4 ms·

The biggest scam is that these companies call their products "VPNs" incorrectly to mislead you. A VPN actually has to have a PN that you join your client to in

The biggest scam is that these companies call their products "VPNs" incorrectly to mislead you. A VPN actually has to have a PN that you join your client to in order to access other targets in that private network. Eg you're at home and you want to access your computer at work, so you connect to a VPN set up at your workplace. What these companies give you is just a proxy to the internet. These products were called "proxies" back in the day, but someone realized "VPN" sounds more awesome and has "Private" in it so they started calling their products that. The only connection these proxies have to VPNs is that they use the same tech under the hood (OpenVPN, Wireguard, etc).

jmuguy 5y ago
I don't think there's anything nefarious around the use of VPN by these services. That's just what they ended up being called because they're using VPN client software and VPN technology to enable the connection. Proxies are different. If someone was providing a Proxy service and calling it a VPN, that would be a scam (although a pretty silly one, imo). Also Proxy services do currently exist, and they have no issues calling themselves a proxy. Also I setup plenty of "real" VPN connections for businesses that tunneled 100% of internet traffic through the central office, because they wanted to be able to do DPI, etc.
trillic 5y ago
This isn't true for all VPN providers though. There are public VPN providers (Mullvad). Where each of your devices gets its own internal IP on their network and you can use it just as a typical VPN. It's just that most people don't use it that way.
0x0000000 5y ago
I disagree with your take. These are VPNs because you are building private overlay tunnels on top of a public Internet underlay. Just because youre not using a VPN to tunnel into a private (e.g. RFC1918) network doesn't mean you haven't established a virtual private network over the Internet. Also, these are not proxies. A proxy terminates a layer 4/7 connnection from the user, and established its own layer 4/7 connection to the destination, fully man-in-the-middling the connection. When one is using these widely advertised VPN services, there is no layer 4 or 7 proxy^. Rather, the gateway at the VPN PoP is NAT'ing traffic at layer 3. ^IME, many of these services also provide an HTTP or SOCKS proxy, but that's not what a user is using when they have an app on their phone or thick client on the desktop.
TechBro8615 5y ago
I wouldn't be so sure... if you poke hard enough at the interface some of these VPN clients create, I think you might find more than just the open internet.
- ithkuil 5y ago
  do you have some reference?
  - TechBro8615 5y ago
    No, just speculation based on the gap between skills required to market a successful VPN business, and skills required to implement a secure and private multi-tenant overlay network (not to mention the ethics required to do so honestly).
    - benedikt 5y ago
      some years ago i ran a vpn service together with a friend. we had the second skill set you mentioned, but not the first. we didn’t overhype the privacy aspect (and would in fact explain what _wasnt_ private about vpns, not that anyone was interested in listening) and primarily existed to serve a customer base for other reasons. it was a good experience, but it went nowhere really. but i did quickly figure out that almost every large vpn provider out there has more of the first skill set you mentioned.
cf141q5325 5y ago
Most VPN companies also just offer OpenVPN configs for download. Not doing that is imho a great indicator their client might be doing a bit more then it should.
- zxcvbn4038 5y ago
  Agreed, it’s really dubious how hard ExpressVPN, ProtonVPN, and others are pushing their closed source binary clients. They are not just a convenience wrapper to download config files, there seems to be something more involved. The paranoid in me wonders if it’s some sort of phone-home mechanism so they can identify you if needed or if they are trying to inject ads at layer 4. It really stands out compared to the VPNs that invite you to download and review all of their client and server config files. I can understand that a couple hours of support can really eat into the margins - but in the same breath the vast majority of users are down to just download the binary client and be on their way - it’s only a small percentage that want to do things low level and we probably aren’t going to need help from support beyond downloading the configs if they are hidden on the website.
  - cf141q5325 5y ago
    Expressvpn actually has the openvpn file as well on their website (for devices their client doesnt support). Although using the IP (instead of the url) in it lead to problems for me since it switched regularly in the subnet. So every few weeks i had to update the file as well as my IpFire config. In all fairness they also do some reasonable stuff with the client, like blocking your internet connection if you get disconnected from the VPN. But yes, didnt use the client either.
- banana_giraffe 5y ago
  It should be noted, that for some of the providers, the OpenVPN configs they provide and their clients actually do different things. The ones I've dug into do seem to all setup VPN networks with their clients, but some of them do something extra to special case some major media services. You'll see little oddities, like the webpage for disneyplus.com being routed through some special IP, no doubt to work around a block, which the content CDN requests are left to load through the normal VPN connection. The OpenVPN config file does none of this. On top of this, how they get these IPs that are unblocked, is ... questionable. https://web.archive.org/web/20200716220700/https://medium.com/@derek./how-is-nordvpn-unblocking-disney-6c51045dbc30 https://web.archive.org/web/20200716220700/https://medium.co... has more details on one case. There are others.
nirui 5y ago
Some VPN providers actually provides a virtual network address, so I guess it still counts as a network (albeit an isolated one). I think a better description is: those companies are using a small set of VPN features to run proxy business. BTW: In Android OS, if you want to intercept and redirect network traffic, you must(I guess??) use a component called android.net.VpnService(1) introduced in Android 4. Maybe this is what inspired those companies to name their product a VPN. Just a guess of course, but the timing is roughly a match. 1: https://developer.android.com/reference/android/net/VpnService https://developer.android.com/reference/android/net/VpnServi...
- Arnavion 5y ago
  Like I said, it's VPN tech under the hood. But just using VPN tech does not make you a VPN, no more than joining two bricks together with cement makes a house. You need to connect lots of bricks in the shape of a house before you can call it a house, and you need to connect machines into an actual private network before you can call it a VPN.
  - askura 5y ago
    Absolutely. The misinformation in this space is risking yet another greater amount of lives now than it was before. It's OK for those of us in countries with freedoms afforded to us by democracy. It's a nightmare for those who aren't.
upbeat_general 5y ago
To be fair, many VPN services (incl mine) allow several of your devices to communicate when both connected to their network.
- askura 5y ago
  Windscribe have unlimited devices. I think a lot of VPNs know that it's a bullshit tactic to sell more accounts but can't turn that revenue down. They know first hand that people will share accounts rather than just purchase a new one but limiting devices takes that option away.
saurik 5y ago
I agree that "private" here is strange, but if you VPN into a private network which happens to have a gateway for the default route... well, that's what these services are; and the term "proxy" was pretty much always operating at a much higher layer of the OSI stack, and so when you say "proxy" the assumption is you are talking about an HTTP CONNECT or SOCKS solution, not something that can give you an IP address on a remote network. Like, yes: the use case is backwards, but the tech is the same and the other terms are wrong.
- xcambar 5y ago
  The average person has a better perception of VPN than it has of Proxy. No matter what the tech aspects behind the terms actually mean. It's marketing. Being technically (in)correct is irrelevant here.
tomerv 5y ago
How is that a scam? The customers - which are probably not extremely technologically savvy - know that they're buying a proxy, even if it's called something else. That's more of a linguistic drift than anything else. If there's a scam here (and there probably is...), this isn't it.

