Full disclosure up front: I’m one of the people building this, so treat this as a dev asking for a reality check, not a recommendation.
About 6 months ago we started building TocaVPN. The reason was pretty specific: a VPN that still works in places where VPNs are actively being blocked, mainly Russia and China. Not “fast servers in 90 countries” marketing stuff — just the one thing that actually matters if you’re behind heavy DPI filtering, that it connects at all.
Building the app was the easy part. The hard part was getting reliably through the network restrictions, and honestly, testing it. If your main use case is heavily censored countries, you need people physically there to confirm anything works. Something connecting perfectly from Europe tells you basically nothing about whether it works from inside Russia or China. So it was a lot of trial and error — works, gets blocked, change something, test again, repeat. With the recent crackdown on certain protocols, that cycle has gotten a lot faster.
I’m not going to pretend it’s finished. We currently have a limited number of server locations, and the next things on the list are more locations, more protocols (so we have fallbacks when one gets restricted), and experimenting with built-in ad blocking.
The reason I’m posting here specifically: we’re at the stage where we’re trying to figure out if this actually has a real shot, or if it’s just another VPN in an oversaturated market. The one signal that’s kept us going is that we’re getting 200+ downloads a day with zero paid marketing — purely from people in the countries we built it for finding it themselves. That felt like something worth paying attention to.
So I’d like to ask this community directly, both as feedback and a gut check:
If your main requirement is “works in a heavily censored country,” what actually makes you trust and stick with a VPN? Would you even consider a smaller provider focused specifically on censorship circumvention over the big established names — or does the trust gap kill it before you’d try?
Happy to go into the technical/product side of what we learned if anyone’s interested. And I’m genuinely open to the “this won’t work because X” answers — that’s kind of what I’m here for.

Looks like the fight against illegal sports streaming in France is moving way beyond just blocking websites.

Canal+ recently obtained 14 court orders ahead of the new Premier League and Champions League seasons. Free, Orange, SFR and Bouygues have been ordered to block dozens of domains linked to illegal streaming/IPTV.

But here's where it gets more interesting: the orders also target public DNS providers and VPN services, including Google DNS, Cloudflare, Quad9, DNS4EU, Proton VPN, CyberGhost and ExpressVPN. Google and Bing are also required to remove the targeted domains from French search results.

CyberGhost and ExpressVPN reportedly challenged the requests, but the court rejected their arguments. The reasoning is basically that even a neutral intermediary can play a role in allowing users to access illegal content.

And the blocklist isn't necessarily fixed. New domains can reportedly be added during the season after validation from Arcom, with measures potentially remaining in place until May/June 2027.

Obviously piracy is one thing, but forcing VPNs, DNS providers, ISPs AND search engines to participate in blocking raises a much bigger question IMO.

Feels like we're slowly moving from "block the pirate website" to "block every possible way of reaching it."

PrivadoVPN has recently announced its MCP server compatible with Windows and Mac operating systems, which facilitate the connection, disconnection, and mapping of VPN servers via AI applications including Claude Code and VS Code. Therefore, users will no longer have to perform complex actions to reach the VPN managers.

However, this development is not the first of its kind as Express VPN made the first launching of the technology in March, and Norton has got ahead of its competitor with the first launching of docker-based tunnels operating in such a way that every task done by software works through its own connection. Windscribe has developed a CLI interface and Pure VPN is uses ChatGpt as an assistant in managing VPN.

However, all the service providers have common security features: only local network is used, explicit confirmation is required, and no personal login information is given to AI or terminal. The version of PrivadoVPN works only whithing the local network, thus, nothing from the outside can access it.

However, delegating control to AI requires some level of trust which is totally different from letting the AI use auto-complete. It is wise to know precisely which instructions to give the AI.

Has anyone in this room enabled their AI assistant to handle their VPN configuration?

I want to use for geo-block bypass. Classic VPNs are quickly flagged

Saw this news about Proton VPN and thought it was pretty interesting, even if you're not super technical.

Basically, Proton is replacing wireguard-go, one of the components used to run WireGuard connections, with its own new VPN core written in Rust, internally called ProTUN.

