A virtual private network (VPN) lets a user remotely access a private network for privacy and security.
A virtual private network (VPN) is an Internet security service that allows users to access the Internet as though they were connected to a private network. This encrypts Internet communications as well as providing a substantial degree of anonymity. Some of the most common reasons people use VPNs are to protect against snooping on public WiFi, to circumvent Internet censorship, or to connect to a business’s internal network for remote work.
How does a VPN work?
Ordinarily, most Internet traffic is unencrypted and very public. When a user creates an Internet connection, such as visiting a website in a browser, their device will connect to their Internet Service Provider (ISP). Then the ISP will connect to the Internet to find the appropriate web server to communicate with to fetch the requested website.
Information about the user is exposed at every step of the website request. Since the user’s IP address is exposed throughout the process, the ISP and any other intermediary can keep logs of the user’s browsing habits. Additionally, the data flowing between the user’s device and the web server is unencrypted; this creates opportunities for malicious actors to spy on the data or perpetrate attacks on the user, such as a on-path attack.
Conversely, a user connecting to the Internet using a VPN service has higher security and privacy. A VPN connection involves the following four steps:
- The VPN client* connects to the ISP using an encrypted connection.
- The ISP connects the VPN client to the VPN server, maintaining the encrypted connection.
- The VPN server decrypts the data from the user’s device and then connects to the Internet to access the web server in an unencrypted communication.
- The VPN server creates an encrypted connection with the client, a ‘VPN tunnel’.
The VPN tunnel between the VPN client and the VPN server passes through the ISP, but since all the data is encrypted, the ISP cannot see the user’s activity. The VPN server’s communications with the Internet are unencrypted. Still, the web servers will only log the IP address of the VPN server, which gives them no information about the user.
*The VPN client is the VPN software installed on the user’s device.
Is a VPN only for people with something to hide?
As with other Internet privacy services, VPNs are sometimes categorized as tools for illegal or subversive activity. The truth is that there are a number of valid and legitimate reasons to use a VPN. Here are a few of the most common:
- Protection over public WiFi – Users who go on public WiFi networks without a VPN are putting themselves at risk. Their Internet traffic is unencrypted, and other users on the same network can monitor their activity using easily accessible tools. This is a common way for attackers to steal login credentials and additional sensitive information. If a user is connected through a VPN, a snooping attacker can only see encrypted data, which won’t reveal sensitive information.
- Remote work – Many businesses allow employees to work remotely using a VPN. This can allow remote employees to access the company’s internal network and provide encryption to protect the business from attackers or spying.
- Freedom from censorship in oppressive states – In some parts of the world, expressing or even reading views critical of the government is forbidden. Many of these states also provide their citizens with a suppressed version of the Internet that blocks significant domains. People accessing the Internet in these states can use a VPN to access content their state wants to be blocked and speak freely online since VPN encryption protects their activity from state surveillance.
- Location anonymity – Some web services will restrict or filter content based on the user’s location. A VPN can anonymize a user’s location and get around these restrictions.
- The right to online privacy – ISPs have been known to sell their users’ private data. Similarly, some websites will sell information about their visitors. The privacy offered by VPN services enables consumers to opt out of having their data harvested.
What are the downsides of a VPN?
A VPN service does not guarantee increased security; users can only feel secure if they trust the VPN provider. A dishonest VPN provider could sell users’ information or open them to attacks. It is also worth noting that most VPN services come at a recurring monthly cost. Some VPN users may also experience issues with performance.
How does a VPN affect performance?
Some users will experience performance degradation from a VPN, which depends mainly on which VPN service they use. Not all VPNs are created equal, and if a VPN service does not have the server capacity to handle the load their users create, those users will experience a slowdown in their Internet connection. Additionally, the resulting travel time can create latency if a VPN is far from the user and the web server they are trying to access. For example, suppose a user in San Francisco is accessing a website whose servers are also in San Francisco, but that user’s VPN service is located in Tokyo. In that case, the user’s request must travel halfway around the world and back before connecting to a server just a few miles away. This is sometimes called the trombone effect.
