasis on this problem.

Collapse
 
jeddevs profile image
Theo

100% agreed, a new issue I have seen becoming more and more prevelant over the last few months are missleading VPN adverts. So many false or missleading statements, for instance saying they use military grade encryption, true but "so what" HTTPS is the same grade.