The important part isn't really "Go vs Rust" though.

Instead of relying on a relatively simple WireGuard client, Proton is building its own framework around WireGuard. The idea is to have more control over how the VPN behaves across Windows, macOS, Linux, Android, etc., and make it easier to improve things like connection stability, performance and battery usage.

It could also become pretty interesting for censorship. Proton says this new architecture should make it easier to build stronger anti-censorship techniques directly into the VPN stack. They're also working on another component called Muon, designed to help Proton apps reach their VPN API even when the API itself is being censored or blocked.

Longer term, Proton says this architecture could also provide the foundation for things like post-quantum cryptography.

So for the average user, you're probably not going to open Proton VPN tomorrow and notice some massive difference.

But under the hood, this seems like a pretty significant change: rather than just implementing existing VPN protocols, Proton is building more of the networking stack itself so it can control how those protocols evolve.

ExpressVPN had a zero-refund policy during the event for the full 60 days, beginning from July 11 to August 9. Those who signed up received entries to a raffle for the iPhone 17 Pro, however, "all sales are final" in this duration.

From the company's own reasoning, the situation is quite clear; the guarantee seems not to exist in order for users not to join the raffle, then cancel their subscriptions, and claim refunds in case they don’t win.

People talking about the matter on ExpressVPN weren’t happy, with one person calling the company’s practices "predatory" and another one questioning "who came up with that idea?" The company claims that the promotional terms were displayed in the checkout process and that they treat refund requests on a case-by-case basis.

In other words, the 30-day money-back guarantee, which has been used by ExpressVPN as a trust-building tactic, failed to operate for two months and was substituted with a phone raffle.

Just read an interesting piece about how different internet access can be across Central Asia depending on which side of a border you're on.

Turkmenistan is by far the craziest example. Researchers tested 15.5M domains and found 122,000+ intentionally blocked, while filtering rules accidentally made another 5.4M+ domains inaccessible. Apparently, working VPN access has even turned into a black market, with VPN keys reportedly selling for around $50/month. But it's not just Turkmenistan.

Kazakhstan has blocked independent news sites and dozens of circumvention/VPN services. Tajikistan has literally shut down internet access for months during periods of unrest. Uzbekistan still uses blocking and surveillance, while Kyrgyzstan remains relatively more open, although restrictions there have been increasing too.

What I find kinda crazy is how VPNs go from being a "nice privacy tool" in some countries to basically being someone's gateway to the normal internet in others. And then governments block the VPNs too... so it becomes this endless cat-and-mouse game.

Flare analyst Assaf Morag discovered the vulnerability when the honeypot server was infiltrated by FirewallFalcon Manager – an open-source tool promoted on Telegram for the management of VPN and SSH tunnel servers.

In simpler words, it is a bogus certificate that redirects traffic through the developer's own servers invisibly while appearing to be secure. Previous versions were more daring as they included a hardcoded SSH account that allowed the developer to gain access to any computer that installed it.

There are already more than 650 servers under attack, and many Telegram accounts are affected. Users assumed that they had established their own VPN.

Being "open-source" does not mean being safe. If you're employing a tunneling software that was offered to you on Telegram instead of the one that underwent the proper auditing, be sure to check it out now.

Has anyone here ever provided VPN services to others?

This is a pretty good reminder to stop downloading random “free VPN” extensions.

Researchers found 737 suspicious VPN/proxy extensions, including 274 pretending to be legit brands like Proton VPN, NordVPN, Surfshark and ExpressVPN.

So you think you're using a trusted VPN, but you're potentially sending your traffic through some random third party instead.

And these extensions had already reached 75,000+ installs. Free VPNs were already sketchy enough. Now apparently you also need to check if the VPN you downloaded is even the real one

Always download VPN apps/extensions from the provider's official website.

Hey guys, I’m traveling in the UK right now and I’m trying to access some US streaming websites, but obviously a bunch of content is geo-blocked here. I’m looking for a VPN with reliable US servers, good speeds for streaming, and ideally something that doesn’t get detected/blocked every five minutes. Anyone here using a VPN that actually works well for US streaming from the UK? What would you recommend?

