54 ms·

NordVPN Review

76 points by trailsandwich 4y ago

asimpleusecase 4y ago
This would be a lot more helpful if they would say exactly what the problem is. “Shady” partner? Who is that? Transparency report - what is expected here? I work with people who rely on VPNs for personal safety, so I’m very interested in anything that can compromise that safety. But this article raised questions but did not answer them in a way I found useful.
- fyvhbhn 4y ago
  NordVPN does shady advertising: https://news.ycombinator.com/item?id=31896120 https://news.ycombinator.com/item?id=31896120
- dzhiurgis 4y ago
  NordVPN is ran by same company that supplies residential proxies. The way it worked is by using using their service you'd actually reciprocally share your IP. Thats dodgy on multiple levels.
  - PaywallBuster 4y ago
    or a feature Traffic coming from your IP would be mixed up with unrelated traffic
    - marginalia_nu 4y ago
      > Traffic coming from your IP would be mixed up with unrelated traffic I'm sure that notion will keep the FBI from raiding your home when that unrelated traffic turns out to be involved in something illicit.
      - lysp 4y ago
        ..RIAA
        marginalia_nu 4y ago
        There are far worse things one can do anonymously over someone's internet connection than download an mp3.
      - sshine 4y ago
        It sounds more likely that the FBI knows you're using NordVPN before they come busting.
  - meroje 4y ago
    How else do you expect to get around maxmind’s anonymous db?
- encryptluks2 4y ago
  I for one do not like their requirement to use a closed source VPN client just to have Wireguard support. I ditched them after trying out Mullvad and am so thankful I did. You'd have to contact chat to do basic things like change your email address. Mullvad doesn't even know my email address.
- trailsandwich 4y ago
  As the article has spelled out, Nord’s operations in many parts of the world, thanks to their convoluted and opaque corporate structure, makes it hard to determine which user data may be accessed by which countries' government entities or third-party companies. Being owned by a data mining company that also owns a residential proxy service (Nord uses it for unblocking streaming services: https://hiddenrouter.com/how-is-nordvpn-unblocking-disney-it-is-likely-using-your-own-ip-for-that-so-be-careful/ https://hiddenrouter.com/how-is-nordvpn-unblocking-disney-it...) is also baffling. Hard to trust a data mining company with data, when they make a profit from selling user data? Other VPN providers like PIA have released transparency reports that contain requests from state, federal, and foreign law enforcement: https://www.privateinternetaccess.com/blog/private-internet-access-releases-updated-transparency-report-in-q1-2022/ https://www.privateinternetaccess.com/blog/private-internet-... Nord’s own employee said they don’t want to publish transparency reports out of “obligations” to their investors.
mintythoughts 4y ago
Quotes like “ At the same time, we have some obligations for our investors as well -- you know, to not look like a shady company who gets lots of different requests from the FBI, et cetera” make me think the journalist probably took some liberties with a conversation the guy didn’t realise was on the record
bkq 4y ago
When it comes to VPN providers you're essentially moving your traffic from your ISP to the provider itself, so it's not entirely private. If you want to be absolutely sure that no logs are kept, then you're best off running your own VPN somewhere, so you remain completely in control.
- bertman 4y ago
  >somewhere You mean on a VPS that you also rented from someone else, therefore essentially moving your traffic from your ISP to...?
  - homeland221 4y ago
    I think he meant more control of the traffic by making sure personally it won't log anything. That is high technical skillset out of reach for most users. And if you do even set that up, you will waste a lot of time maintaining. The time lost need to get compensated as he will need to pay bills...and hence he himself quit his day job and become NordVPN. Again, not many users willing to go thru that.
    - Last5Digits 4y ago
      But can you really do that? In the end, you still use the network architecture of the VPS provider. What's preventing them from logging traffic outside of your VPS? You also don't get the benefit of your traffic getting mixed together under the same address, since VPS providers will assign you an individual address.
    - mintythoughts 4y ago
  - doix 4y ago
    Everything is a trade-off, at some point you need to trust someone. I've got a box with OVH that I use as a VPN with wireguard. I just assume that OVH aren't logging all my traffic because it would cost them money and cut into their margins. I would never do anything illegal via that VPN though, since it would be trivial to trace it back to me. I'm sure OVH wouldn't hesitate to hand over my details if the authorities requested them. But as a privacy protection on public wifi, it works well. When choosing a VPN, you should think about what you're trying to achieve and what you're trying to protect yourself from. Most non-tech people I know that use VPNs, use them to bypass geo-restrictions. For that purpose, these giant commercial ones are probably fine.