jmuguy 5y ago

I don't think there's anything nefarious around the use of VPN by these services. That's just what they ended up being called because they're using VPN client software and VPN technology to enable the connection. Proxies are different. If someone was providing a Proxy service and calling it a VPN, that would be a scam (although a pretty silly one, imo). Also Proxy services do currently exist, and they have no issues calling themselves a proxy. Also I setup plenty of "real" VPN connections for businesses that tunneled 100% of internet traffic through the central office, because they wanted to be able to do DPI, etc.

trillic 5y ago

This isn't true for all VPN providers though. There are public VPN providers (Mullvad). Where each of your devices gets its own internal IP on their network and you can use it just as a typical VPN. It's just that most people don't use it that way.

0x0000000 5y ago

I disagree with your take. These are VPNs because you are building private overlay tunnels on top of a public Internet underlay. Just because youre not using a VPN to tunnel into a private (e.g. RFC1918) network doesn't mean you haven't established a virtual private network over the Internet. Also, these are not proxies. A proxy terminates a layer 4/7 connnection from the user, and established its own layer 4/7 connection to the destination, fully man-in-the-middling the connection. When one is using these widely advertised VPN services, there is no layer 4 or 7 proxy^. Rather, the gateway at the VPN PoP is NAT'ing traffic at layer 3. ^IME, many of these services also provide an HTTP or SOCKS proxy, but that's not what a user is using when they have an app on their phone or thick client on the desktop.