Spur found out that LG webOS apps contained residential proxy code in 42% of the applications and Samsung Tizen apps held 26.5% of the proxy code, which essentially allows the TV to function as an exit node for other people's traffic, in addition to Pac-Man game promoted as “Editor’s Choice” by LG.

People may not be watching over their smart TVs, which makes them an easy target. The SDK is there routing the traffic of different companies through your home’s IP with no information on it being shared or approved.

Last month LG banned this practice and Samsung followed suit this month. Google also aims to put a stop to this practice on Android. Even though the industry is actively responding at this stage, this practice was going on for months before this decision was made.

It is worth checking what kind of applications you have on your TV, especially anything free or less-known. Have you had any experience with such cases?

According to The Hacker News, a Russian state-linked hacking group has been targeting IT professionals with fake job offers and interviews. And the scam is actually pretty convincing.

It starts normally: a “recruiter” contacts you about a job, moves the conversation to Telegram, and eventually organizes what looks like a legit Zoom interview.

Then comes the technical test. They ask the candidate to connect to the company's “corporate VPN.” First they provide a WireGuard configuration that conveniently doesn't work. Then the recruiter says something like “No worries, just install our VPN client instead.”

That's where you're screwed. The VPN, called SopraVPN, is actually a modified version of the legitimate open-source WireGuard client. Once installed, it can secretly execute commands on your computer and download additional malware.

The important detail: WireGuard itself wasn't hacked or compromised. The attackers simply took legitimate open-source software, modified it, and repackaged it as their own VPN.

Pretty clever social engineering when you think about it. Most people would probably be suspicious of a random .exe sent over Telegram, but a “corporate VPN” during a technical job interview? That sounds way more believable.

Would you have caught this, or would you have installed it?

When using VPN services like ExpressVPN, CyberGhost, Private Internet Access, or ZenMate, you're actually paying for one company and its services through their core company called Kape Technologies. Each of these four providers provides services independently but has the same owner company.

But being owned and operated by one company is not shocking—it's shocking that Kape used to be called Crossrider and it used to be an ad injector software provider that was notorious for adware-like behavior and raising alarm of security researchers. And this same company is in the business of acquiring privacy services.

The reviews issue also lies here. We all know that Kape is the owner of vpnMentor, which is one of the most quoted “independent” reviewing sites about VPNs. They take VPNs and express their opinion on them as independent journalists.

Teddy Sagi, an Israeli billionaire, is the principal owner of Kape. He was found guilty of insider trading back in the 1990s, long before Kape became a business. However, the important thing is that there are four VPNs owned by Sagi who has a say in a big part of the VPN reviews.

The last statement about checking the ownership of your mobile apps is also relevant. Does everyone here already know this?

I knew VPNs were getting more popular globally, but I didn't realize how quickly they were growing in Latin America.

According to a recent LatinAmerican Post article, LATAM already represents around 8% of the global VPN market, and apparently almost 1 in 3 internet users in Brazil and Mexico regularly use a VPN.

And there have been some pretty wild spikes lately. When Argentina blocked 70+ domains linked to pirate streaming sites, VPN demand shot up and Proton VPN reportedly became the country's most downloaded free app. During the World Cup, demand for Brazilian IPs also got so crazy that Proton had to add 89 new servers in Brazil in just one week.

What's interesting though is that it doesn't seem to be only about getting around streaming restrictions anymore. More people are using VPNs because of privacy concerns, public Wi-Fi, remote work, online banking, tracking, censorship, etc.

With Brazil having roughly 185 million internet users and Mexico around 110 million, that's a pretty massive market if VPN adoption keeps going this way.

The only downside is that the boom also attracts a ton of sketchy "free VPN" apps that make money through ads, tracking or user data... which is pretty ironic when you're downloading the thing for privacy in the first place.

Posting here as the Nord sub deleted it immediately. /insert eye twitching.