dzhiurgis 4y ago
There's tons of rumours around Vilnius tech scene about how Tesonet works. Namely they hire younger devs, give little remote work opportunities and generally push them a lot (kinda fair). I've also heard their engineers say "there are still ways around" to get proxies which to me just sounds like they are simply hacking residential routers. Finally, they keep providing service to a Russian market.
_l4jh 4y ago
>is a great option for casual VPN users who just want to unblock content Honestly that is all you should ever use these VPN services for. Convenient access to blocked content (or flip to a different region to access alternative content). Sure your own VPS running WireGuard or OpenVPN is better but that isn't as easy as just picking a different country on a pretty map in an app to get access to a show on BBC iPlayer or Netflix a second later. Nord, Express, etc. are close to worthless from a privacy aspect but they're very convenient for watching blocked content and that is all anyone should use them for. If you want/need privacy because you're on a network you don't trust (hotel, airport, whatever) then your own VPS and WireGuard are what you should be looking into. If you trust you home ISP and have decent bandwidth (both ways) you can easily run your own WireGuard server on pretty much anything from home and just connect into that so cost is pretty much zero.
- SahAssar 4y ago
  With american ISPs (specially mobile ones) moving more into tracking and advertising I think you can still get a privacy boost from using a reputable VPN. If you want to access things that are banned or illegal in your country (either for free-speech or piracy reasons) using a VPN will definitely help with that too. I'm definetly aware that I'm just moving trust from my ISP to the VPN, but most ISPs do not even consider privacy as a selling-point or a feature, while a reputable VPN often will. So far I haven't seen anything about mullvad that makes me doubt them.
  - maven29 4y ago
    I'd say that cloud service providers serving billion dollar contracts definitely have much more at stake with regards to confidentiality. This is in contrast to whatever unaccountable colocation provider and residential IP botnet swarm a typical consumer VPN provider would rely on. AWS Lightsail costs the same as a consumer VPN service while also giving you always-on compute and storage for sync and long-running jobs.
    - weberer 4y ago
      Let's say some Hollywood lawyer finds the IP address of your Amazon VPN in the list of seeders for some big movie torrent. They send a threatening legal letter to Amazon. Will Amazon forward them your contact information? Will they lock your AWS account?
icare_1er 4y ago
- IanCal 4y ago
  I don't understand how those things are related.
  - sph 4y ago
    Some people just see partisan politics everywhere, even in toasted bread.
  - icare_1er 4y ago
    This is very simple: if you believe VPN is a safety for protecting your privacy and your data, you don't want to put all of that in the hands of someone who will submit not to governments; not to a tribunal... but to a mere Twitter account with 95 followers.
    - mintythoughts 4y ago
      lol the people making the marketing decisions probably aren’t the people making decisions about legal data requests
      - icare_1er 4y ago
        "probably" Or probably not. As far as I am concerned, I judge a company as a block, any of its employees/teams/departments speaks for the whole company, end of the story. And for the topic we're discussing, the company easily caves in and is weak so I am not going to rely on them for anything related to privacy or safeguarding data.
    - IanCal 4y ago
      Privacy and where someone advertises are dramatically different things. If they'd handed over data to those twitter accounts I'd agree with you. This kind of thing I think pushes the needle the other way. It shows a company extremely concerned about their image, when their core argument is about trust and privacy.
overlisted 4y ago
All VPNs are shady, unless you self-host your own one. And if you're looking traffic privacy, Tor is pretty much the only effective option.
Namari 4y ago
What's the best alternative for privacy? I need to change some stuff on my bank accounts in another country and I can't just go there so I need to use it once or twice just for that.
kioshix 4y ago
In my opinion, the most shady thing about NordVPN is their marketing. There is ALWAYS a "great discount" of about 70% off, and it expires in 9 hours and 39 minutes. Always. I am a NordVPN customer, but not for privacy, only for access to content in different regions.
