Who Owns Express Vpn, Nord, Surfshark? VPN Relationships Explained (2024)

So am I right in saying that the data that's encrypted by VPNS is only in transit? It then sits on a server in plain text, ready to be queried by third parties for money.

I'm more interested in this part - how does that work? Do you just reach out to them directly and ask "hey, let me buy your user data"? Or is there some sort of service they offer?

People love to stick to what they irrationally believe in. I would give you push back as well by saying 95% is a very conservative number. I would say 98-99%

But hey, they say they don't sell my data isn't it?

How does this work? They harvest your DNS! They inject surveys into your YouTube packets. They tabulate just how much traffic goes to which specific games on Twitch. How? The provider is the endpoint, not you.

It's not the whole picture, but it's enough to sell to marketers.

This is what happens EVERY time I say this! Look again! It happened, I have 1 upvote... It's almost as if the VPN companies don't want you to believe this is true!

Story time! I have been cashed out of three startups. $600 total, across them all. It's the people in the Valley who've struck out over and over who know the truth, not the successes.

One of those startups was about tracking the games played on Twitch, and selling that info to Esports entities, marketing firms, etc. The company did not succeed because, honestly, it's not hard data to scrape yourself. BUT, we tried. And where did we get our data? VPN providers. Major VPN providers. We don't care about your personal data. We care about whether you watched a Twitch stream of GTA or Madden.

And for a time, yes, we could buy injected surveys. Packets, literally injected into your streams of data. This was expensive, iffy, and controversial, but it was on the rate cards.

DNS is very useful, and unencrypted. OpenDNS makes its money on this same info. Stop putting your heads in the sand. Ya'll have seriously lost the path.

This is believable.

> It's where they make their money.

I'm much more skeptical of this. I know linus tech tips is not exactly an expert organization, but I believe the discussions they've had about almost starting a VPN and backing out for ethical reasons, and they made it clear that the core VPN product would have huge profit margins. You can always do greedy things to make more money, but for a paid VPN I'd need some solid evidence to believe that data sales are a huge line item or especially that they're the main source of money.

If you're including the swaths of free VPNs then that makes your number a lot harder to use.

In your later comment you said "DNS is very useful, and unencrypted. OpenDNS makes its money on this same info." Is the VPN company only openly selling DNS info or are they selling more, such as connection logs?

How did you approach the VPN provider to ask to buy this info?

How did they make money? Easy: there were also selling a botnet! So if you used their "free VPN", you could be part of a botnet for DDOS or to create fake reviews/upvotes from thousands of "legit" IP addresses.

Nowadays most traffic is tls encrypted, but there are still metadata that can be collected.

And yes, I'm aware that you're most likely trading one surveilence for another - but honestly at this point I'd much rather trust my paid VPN provider with my browsing data than my ISP and ultimately the government.

a) your ISP (who knows your billing information) knowing which sites you visit, and any site you visit can correlate internet activity back to your household

b) your VPN provider knowing all the sites you visit

This happened to discord literally a few days ago.

I use VPNs when I'm trying to ferret out the scope of an outage. I have VPN servers on local ISP which moves me around different routing. I use a commercial service to move me further out and to other countries.

I don't just mean being able to access some private web interface you have on a private server in your at home, I mean connecting a satellite office to the main corporate office.

But for all of these consumer marketed VPNs, I think your list has 90%+ covered...

That's one of the best reasons to use a VPN if you're in Australia. Give up as little as possible.

I have found, however, lots of sites block or Captcha-restrict IP addresses that are (somehow determined as) non-residential, and Netflix restricts its content as well.

Recently a SaaS supplier blocked my IP because I was logging in programmatically every thirty seconds to collect data on batch processing in a customer project, basically two HTTP requests to get an access key and then the data, and I was lazy so I just put those in a script and dumped the second response to a log file and put that in a scheduler. Turned out that another customer of the SaaS supplier somehow could see the traffic on my customer's SaaS instance and panicked because in their mind it was obviously the russians attacking or something, and when they brought this to the supplier they also panicked.

So to keep doing this I had to move over to checking whether the previous access key was still valid and reuse it if so, as well as moving my 'location' to another country. Apparently this is fine but logging in two times a minute is not. It also happens that I need to do research on network services and cloud environments, where having the ability to just hit a couple of terminal incantations to switch 'where' I am helps out quite a bit sometimes.

If you live in a country that restricts your internet access, which to be fair is most these days, a VPN can help. Most of us just don't care about those restrictions or they are more easily circumvented using a 3rd. party DNS. Also if you're in country like Iran or Russia, you really need to trust your VPN provider and strange corporate structures and staff sharing really isn't helping in that respect.

For the average person, no you don't need a VPN. You might need one for a few days or week per year, if you travel and need to access your bank or corporate infrastructure (in that case your employer most likely have their own VPN). VPNs are a niche business, but online influencers have convinced a lot of people that they need a VPN for everything, which simply isn't the case for the vast majority of us.

4. Though it hurts anonymity, and is relatively rare: I2P or Hyphanet, because some websites block known P2P nodes[1]. Important if your bank or work is being a jerk about it.

5. As ThatMedicIsASpy notes, ISP issues: some routers soil the bed from P2P, some ISP's throttle P2P traffic regardless of legality, etc.

[1] https://old.reddit.com/r/i2p/comments/tc3bhs/is_anybody_else...

VPNs don't increase privacy, they just change who has the opportunity to spy on your traffic. Sometimes, it's much better if it's some foreign random ISP instead of your local government, who can send law enforcement agents where you live.

4. Perform DDoS

5. brute force passwords

6. try out leaked passwords

7. exploit vulns.

8. CSAM

9. Phish

10. Spam

11. Evade taxes with crypto

12. Sell drugs

13. Terrorism

Lots of malicious uses for VPNs, or was your question about legitimate usecases? In which case:

14. Sending emails about cryptography

15. Pornography

16. activism

17. Journalism/Whistleblowing

18. Military

Although some of the legitimate/ilegitimate categories might be subjective, which is precisely why it's a grey legal area at all.

1) I need to come out of a particular country for some systems access. If I'm travelling it's easier than having IT team change permissions.

2) I use dedicated IPs for some systems.

3) Testing websites where I want to appear local to a particular country.