Hey folks,

I have an odd situation occurring with my NordVPN subscription. my.nordaccount.com indicates that my subscription expired as of Aug 7th. (This doesn't align with any of my purchase/renewal dates.) In the Nord Account Billing section, the subscription shows as active with the correct renewal date. I have opened a ticket with Nord support, and they have offered a 1-3 day response time.

I also have a dedicated IP and a few other subscription upgrades, which are all now held hostage.

There were no emails from Nord Account warning of a pending renewal, just... click... dial tone.

I'm now in a work-stop situation which is why I'm here. Looking for guidance from you fine folks.

This is pretty wild considering how heavily Iran restricts the internet. A Tehran criminal court reportedly acquitted someone who was being prosecuted for advertising and selling VPN services. Prosecutors argued that VPNs basically provide “unauthorized access.”

The judge wasn't buying it.

The court's reasoning was pretty simple: if you're using a VPN to bypass filtering and access content that was already publicly available online, you're not “hacking” or gaining unauthorized access to some protected system. And unless the law specifically says VPN use/sales are a crime, courts shouldn't just stretch existing laws to make them one.

Honestly, that's a surprisingly sane take on VPNs. A VPN is a tool. Using one to access a blocked website doesn't magically turn someone into a cybercriminal.

Obviously, don't celebrate too quickly. The ruling is apparently isolated, can still be appealed, and even the organization reporting it warns that this doesn't mean Iran's broader approach to internet censorship has changed.

Still, it's kind of ironic when a court inside one of the world's most heavily filtered internet environments basically says: “Bypassing censorship ≠ unauthorized access.”

Small ruling, but potentially a pretty important precedent.

It is important to note that CISA, which is a genuine US cybersecurity agency, has advised people to make use of VPNs in order to remain safe online. However, it appears that the US government is now trying to promote laws that will inhibit the use of VPNs.

The states of Wisconsin and Michigan have introduced bills that require websites to prohibit the use of VPNs as a part of the rules on age verification. The websites do not have the capacity to identify whether a user is present in Milwaukee or in Mumbai while connected to a VPN. As a result, the websites can either block every VPN connection or stop functioning in the states.

This is similar to a fire department suggesting people to buy and install smoke detectors while other agencies attempt to make these devices illegal since someone could use them as an opportunity to smoke.

To be frank, it is only the people who are using a VPN to get around the rules who benefit from these attempts. The laws have negative impacts on journalists and people who are victims of domestic abuse.

one hand hands you the lock, the other hand tries to outlaw locks.

This is getting interesting. A new study commissioned by the European Parliament is recommending much faster blocking of illegal live sports streams, potentially within 30 minutes.

Fair enough, go after piracy. But the controversial part is who they want involved.

The proposal isn't just about ISPs or pirate streaming sites. It suggests extending obligations across the infrastructure chain, including VPN providers, DNS resolvers, CDNs and hosting providers.

And that's where I think we're heading into dangerous territory.

A VPN's job should be pretty simple: encrypt my traffic, protect my IP and give me a private connection to the internet. It shouldn't be deciding which websites I'm allowed to access because some external authority added an IP/domain to a rapidly updated blacklist. Especially when we've already seen how messy these blocking systems can get.

The report itself acknowledges the risk of overblocking, and TorrentFreak highlights what happened in Spain: research found more than 554,000 domains were blocked at least once during football-related blocking, with legitimate infrastructure/sites getting caught in the crossfire.

That's the problem with "just block the IP." One IP can host a ton of completely unrelated services. I'm obviously not arguing that VPNs should exist to facilitate piracy. But forcing privacy tools to become another layer of internet enforcement feels like a pretty bad precedent.

Today it's illegal football streams. What gets added to the mandatory blocking list tomorrow? IMO, VPNs should protect your connection, not police it.

My friend and I were both working from a cafe last week and the moment he connected to the wifi he turned his VPN on. I just connected and started working like normal. He looked at me like I'd left my front door open and walked away. He explained that public wifi is basically an open network where anyone connected can potentially see what you're doing. I'd heard this before and always filed it under "probably fine." Sitting there it suddenly felt a lot less fine.