- bearmode 4y ago
  It's the same thing most consumer VPNs do. That 70% off discount will basically always be for a 2+ year plan as well. It's one of the main reasons I like Mullvad. One price, month-to-month, no 'discount' for paying for multiple years at a time, no shady sales tactics.
epups 4y ago
I don't know of any other VPN company that has a no-log policy and has been audited to prove that. If anybody else has a recommendation that meets these conditions, I'd be glad to hear it.
- cloutchaser 4y ago
  https://proprivacy.com/privacy-news/expressvpn-cannot-hand-over-logs https://proprivacy.com/privacy-news/expressvpn-cannot-hand-o...
- Liquidity 4y ago
  ProtonVpn had their no logs policy audited. Source: https://protonvpn.com/blog/no-logs-audit/ https://protonvpn.com/blog/no-logs-audit/
- causi 4y ago
  Several VPNs have given no information to courts after being subpoenaed, including ExpressVPN and Private Internet Access.
  - epups 4y ago
    I used PIA before, and I left after I learned that they were sold to a dodgy guy whose previous company installed malware. The situation with NordVPN seems confusing, but no major red flag such as that one. I would not recommend PIA anymore.
- capableweb 4y ago
  Similarly to the others who replied to you, Mullvad have had audits done to "prove it" (but even so, they can change infrastructure from the audit easily). Their last audit was published in June 22, 2022: https://mullvad.net/en/blog/2022/6/22/vpn-server-audit-found-no-information-leakage-or-logging-of-customer-data/ https://mullvad.net/en/blog/2022/6/22/vpn-server-audit-found...
ageitgey 4y ago
NordVPN is a surprisingly slick product for casual users. I use it to access websites for work that block foreign users. The Mac and Android apps are well done and remove the friction of using a VPN. It's not like the old days of fly-by-night VPNs you have to configure yourself. But as useful as it might be for casual users, I think you'd be crazy to trust a large commercial VPN service to anonymize yourself if you are worried about being tracked by a nation-state actor or hiding serious crimes or something like that. No large business is going to protect you if they get sufficient pressure from a government that threatens their existence.
TimButterfield 4y ago
I am a NordVPN subscriber. I have found some 'location' issues while using their software. Using something like iplocation.net will show the correct location. However, one of my clients uses search.arin.net as part of their security, which then flags the location as 'out of country'. This is because arin uses the whois location instead of the physical location. In this case, it came back as Panama instead of USA. The client had to baseline my connection to avoid it continually raising that error. Connecting through my dedicated IP address always does that. Connecting through another IP address might or might not.
SAI_Peregrinus 4y ago
These "VPN" services should be called Virtual ISPs (VISP services). They're not a VPN in the classic sense of extending a private IP address space (like 10.0.0.0/8) over the internet. They can do anything a physical ISP can do with your traffic. If you trust the VISP service to protect your privacy more than your physical ISP, they might be useful for privacy. Otherwise they're harmful to privacy, and only useful for getting around region locks.
- bearmode 4y ago
  Hm, do I trust a company whose entire reputation is staked on keeping my data private, and who've been audited numerous times, as well as tested in court? Or do I test my ISP, who absolutely doesn't care about my privacy and would give up my data at a moment's notice? As long as you've researched your VPN provider, there's almost no reason to trust your ISP over them.
tiffanyh 4y ago
Just curious, if you're on macOS/iOS - is there a benefit to using a 3rd party VPN vs just using iCloud Private Relay?
controversial97 4y ago
I have been reliably informed by someone who has spent too much time building up credit on private torrent sites that downloading torrents is often slow through NordVPN. Also, NordVPN does not support incoming connections to a listening port, so commonly can't download from two thirds of the seeds on a torrent. It is not unusual for there to be one to five seeders on a torrent, none with a port open for incoming connections, so people behind many commercial VPN's can't download the torrent. There are other VPNs that support incoming connections, such as Mullvad, which are much more effective for torrents, if the users makes the effort to configure it.
taldo 4y ago
These days I use Tailscale + any random VPS I can rent for a while in the region I'm interested (usually DO, sometimes others). The setup is easy (for me): create VPS, install tailscale, cut+paste the setup command, done. Then in the Tailscale app just pick your new exit node, all done.
alam2000 4y ago

