Do I need a VPN?

Probably not, but it doesn't hurt to have one. I do, and I use it when I'm out of the house, especially on public WiFi.

NordVPN

Highly recommended.

Get it now

If you've spent any time on the internet, especially watching YouTube, you’ll have seen adverts for a VPN, or ‘Virtual Private Network’. They promise to keep you safe online, protecting you from spammers, scammers, hackers and trackers, but is it all too good to be true?

Yes and no, frankly. At its heart a VPN does one thing — encrypt the traffic leaving your computer, and decrypt it again somewhere on the internet. From there it continues on its way to the website or service you want to connect to.

In the early days of the internet, almost nothing was encrypted. Anyone sharing the same network as you (or anyone sitting in between you and the site you were reading) could see everything you did, watch all the data flowing back and forth, and even change it as it passed. For example, if you were in a coffee shop, everyone else there would in theory be able to read your Facebook feed, if they knew how. There used to be a neat little application that replaced every image on Facebook with a picture of a sheep (or something less savoury, depending on the mood of the person running it). More nefariously, they could also steal usernames and passwords, eavesdrop on banking transactions or see which medical symptoms you were searching for information about.

It’s that Wild-West era that sparked the need for an encrypted path to the destination. Companies were the first to adopt VPNs, so staff working remotely could access company information without leaking it to anyone in the area. In parallel, more and more websites began deploying HTTPS (the little padlock you used to see in the top corner of the browser) which meant that everything they sent back and forth was hidden from view. No more sheep pictures!

So with HTTPS covering around 75% of the web these days, you don’t need a VPN any more, right?

Maybe. While everything you do on Facebook is encrypted now, people can still see that you’ve been there. The coffee shop, anyone else nearby or your own ISP at home can see your requests and work out where you’ve gone, even though they can’t see what you did there. There’s still the potential for some sensitive information to get leaked… Imagine your employer knowing you’re browsing employment sites, anyone in the doctor’s waiting room knowing you’re visiting the support forum for a specific disease, or so on. A VPN will still hide that information.

So you do need one?

Maybe. All it does is shift the trust somewhere else. You might trust your employer not to track your lunchtime browsing (but they probably do) or your ISP not to sell your web history to the highest bidder (though many do) but many people don’t. If you install a VPN then you’re now asking the VPN not to track you, sell your data, or spy on you.

For most people, that’s fair enough. We’re not under constant surveillance, government agencies aren’t trying to read your email, and the small risk of trusting a third party is worth it to keep your job-seeking private.

But pick your VPN carefully. Free ones have to make money somewhere… and there’s still some truth to the saying that “if you’re not paying for it, you’re the product.” Reputable ones are cheap (including NordVPN, the one I use) and promise not to log any data. They even back that with regular audits. 

But some do oversell their capabilities. In the next article we’ll look at some of the claims made by some unnamed VPN services, and break them down.