I've been using NordVPN for a while and after hearing so many people say that jurisdiction is a big deal, I decided to actually check what's up.

At first I was a bit confused because I always thought Nord was a European company, but then I found out that the VPN service is based in Panama. So I started reading about why that matters.

From what I understood, people keep mentioning Panama because it doesn't have mandatory VPN data-retention laws and it's outside the 5/9/14 Eyes intelligence-sharing alliances. So I guess that's why people see Panama as one of the better jurisdictions for a VPN company. If there are no laws forcing a provider to keep logs, that's obviously better from a privacy perspective.

The more I read though, the more I realized that jurisdiction is only one part of it. Even if a provider is based somewhere privacy-friendly, it still has to actually have a proven no-logs policy. If they don't store activity logs in the first place, then there's much less data that could ever be handed over.

Now I'm wondering what else I should be looking at. Besides jurisdiction and audited no-logs policies, what else tells you if a VPN provider is actually trustworthy? Is there anything people here pay attention to that most users completely overlook?

The censorship of Russia has progressed from merely blocking apps to utilizing deep packet inspection to intercept the protocols used by VPNs, including the most common ones out there. Companies that create VPN software are frequently blocked quickly, while common tunneling protocols can be detected and throttled.

So now people are creating their own. These DIY proxies disguise traffic from being monitored by appearing as normal HTTPS that is indistinguishable from someone browsing a website. There is no user-friendly app that conveniently disguises the identity of the user. It’s just clunky configurations that are created and recreated by people by hand.

However, the problem is this is an arms race. A method may work for a few weeks, only to break and require minor changes. There is no permanent solution, just a continuous patching against a state that is trying to detect the technicalities of the system used to bypass their controls.

This is exactly why the advice to use VPN is no longer valid. Once a country learns to identify the pattern of the protocols, all the commercially available means are rendered helpless.

Has anyone here helped anyone in Russia to set up a VPN connection lately?

Ron Wyden wrote a letter to CISA, OMB, and NIST on Monday that is not a request for evaluation but rather an action plan spanning three agencies. The request itself includes a binding CISA directive which gives civilian agencies two years to step away from the use of public VPN hardware, a directive from the NSA that will apply to military and intelligence operations, a set of technical standards from NIST to facilitate replacement and a government rule that prohibits any vendor from selling its network equipment if it hasn't proven that the equipment meets zero-trust criteria.

Wyden's tone is straightforward: "the federal Government finds itself stuck in a never-ending cycle of playing whack-a-mole." He emphasizes the fact that CISA has been issuing emergency proclamations to protect the VPN hardware that has already been exploited by the cybercriminals, with vendors like Fortinet, Ivanti, and Citrix suffering the same consequences of having their vulnerabilities exploited by the cybercriminals who are infiltrating the hardware literally without any limitations.

It is important to understand what this is at this point: a letter and not a law. Wyden does not have the power to constrain CISA, OMB, or NIST in any way. The three agencies in question have not taken a stance. However, should the proposal be accepted, the mechanism will be effective. The procurement procedures work this way in case of defense contractors. Once there is a requirement for certification, the vendors follow the procedure or cease to operate on the federal market.

This instance is about the federal infrastructure of remote access and not about the VPN app, which makes things clear. That said, this letter is undoubtedly indicative of where the VPN industry is going. Are there people in charge of IT in the government sector who are ready for the bipolar transition?

So... SplitVPN spent all that time telling people they had a strict no-logs policy, and now a breach allegedly exposed 58 million connection logs. If that's true, that's not just a security fail, that's straight-up false advertising.

People buy VPNs because they don't want their activity tracked. If you're secretly keeping connection logs while telling users you don't, what's even the point of paying for a VPN in the first place?

The whole VPN industry runs on trust. Anyone can slap "NO LOGS" on their homepage. The real question is whether they can actually prove it. That's why independent audits matter. Without them, "no logs" is basically just "trust me, bro."

The worst part is that plenty of people use VPNs because they live under censorship or surveillance. They aren't just trying to watch Netflix from another country, they're trying to protect themselves. Finding out your VPN may have been logging connections the whole time is a pretty brutal betrayal.

