Ian Posner demystifies the digital maze!

Watch enough YouTube videos and you’ll be bombarded by promotions for VPNs. But what exactly is a VPN, what are its constituent parts and do you need one? In this article I break down what a VPN offers, benefits and downsides so you can make an informed decision about whether you need one.

Zuzu, CC BY-SA 3.0 <https://creativecommons.org/licenses/by-sa/3.0>, via Wikimedia Commons

Understanding Transferring Data Over the Internet

In order to understand what a VPN offers, it’s essential to understand the process by which data is transferred over the internet and what information can be tracked at each stage and by whom:

DNS Lookup

When you first make a request to connect to a service over the internet, the first stage is that the request must be translated to an internet address,e.g. your computer asks what is the internet address of myfakecompany.com It does this in the following order, and when it finds the internet address for the requested name, the DNS lookup is complete and no further steps are requested:

1. Your computer looks in a special file on your machine called the hosts file, which may contain name-to-iinternet-address  mappings. For most of you, you will have nothing in this file, but I include this for completeness.
2. Your computer looks in its own memory searching the DNS cache, which is a list of name-to-internet-address mappings that have been requested since the machine was last started.
3. If your computer still can’t resolve the IP address for the requested name, it sends a DNS request to the first DNS server configured under your computer’s networking settings. Note that in many cases, the DNS server for your computer may be set to that specified by your router, which may be configured to act as a DNS cache itself.

From this process we need to understand what data is visible and to who: Only the name of the server to which you request data is visible, not any other data and the name is only visible the first time your configured DNS server receives a request for the internet address.

So your DNS server will only be aware that you request the IP address of myfakecompany.com at a particular time, not what you requested.

If you wish to conceal this very limited information, you can use Secure DNS which is configurable under your browser settings, but the DNS server from which you are requesting the internet address still can see your request even if all others can’t.

Note that you can reduce the number of DNS lookups made by your devices by configuring your router to be the first DNS server for your home network devices. In this case, your home devices will use the DNS cache on your home router first, which will reduce the number of times your home devices have to request this data from DNS servers on  the internet.

Encrypted versus Unencrypted Data

Once your computer knows the IP address of the desired company, your computer then attempts a connection to the IP address of the desired company. This communication can either be encrypted or unencrypted.

If the data is unencrypted, all data traversing the internet could be read by a third party.

If the data is encrypted, only the target server and your computer can read the data.

Data that is sent over the HTTPS protocol is encrypted.

VPN Services

A VPN provides a number of services. Let’s understand each of them:

Proxy Service

A proxy service is an intermediate server through which your internet traffic passes. Any internet service (like a website) receiving your requests for data through the proxy server makes it appear to the website that your request comes from the proxy server and not from your router or from your mobile phone, concealing your internet address.

End-to-End Encryption (Tunnelling)

Because a proxy service by itself simply passes traffic through it from source to destination,  your unencrypted traffic could be read by the proxy server, which is why that traffic needs to be encrypted, hence the second service bundled within the VPN offering is encryption of all traffic. In this way the proxy server is unaware of the content you are requesting and receiving or sending.

(Optional) No Log Policy

Most of the VPN offerings have a “no log” policy – this means they do not store information about the source and destination of traffic.

(Optional) Ad Blocker

Some VPNs may include an ad blocker feature. Note that since traffic sent from a website is almost always encrypted, it can only block ads from an ad service that embeds ads within the website and not ads served by the website itself as the traffic from the requested website is completely encrypted by the tunnelling encryption.

Downsides

Cost

The first downside is the cost – you’ll have to pay for a VPN service.

Increased Latency and Poorer Performance

Latency is the measure of the response from the destination back to your machine. The proxy service increases latency as does the encryption. If you’re an online gamer, you don’t want to increase your latency as it will result in a much poorer experience and in the case of many shooters, you will lose gunfights more often!

Encrypting Encrypted Data

The biggest downside is that in most cases, you’re paying for encrypting data that is already encrypted for free! In other words, there is no benefit in encrypting encrypted data.

By default, most modern browsers will warn you if the data you are sending is unencrypted, so providing that you don’t ignore these warnings, a VPN service is of no benefit here. A VPN will however protect you against third parties intercepting data that is otherwise unencrypted.

Comparison

Scenarios When You Might Need a VPN

Bypassing Geo-Fenced Websites

Some websites and services are only available to people in a particular jurisdiction. For example if a website is only available to people in the UK and you travel abroad, should you access this website, you may get a message that the content is not available to you.

Using the proxy service inherent in a VPN service, you could set the proxy server to be in the UK and bypass the restriction completely.

In this way, if you were so-minded, you could also bypass the UK government’s Online Safety Act restrictions by making it appear to the foreign website that you are not in the UK….

Concealing Your IP Address From the Target Server

The IP address from which you are connecting has little value to the target server (unless that which you are doing is illegal). Most websites rely more heavily on identifying users via cookies. Beyond general geographic location, there is little value in the IP address.

Summary

For most users, VPNs offer negligible benefit – provided that you do not ignore the warnings that your web browser gives you about unencrypted sites, the data that you are giving away is minimal and of little commercial value.

Ian Posner is a freelance IT consultant specialising in performance troubleshooting and optimisation. In his free time, he provides technical help to his neighbours! ian@datasurge.co.uk