TLS won't cloak your IP address nor your browsing history from the VPN provider... so, even if the content is TLS encrypted, your VPN provider has to that metad

TLS won't cloak your IP address nor your browsing history from the VPN provider... so, even if the content is TLS encrypted, your VPN provider has to that metadata (+ more) across all sites you visit while connected to their servers. which they can then turn over to law enforcement on request[1], or leave on an unsecured S3 bucket (or similar) somewhere[2]. So yeah, in short, we shouldn't be recommending the use of third-party VPNs without qualification. There are valid use cases sometimes, but avoiding tracking is very much not one of them. [1] https://securitygladiators.com/fbi-purevpn/ https://securitygladiators.com/fbi-purevpn/ [2] https://nakedsecurity.sophos.com/2020/07/20/7-vpns-that-leaked-their-logs-the-logs-that-didnt-exist/ https://nakedsecurity.sophos.com/2020/07/20/7-vpns-that-leak...