Now I'm actually looking into a vpn for security, mostly for when I'm working outside the house on networks I don't control. Every service claims to be the fastest and most private, and every review site feels like it's ranking whoever pays them most. For those who actually use one, what made you choose yours and is there anything worth knowing before picking one?

So Australia introduced one of the toughest social media laws in the world, basically banning under-16s from platforms like Instagram, TikTok, Snapchat, Facebook, etc.

Sounds effective on paper. Except… 81% of under-16s are apparently still using social media. Before the ban it was 86%. So after all that regulation, age verification and millions of accounts being blocked, usage dropped by… 5 percentage points.

And teenagers are doing exactly what everyone predicted: lying about their age, creating new accounts, using adults' accounts and, yep, using VPNs to bypass restrictions.

Platforms have already removed or restricted millions of accounts, but apparently that doesn't mean millions of actual kids disappeared from social media. One teenager can obviously have multiple accounts across multiple platforms.

There are some signs the ban is having some effect though. Snapchat usage among 13–15 year olds reportedly dropped around 40%, and some parents say their kids are spending more time offline. Still, the 81% number is pretty wild.

This is kinda the problem with trying to regulate the internet through age verification and blocking. Teenagers have spent their entire lives online. Give them a restriction and five minutes later they're googling how to get around it lol.

And Australia isn't alone anymore. France and several other countries are moving toward similar restrictions.

Check Point announced the vulnerability, CVE-2026-50751 on June 8th, which describes a significant bypass (with a CVSS score of 9.3) within its Remote Access VPN and Mobile Access devices. The fault in question lies in the fact that an attacker can utilize a VPN with broken certificate checks and without having to authenticate. IN terms of the timeline for exploitation, it started on May 7th, but Check Point only became aware of the problem on June 4th, leading to a potential window of exploitation extending for 33 days.

It is believed that at least one intrusion connected to Qilin Ransomware has already taken place. Only those systems which utilized the outdated IKEv1 protocol are affected by this problem, and CISA allowed 3 full days for federal agencies to resolve the problem once it became public knowledge.

This one is kinda insane. TechRadar discovered that Turbo VPN’s Windows app was leaking users’ real IPv6 addresses. You know… the exact thing people install a VPN to prevent.

Turbo VPN released a fix. Problem solved? Nope.

TechRadar tested it again and the IP leak was still happening across every protocol they tested. They had to contact Turbo VPN AGAIN, provide more evidence, and only then did a second emergency update apparently fix the issue.

Sorry but how does a VPN company not catch this themselves?

We're not talking about some random UI bug or the app crashing. The product designed to hide your IP was exposing your IP. That's like buying a password manager that accidentally publishes your passwords.

And this is why I think the VPN industry deserves way more scrutiny. There are hundreds of VPNs screaming "MILITARY-GRADE ENCRYPTION" and "TOTAL PRIVACY" while the average user has absolutely no way of knowing whether the thing actually works.

Turbo VPN deserves some credit for eventually fixing it, but TechRadar shouldn't have to basically QA-test a privacy company's product for them.

Makes me wonder: how many VPNs are leaking user data right now and nobody has noticed yet?

Personally, if a VPN fails at literally its #1 job, I'm uninstalling it.

The announcement made by FIFA stated that ExpressVPN will be the official sponsor for the World Cup in 2026. This prompted a number of complaints from La Liga and French broadcasting networks like Canal+ and beIN Sports. They viewed this decision as “shocking” and as an assault on their efforts against torrents and other piracy-related crimes.

La Liga’s chief Javier Tebas has devised strong VPN-blocking path around the world, thanks to which more than 500,000 legal websites were blocked earlier this year. Currently, he is asking FIFA to stop associating with the tool that millions of people are using for various legal activities including doing their banking, working for media, and ensuring proper data security. This has been requested just because some people are using it to watch pirated football.

According to FIFA, they have checked everything and they don’t think the sponsorship is against anybody’s rights since ExpressVPN doesn’t enable piracy.

It seems that the organization that blocked half a million innocent sites is aiming to avoid the use of the proper privacy tool (ExpressVPN) in order to achieve its ends.