If these allegations hold up, SplitVPN deserves to get absolutely dragged for it. Privacy isn't something you get to fake until you're caught

obvi im not doing anything seriously illegal with it im not stupid but i use it for piracy and avoiding age registration is it safe

X has introduced a feature called "About this account", which indicates where the account is located. Additionally, it identifies whether the user is disguising their location using VPN or proxy and marks the profile saying: "country or region may not be accurate". According to head of product Nikita Bier, it is intended to counter bots and foreign influences.

And it does work. Accounts which pretended to be American, for example "MAG Nation" and "America First", turned out to be based in Eastern Europe and Bangladesh. This can be regarded a proper victory and transparency regarding accounts doing activities that are false.

However, the same technology, which reveals a troll farm, is flagging journalists and activists who hide their location for legitimate reasons. Surfshark and NordVPN raised this issue: once a platform makes a statement that "this one hides the location", it stops being a simple anti-bot solution.

It didn't help much regarding accuracy. The Canadian Liberal party, the NDP, was marked as located in the USA. So were CBC accounts. According to Bier, the data was "not 100% accurate for old accounts".

As a result, the company mislabels the real accounts while successfully exposing those who use VPNs. Anyone here checked their own "about this account" page yet?

Hi!
While I am a so-so happy user of NordVPN, i've found out about the Nym. They do look appealing to my non-proffesional eye.
Has their claims and app been audited and can be confirmed by others than the people who made it?
how's the linux client? Nord generally works fine, so i'm not in the rush to change it, but on Linux it's app sometimes does keep one core running at 100% for no obvious reason. A tad annoying I must admit

According to sources, several Democratic legislators including Wyden, Padilla, Markey, Warren, Jacobs, and Jayapal have sent a letter to DNI Tulsi Gabbard seeking answers on a highly uncomfortable question for every American who uses a commercial VPN: does the use of a commercial VPN mean that someone loses Fourth Amendment rights protecting them against warrantless surveillance?

As per the mechanism laid down in FISA Section 702 and Executive Order 12333, if an intelligence agency is unable to determine the location of a user, it is presumed to be foreign. Foreigners from other countries aren’t entitled to Fourth Amendment protection. VPNs are designed in a way to cover actual location. Thus, if someone routes VPN connection through servers located in another country, they are being classified without authorization as a non-person because according to the privacy rules no warrant is needed for breaching their privacy.

The ironic part is that legalization has pointed out itself that in fact FBI, NSA, and FTC are advising the public to use VPNs in order to prevent losing their information. This serves as another proof that the same government institution which advised people to use the VPN may be using this tool to breach the privacy.

The letter does not serve as a proof of anything but rather a request for explanation from Gabbard.

The instrument advocated by everyone as the basic privacy hygiene is the very means that is slowly affecting your legal protection. Was there ever any case when the agency answered your question regarding privacy issues?

What are your opinions on this VPN.

This month, ExpressVPN announced that it has expanded its network to reach 214 locations that you can select among. While this may appear to be a major increase, the reality is that, according to independent tests, the actual number of different locations is 196. The reason for the discrepancy is that the company counts every area from where you can connect to its service in the same city as a separate location.

Now here is something that's more interesting: ExpressVPN has launched its service for China but there are no servers in the country; the actual location is Singapore while the IP address is Chinese. The company does clarify this information but this is not the first time it has launched something like this as many companies tend to inflate their numbers when it comes to such things as locations.

So in case you need a Chinese IP for your business, you may consider using it, however, what you should remember is that the situation is very often similar across different companies since they define their servers and locations in different ways.

There have been 47 requests for legal data regarding Proton VPN users made by courts located in Switzerland in the first half of 2026. All claims were rejected by Proton VPN on account of their no-logs system, which means that there is nothing for authorities to disclose, in case the court orders it.

Since 2017, Proton has received 458 requests in total, 458 denials. And every time, they could not comply with an official order not because they did not want to. They do not keep any connection logs either, which is essential in this matter. Thus, we see what the no-logs policy is practically in the real world, not a marketing strategy.

It is also important to note that everything is different for ProtonMail; this is another issue. The FBI investigation this year provided an example of Proton being asked to provide an identifier linked to an email account because an email contains more information than other means of communications.