76 points by trailsandwich 4y ago

This would be a lot more helpful if they would say exactly what the problem is. “Shady” partner? Who is that? Transparency report - what is expected here? I work with people who rely on VPNs for personal safety, so I’m very interested in anything that can compromise that safety. But this article raised questions but did not answer them in a way I found useful.

fyvhbhn 4y ago
NordVPN does shady advertising: https://news.ycombinator.com/item?id=31896120 https://news.ycombinator.com/item?id=31896120
dzhiurgis 4y ago
NordVPN is ran by same company that supplies residential proxies. The way it worked is by using using their service you'd actually reciprocally share your IP. Thats dodgy on multiple levels.
- PaywallBuster 4y ago
  or a feature Traffic coming from your IP would be mixed up with unrelated traffic
  - marginalia_nu 4y ago
    > Traffic coming from your IP would be mixed up with unrelated traffic I'm sure that notion will keep the FBI from raiding your home when that unrelated traffic turns out to be involved in something illicit.
    - lysp 4y ago
      ..RIAA
      - marginalia_nu 4y ago
        There are far worse things one can do anonymously over someone's internet connection than download an mp3.
    - sshine 4y ago
      It sounds more likely that the FBI knows you're using NordVPN before they come busting.
- meroje 4y ago
  How else do you expect to get around maxmind’s anonymous db?
encryptluks2 4y ago
I for one do not like their requirement to use a closed source VPN client just to have Wireguard support. I ditched them after trying out Mullvad and am so thankful I did. You'd have to contact chat to do basic things like change your email address. Mullvad doesn't even know my email address.
trailsandwich 4y ago
As the article has spelled out, Nord’s operations in many parts of the world, thanks to their convoluted and opaque corporate structure, makes it hard to determine which user data may be accessed by which countries' government entities or third-party companies. Being owned by a data mining company that also owns a residential proxy service (Nord uses it for unblocking streaming services: https://hiddenrouter.com/how-is-nordvpn-unblocking-disney-it-is-likely-using-your-own-ip-for-that-so-be-careful/ https://hiddenrouter.com/how-is-nordvpn-unblocking-disney-it...) is also baffling. Hard to trust a data mining company with data, when they make a profit from selling user data? Other VPN providers like PIA have released transparency reports that contain requests from state, federal, and foreign law enforcement: https://www.privateinternetaccess.com/blog/private-internet-access-releases-updated-transparency-report-in-q1-2022/ https://www.privateinternetaccess.com/blog/private-internet-... Nord’s own employee said they don’t want to publish transparency reports out of “obligations” to their investors.

mintythoughts 4y ago

Quotes like “ At the same time, we have some obligations for our investors as well -- you know, to not look like a shady company who gets lots of different requests from the FBI, et cetera” make me think the journalist probably took some liberties with a conversation the guy didn’t realise was on the record

bkq 4y ago

When it comes to VPN providers you're essentially moving your traffic from your ISP to the provider itself, so it's not entirely private. If you want to be absolutely sure that no logs are kept, then you're best off running your own VPN somewhere, so you remain completely in control.

bertman 4y ago
>somewhere You mean on a VPS that you also rented from someone else, therefore essentially moving your traffic from your ISP to...?
- homeland221 4y ago
  I think he meant more control of the traffic by making sure personally it won't log anything. That is high technical skillset out of reach for most users. And if you do even set that up, you will waste a lot of time maintaining. The time lost need to get compensated as he will need to pay bills...and hence he himself quit his day job and become NordVPN. Again, not many users willing to go thru that.
  - Last5Digits 4y ago
    But can you really do that? In the end, you still use the network architecture of the VPS provider. What's preventing them from logging traffic outside of your VPS? You also don't get the benefit of your traffic getting mixed together under the same address, since VPS providers will assign you an individual address.
  - mintythoughts 4y ago
- doix 4y ago
  Everything is a trade-off, at some point you need to trust someone. I've got a box with OVH that I use as a VPN with wireguard. I just assume that OVH aren't logging all my traffic because it would cost them money and cut into their margins. I would never do anything illegal via that VPN though, since it would be trivial to trace it back to me. I'm sure OVH wouldn't hesitate to hand over my details if the authorities requested them. But as a privacy protection on public wifi, it works well. When choosing a VPN, you should think about what you're trying to achieve and what you're trying to protect yourself from. Most non-tech people I know that use VPNs, use them to bypass geo-restrictions. For that purpose, these giant commercial ones are probably fine.

