Broken Promises: Who's Accountable When VPNs Fail?
summary
Systematic research over five years tests over a thousand users, nine VPN providers and hundreds of desktop and mobile apps and finds concrete failures: kill switches leak real IPs during tunnel failures, DNS queries escape tunnels, apps transmit cleartext, deliver OpenVPN configs unencrypted and exfiltrate advertising IDs. A simple mobile test framework called Immobilizer and a VPN App Analyzer reveal that 88% of top free VPNs had at least one issue and 290 apps account for 2.2 billion installs. Recommendations: app-store prepublish audits, ongoing monitoring, and revocation for proven violators.
AI-written summary · about
chapters (11)
- 0:00VPN accountability challenges
- 2:28VPN adoption surge
- 4:17VPN vulnerabilities research
- 6:27Mobile VPN security failures
- 7:54Users cannot fix VPN alone
- 10:03Journalism limits on VPN change
- 11:50Regulatory actions on VPNs
- 12:52App Stores leverage for change
- 15:20Stricter VPN app store policies
- 17:28Call to action for researchers
- 19:13Q&A
related talks
43mSecure, Free VPN — Are You Sure?
31mPrivacy and Transparency in VPN industry
38mTunnelCrack: Leaking VPN Traffic by Manipulating Routing Tables
39mMobile App Security
52mWhere, how, and why is SSL traffic on mobile getting intercepted?
36mKeynote – James Vasile
48mMobile Security Attacks: A Glimpse from the Trenches
31mGetting the Security and Flexibility Balance Right in a COVID-19 World