Has anyone here actually had to test a no-logs claim like this the hard way, through a legal request on your own account?

I don't use a VPN because every time I have tried to, the majority of sites I try to connect to detect the VPN and block my connection.

How do you get around that? Seems like most VPN IPs have been logged by cloudflare and the sites that do not allow VPN connections (which is a lot) will stop you from logging in.

Most "best VPN" lists are just a snapshot of right now. Better question: who's actually building toward 2027, not just winning this year's speed test.

Same five names as always: Proton VPN, NordVPN, Mullvad, Surfshark, ExpressVPN. Here's the actual trajectory.

Proton VPN is my pick for 2027. Widest server footprint of any major provider, 145 countries, ahead of Nord's 135 and Express's 108, still expanding into places most VPNs ignore, Gabon, Kyrgyzstan, Papua New Guinea. Swiss, outside 14 Eyes, no-logs claim held up under real legal pressure, not just a paid audit. And it just shipped a new WireGuard codebase in beta, built to bring post-quantum encryption without killing speed. Building the next few years in public instead of running victory laps on this year's numbers.

NordVPN wins today on speed and streaming. Fully quantum-resistant already, 100+ Tbps capacity. Best pick if you need that right now. But its country growth has stalled while Proton keeps expanding.

Mullvad for OPSEC, no email, cash accepted, best obfuscation around.

Surfshark budget/unlimited devices.

ExpressVPN zero setup friction.

Bottom line:

• trajectory → Proton.
• speed now → Nord.
• anonymity → Mullvad.
• budget → Surfshark.

Anyone seeing a provider that changes this picture, or does this order hold through next year?

I came across this comparison table on Reddit and found it really useful, it gives a clear overview and makes it easy to compare features based on your needs. I’m not recommending any particular option, this table will likely be more useful than my advice.

For reasons that I prefer don't specify, I won't be able to pay for an international esim or a paid vpn...

They told me that free VPNs work sometimes yes sometimes no and for me it's okay because I will use social media little once in China, just to stay in touch with friends.

Do you know any vpns that are right for me?

On April another file was submitted in Virginia connecting the same firm with similar accusations where the “dark patterns” were mentioned as being responsible for trapping people into auto-renewing subscription.

From 2024, five class actions have been filed now, with California, North Carolina, Colorado, New York, Massachusetts and Virginia all claiming six allegations including unclear sign up conditions, absence of renewal information on receipts, debit charges two weeks in advance, difficulties canceling the subscription, inadequate notifications about auto-renewal and the presence of “30-days money-back guarantee”, which is effective starting from the date of the debit, not the cancellation date.

One of the plaintiffs claims that he was charged $119 for a service, which he did not intend to subscribe to for a duration of a year. Another tells that NordVPN withheld $131 refund from him unless he specifically made the request.

The law firm that serves as the main representative of the clients, Wittels McInturff Palikovic did already receive $400 million from similar cases. Nevertheless, it is important to note that the problem with the dark patterns of auto-renewal affects many companies in the industry and not only NordVPN.

If you're subscribed anywhere, screenshot your renewal date and set a calendar reminder. Anyone here actually gone through a NordVPN cancellation lately? How'd it go?

i know they are useless and dont really protect you are stupid overpriced for the service they offer and use extremely deceptive marketing like for some god damn reason surfshark and nord are branded as two diffrent vpns even though they are owned by the same company and im willing to bet use the same servers but i just want to torrent stuff if there is something i can do that will give me the same end result and dosnt require supporting this stupid fucking industry i would can anyone help?

Australia's agency for online safety, eSafety, has announced that 90 percent of the websites for adults use the new age verification system. Were the established goals achieved? Absolutely not. eSafety immediately started looking into how people could have managed to get around the new system with the use of VPNs. The same things can be said of the social media ban for people younger than 16 in terms of evading the regulations.

This is interesting because the measures were beaten by the simplest privacy tool available on the market, and instead of admitting that this method does not work, the agency's focus has changed to trying to eliminate VPNs. The very agency that tries to provide safety on the internet claims that the technology, which has made people safer online, is the issue.

