Every podcast I listen to tells me my provider is selling my browsing and that a VPN fixes it. I work from home on my own connection, bank on my phone over mobile data, and travel maybe twice a year. Money is not really the issue, GBP 50 a year would be fine, I just cannot work out what problem I would be solving. What does it actually change for someone in that situation?
Public wifi is dangerous and a VPN is the only thing standing between you and someone on the same network reading your banking login. I would not sit in a cafe without one.
This was true around 2010 and it has been steadily less true since. Browsers now refuse plain HTTP by default on most sites, banking apps pin certificates, and the coffee-shop packet-sniffing attack that everyone still describes needs the site to be unencrypted to work. There are real reasons to use a VPN on a hostile network, mostly around hiding which services you use and dodging captive-portal nonsense, but reading your bank password out of the air is not one of them any more.
Fair correction, and I will stop repeating the version I learned. The metadata argument still lands for me though.
A VPN moves who can see your traffic metadata from your internet provider to your VPN provider. That is the whole product. It is a good trade if you distrust your provider more than the VPN company, which is a real situation in some countries and on some networks, and a pointless one if you do not. For your description, the honest answer is that it solves almost nothing you currently have, and if you buy one anyway the useful framing is that you are renting an IP address in another country, not buying safety.
"Renting an IP address in another country" is the clearest one-line description of the product I have seen, and it survives contact with every marketing page.
The two situations where I actually reach for mine are hotel networks that block half of what I need, and getting at services from home while abroad. For twice-a-year travel you can buy a month, use it, and stop, which is why I stayed on a provider with flat monthly pricing rather than a three-year prepay. Do not buy the multi-year deal for a use case you have not confirmed yet; that is the entire business model.
Spend the GBP 50 on a password manager subscription and a hardware key instead. Both of those measurably reduce the odds of the thing that actually happens to normal people, which is credential reuse and phishing, and neither requires you to trust a company with all of your traffic.
If you do get one, care about the payment and account model as much as the encryption. Mullvad has been flat EUR 5 a month for years with no tiers, no email address required, and no free trial, which tells you they are not funding it on upsells. They also dropped port forwarding in 2023, which annoyed a lot of long-time users, so check that your use case does not depend on it before you sign up.
@flakey_test · 2mo ago
Worth remembering that almost everything you touch is already encrypted in transit. Your provider can see which sites you connect to, and depending on how your device resolves names it may see the lookups too, but not the contents of your bank session. The sponsor reads deliberately blur that distinction because "they can see which sites you visit" sells worse than "hackers are stealing your passwords".
Reply
Report