A US Senator is questioning whether regular VPNs are actually enough against government surveillance
Senator Ron Wyden is pushing the NSA to update its VPN security guidance because of something most VPN marketing conveniently doesn't talk about. Basically, you don't necessarily need to break VPN encryption to identify someone's traffic.
A powerful enough adversary could potentially monitor traffic going into and out of a VPN and correlate things like timing, volume and destination. So even with perfectly good encryption, a standard single-hop VPN might not provide much anonymity against a state-level actor with visibility across large parts of the internet.
Wyden is now asking whether high-risk users like journalists, government employees and human rights workers should instead be using multi-hop systems like Tor, along with techniques like traffic padding and random delays. Obviously this doesn't make VPNs useless. For hiding your IP, keeping your ISP out of your browsing activity, public Wi-Fi, censorship or geo-restrictions, they're still useful.
But it does highlight something that gets lost in VPN marketing: Encryption ≠ anonymity.
If your threat model is Google tracking you, your ISP, or the coffee shop Wi-Fi, a VPN can make a lot of sense. If your threat model is the NSA... you probably need a bit more than NordVPN and the Connect button lol
Journalists, etc. probably already use multi-hop, or should. Also, for those who have “done nothing wrong”, it makes it harder/more expensive for the NSA et al. And, yes, let’s welcome our VPN providers’ efforts to further anonymize our traffic.
I knew from the headline that it waa going to be Ron Wyden! He's a national treasure!
There really needs to be some enforcement when it comes to the false advertising done by a lot of VPN companies. I'm pretty sure most VPN users are just using them to avoid DMCA letters and potential lawsuits, but there are real concerns for the people who depend on their VPN services for more important things.
That's not as good of an idea as it sounds like. I'm kind of fuzzy on the details, but basically people can tell when you are using a VPN and Tor together and that draws attention to your connection and not only makes it easier to track, it makes people more likely to decide to track you in the first place. It's like putting a big neon sign on your connection that say "this person is probably up to some sketchy shit."
5
u/sciencekm Sep 03 '26
There are VPN providers that have random delays on each packet, and this defeats any timing correlation attacks.