TechBro8615 5y ago

I wouldn't be so sure... if you poke hard enough at the interface some of these VPN clients create, I think you might find more than just the open internet.

ithkuil 5y ago
do you have some reference?
- TechBro8615 5y ago
  No, just speculation based on the gap between skills required to market a successful VPN business, and skills required to implement a secure and private multi-tenant overlay network (not to mention the ethics required to do so honestly).
  - benedikt 5y ago
    some years ago i ran a vpn service together with a friend. we had the second skill set you mentioned, but not the first. we didn’t overhype the privacy aspect (and would in fact explain what _wasnt_ private about vpns, not that anyone was interested in listening) and primarily existed to serve a customer base for other reasons. it was a good experience, but it went nowhere really. but i did quickly figure out that almost every large vpn provider out there has more of the first skill set you mentioned.

cf141q5325 5y ago

Most VPN companies also just offer OpenVPN configs for download. Not doing that is imho a great indicator their client might be doing a bit more then it should.

zxcvbn4038 5y ago
Agreed, it’s really dubious how hard ExpressVPN, ProtonVPN, and others are pushing their closed source binary clients. They are not just a convenience wrapper to download config files, there seems to be something more involved. The paranoid in me wonders if it’s some sort of phone-home mechanism so they can identify you if needed or if they are trying to inject ads at layer 4. It really stands out compared to the VPNs that invite you to download and review all of their client and server config files. I can understand that a couple hours of support can really eat into the margins - but in the same breath the vast majority of users are down to just download the binary client and be on their way - it’s only a small percentage that want to do things low level and we probably aren’t going to need help from support beyond downloading the configs if they are hidden on the website.
- cf141q5325 5y ago
  Expressvpn actually has the openvpn file as well on their website (for devices their client doesnt support). Although using the IP (instead of the url) in it lead to problems for me since it switched regularly in the subnet. So every few weeks i had to update the file as well as my IpFire config. In all fairness they also do some reasonable stuff with the client, like blocking your internet connection if you get disconnected from the VPN. But yes, didnt use the client either.
banana_giraffe 5y ago
It should be noted, that for some of the providers, the OpenVPN configs they provide and their clients actually do different things. The ones I've dug into do seem to all setup VPN networks with their clients, but some of them do something extra to special case some major media services. You'll see little oddities, like the webpage for disneyplus.com being routed through some special IP, no doubt to work around a block, which the content CDN requests are left to load through the normal VPN connection. The OpenVPN config file does none of this. On top of this, how they get these IPs that are unblocked, is ... questionable. https://web.archive.org/web/20200716220700/https://medium.com/@derek./how-is-nordvpn-unblocking-disney-6c51045dbc30 https://web.archive.org/web/20200716220700/https://medium.co... has more details on one case. There are others.

nirui 5y ago

Some VPN providers actually provides a virtual network address, so I guess it still counts as a network (albeit an isolated one). I think a better description is: those companies are using a small set of VPN features to run proxy business. BTW: In Android OS, if you want to intercept and redirect network traffic, you must(I guess??) use a component called android.net.VpnService(1) introduced in Android 4. Maybe this is what inspired those companies to name their product a VPN. Just a guess of course, but the timing is roughly a match. 1: https://developer.android.com/reference/android/net/VpnService https://developer.android.com/reference/android/net/VpnServi...

Arnavion 5y ago
Like I said, it's VPN tech under the hood. But just using VPN tech does not make you a VPN, no more than joining two bricks together with cement makes a house. You need to connect lots of bricks in the shape of a house before you can call it a house, and you need to connect machines into an actual private network before you can call it a VPN.
- askura 5y ago
  Absolutely. The misinformation in this space is risking yet another greater amount of lives now than it was before. It's OK for those of us in countries with freedoms afforded to us by democracy. It's a nightmare for those who aren't.

upbeat_general 5y ago

To be fair, many VPN services (incl mine) allow several of your devices to communicate when both connected to their network.

askura 5y ago
Windscribe have unlimited devices. I think a lot of VPNs know that it's a bullshit tactic to sell more accounts but can't turn that revenue down. They know first hand that people will share accounts rather than just purchase a new one but limiting devices takes that option away.

saurik 5y ago

I agree that "private" here is strange, but if you VPN into a private network which happens to have a gateway for the default route... well, that's what these services are; and the term "proxy" was pretty much always operating at a much higher layer of the OSI stack, and so when you say "proxy" the assumption is you are talking about an HTTP CONNECT or SOCKS solution, not something that can give you an IP address on a remote network. Like, yes: the use case is backwards, but the tech is the same and the other terms are wrong.

xcambar 5y ago
The average person has a better perception of VPN than it has of Proxy. No matter what the tech aspects behind the terms actually mean. It's marketing. Being technically (in)correct is irrelevant here.

tomerv 5y ago

How is that a scam? The customers - which are probably not extremely technologically savvy - know that they're buying a proxy, even if it's called something else. That's more of a linguistic drift than anything else. If there's a scam here (and there probably is...), this isn't it.