dzhiurgis 4y ago

There's tons of rumours around Vilnius tech scene about how Tesonet works. Namely they hire younger devs, give little remote work opportunities and generally push them a lot (kinda fair). I've also heard their engineers say "there are still ways around" to get proxies which to me just sounds like they are simply hacking residential routers. Finally, they keep providing service to a Russian market.

_l4jh 4y ago

>is a great option for casual VPN users who just want to unblock content Honestly that is all you should ever use these VPN services for. Convenient access to blocked content (or flip to a different region to access alternative content). Sure your own VPS running WireGuard or OpenVPN is better but that isn't as easy as just picking a different country on a pretty map in an app to get access to a show on BBC iPlayer or Netflix a second later. Nord, Express, etc. are close to worthless from a privacy aspect but they're very convenient for watching blocked content and that is all anyone should use them for. If you want/need privacy because you're on a network you don't trust (hotel, airport, whatever) then your own VPS and WireGuard are what you should be looking into. If you trust you home ISP and have decent bandwidth (both ways) you can easily run your own WireGuard server on pretty much anything from home and just connect into that so cost is pretty much zero.

SahAssar 4y ago
With american ISPs (specially mobile ones) moving more into tracking and advertising I think you can still get a privacy boost from using a reputable VPN. If you want to access things that are banned or illegal in your country (either for free-speech or piracy reasons) using a VPN will definitely help with that too. I'm definetly aware that I'm just moving trust from my ISP to the VPN, but most ISPs do not even consider privacy as a selling-point or a feature, while a reputable VPN often will. So far I haven't seen anything about mullvad that makes me doubt them.
- maven29 4y ago
  I'd say that cloud service providers serving billion dollar contracts definitely have much more at stake with regards to confidentiality. This is in contrast to whatever unaccountable colocation provider and residential IP botnet swarm a typical consumer VPN provider would rely on. AWS Lightsail costs the same as a consumer VPN service while also giving you always-on compute and storage for sync and long-running jobs.
  - weberer 4y ago
    Let's say some Hollywood lawyer finds the IP address of your Amazon VPN in the list of seeders for some big movie torrent. They send a threatening legal letter to Amazon. Will Amazon forward them your contact information? Will they lock your AWS account?

icare_1er 4y ago

IanCal 4y ago
I don't understand how those things are related.
- sph 4y ago
  Some people just see partisan politics everywhere, even in toasted bread.
- icare_1er 4y ago
  This is very simple: if you believe VPN is a safety for protecting your privacy and your data, you don't want to put all of that in the hands of someone who will submit not to governments; not to a tribunal... but to a mere Twitter account with 95 followers.
  - mintythoughts 4y ago
    lol the people making the marketing decisions probably aren’t the people making decisions about legal data requests
    - icare_1er 4y ago
      "probably" Or probably not. As far as I am concerned, I judge a company as a block, any of its employees/teams/departments speaks for the whole company, end of the story. And for the topic we're discussing, the company easily caves in and is weak so I am not going to rely on them for anything related to privacy or safeguarding data.
  - IanCal 4y ago
    Privacy and where someone advertises are dramatically different things. If they'd handed over data to those twitter accounts I'd agree with you. This kind of thing I think pushes the needle the other way. It shows a company extremely concerned about their image, when their core argument is about trust and privacy.

overlisted 4y ago

All VPNs are shady, unless you self-host your own one. And if you're looking traffic privacy, Tor is pretty much the only effective option.

Namari 4y ago

What's the best alternative for privacy? I need to change some stuff on my bank accounts in another country and I can't just go there so I need to use it once or twice just for that.

kioshix 4y ago

In my opinion, the most shady thing about NordVPN is their marketing. There is ALWAYS a "great discount" of about 70% off, and it expires in 9 hours and 39 minutes. Always. I am a NordVPN customer, but not for privacy, only for access to content in different regions.

bearmode 4y ago
It's the same thing most consumer VPNs do. That 70% off discount will basically always be for a 2+ year plan as well. It's one of the main reasons I like Mullvad. One price, month-to-month, no 'discount' for paying for multiple years at a time, no shady sales tactics.

epups 4y ago

I don't know of any other VPN company that has a no-log policy and has been audited to prove that. If anybody else has a recommendation that meets these conditions, I'd be glad to hear it.

cloutchaser 4y ago
https://proprivacy.com/privacy-news/expressvpn-cannot-hand-over-logs https://proprivacy.com/privacy-news/expressvpn-cannot-hand-o...
Liquidity 4y ago
ProtonVpn had their no logs policy audited. Source: https://protonvpn.com/blog/no-logs-audit/ https://protonvpn.com/blog/no-logs-audit/
causi 4y ago
Several VPNs have given no information to courts after being subpoenaed, including ExpressVPN and Private Internet Access.
- epups 4y ago
  I used PIA before, and I left after I learned that they were sold to a dodgy guy whose previous company installed malware. The situation with NordVPN seems confusing, but no major red flag such as that one. I would not recommend PIA anymore.
capableweb 4y ago
Similarly to the others who replied to you, Mullvad have had audits done to "prove it" (but even so, they can change infrastructure from the audit easily). Their last audit was published in June 22, 2022: https://mullvad.net/en/blog/2022/6/22/vpn-server-audit-found-no-information-leakage-or-logging-of-customer-data/ https://mullvad.net/en/blog/2022/6/22/vpn-server-audit-found...

ageitgey 4y ago

NordVPN is a surprisingly slick product for casual users. I use it to access websites for work that block foreign users. The Mac and Android apps are well done and remove the friction of using a VPN. It's not like the old days of fly-by-night VPNs you have to configure yourself. But as useful as it might be for casual users, I think you'd be crazy to trust a large commercial VPN service to anonymize yourself if you are worried about being tracked by a nation-state actor or hiding serious crimes or something like that. No large business is going to protect you if they get sufficient pressure from a government that threatens their existence.

TimButterfield 4y ago

I am a NordVPN subscriber. I have found some 'location' issues while using their software. Using something like iplocation.net will show the correct location. However, one of my clients uses search.arin.net as part of their security, which then flags the location as 'out of country'. This is because arin uses the whois location instead of the physical location. In this case, it came back as Panama instead of USA. The client had to baseline my connection to avoid it continually raising that error. Connecting through my dedicated IP address always does that. Connecting through another IP address might or might not.

SAI_Peregrinus 4y ago

These "VPN" services should be called Virtual ISPs (VISP services). They're not a VPN in the classic sense of extending a private IP address space (like 10.0.0.0/8) over the internet. They can do anything a physical ISP can do with your traffic. If you trust the VISP service to protect your privacy more than your physical ISP, they might be useful for privacy. Otherwise they're harmful to privacy, and only useful for getting around region locks.

bearmode 4y ago
Hm, do I trust a company whose entire reputation is staked on keeping my data private, and who've been audited numerous times, as well as tested in court? Or do I test my ISP, who absolutely doesn't care about my privacy and would give up my data at a moment's notice? As long as you've researched your VPN provider, there's almost no reason to trust your ISP over them.

tiffanyh 4y ago

Just curious, if you're on macOS/iOS - is there a benefit to using a 3rd party VPN vs just using iCloud Private Relay?

controversial97 4y ago

I have been reliably informed by someone who has spent too much time building up credit on private torrent sites that downloading torrents is often slow through NordVPN. Also, NordVPN does not support incoming connections to a listening port, so commonly can't download from two thirds of the seeds on a torrent. It is not unusual for there to be one to five seeders on a torrent, none with a port open for incoming connections, so people behind many commercial VPN's can't download the torrent. There are other VPNs that support incoming connections, such as Mullvad, which are much more effective for torrents, if the users makes the effort to configure it.

taldo 4y ago

These days I use Tailscale + any random VPS I can rent for a while in the region I'm interested (usually DO, sometimes others). The setup is easy (for me): create VPS, install tailscale, cut+paste the setup command, done. Then in the Tailscale app just pick your new exit node, all done.

alam2000 4y ago