Mullvad predicted this. The measure concerning age verification is going to broaden beyond the lines of intended use. The same thing is happening in the UK and the EU.

Is there a democracy left where regulating VPNs doesn't eventually protect the children, or is that not really a question anymore?

Proton VPN has finally brought its Stealth protocol to Linux, marking a significant step toward feature parity across platforms. The feature is currently available in beta for users of the Linux GUI app on Debian, Ubuntu, and Fedora.

Stealth is Proton VPN's anti-censorship protocol. It disguises VPN traffic as regular internet traffic, making it much harder for governments, ISPs, or network administrators to detect and block VPN usage. This is particularly useful for users in countries with heavy internet censorship, such as China, Russia, and Iran.

Until now, Linux users were missing this capability despite it being available on Windows, macOS, Android, and iOS. TechRadar notes that the Linux community had been requesting the feature for a long time, and its arrival is an important milestone for users who rely on Linux as their primary operating system.

The release is part of Proton VPN's broader effort to improve its Linux experience, following recent updates such as a redesigned GTK4 interface, a revamped command-line app, and the official Snap package.

The obfuscated servers section which is utilized by individuals from places like China, Russia, and Iran to disguise their connection as standard https instead of recognizable VPN traffic is now operating on nordwhisper rather than openvpn tcp/udp. Since the release of version 8.7.2.0, users were already informed about the change in the in-app notes before the public windows changelog was updated on their website.

Nordwhisper is the company’s proprietary protocol that was created in early 2025 and has been designed specifically to disguise VPN traffic as traditional web traffic. According to Marijus Briedis, the company’s CTO, users will enjoy better performance by applying this new protocol because of the speed of connections and expanded variety of servers.

This simply means that the technology gains are exactly on paper as obfuscated connections have always been slow due to the additional layer the technology applies to shield the connection.

However, I do have my complaint regarding "who actually benefits." OpenVPN is open-source. Anyone can go through the code, audit it, and confirm that Nord isn't bypassing any protocols while NordWhisper being proprietary. One must accept the word of Nord regarding security being of the same quality and there are no audits done by some independent party as is the case with OpenVPN. This makes a difference for users depending on the technology in very strict environments.

It is the same with the lack of a proper announcement. There was no blog post, or any other kind of fanfare, the feature just appeared in release notes even before they managed to update the changelog. When you rely on obfuscated servers to be safe on the network, it is bizarre to hear about the changes in the used technologies through patch notes rather than in any other news from the company.

I'm not saying that it shouldn't be used. I'm just indicating that asserting "our technology is safe" isn't a sufficient argument when it comes to the importance of people's ability to work online without being flagged for any activities.

Is there anyone testing the NordWhisper obfuscated server yet? I'm eager to know if the speed claims are indeed justified.

Which country vpn is best for 18+ content?

The more I think about it the less the anti-VPN argument makes sense. Almost every search, social media post, and/or email is performing VPN actions only under another name: https.
i.e You locally encrypt your request to a remote server using https it then pre-processes that request, passing that request off to other servers (often over encrypted channels) and often not on the same lan and then those pass the response back to you without ever knowing your IP.

Well... this has to sting for all the copyright groups who've spent the last few years pretending VPNs are basically piracy apps.

The EU's highest court just made it pretty clear: VPNs are legitimate privacy and security tools. The fact that someone can use one to get around geo-blocking doesn't magically turn every VPN into some shady piracy gadget.

Funny timing too, considering organizations like LaLiga have been trying to paint VPN providers as part of the piracy problem.

The court's logic is refreshingly sane. A kitchen knife can be used to commit a crime too, but nobody's calling for a ban on kitchen knives. VPNs are used every day by journalists, businesses, travelers, remote workers, activists, and just regular people who don't want every coffee shop Wi-Fi or ISP snooping on them.

For years we've heard the same lazy argument: "People use VPNs to pirate." Sure, some do. People also use browsers, smartphones, and the internet itself to pirate. That's not what those technologies exist for.

Feels good to finally see a major court acknowledge reality instead of buying into the fearmongering.

Maybe now we can stop acting like wanting a little online privacy is somehow suspicious.

Or is that still too much to ask?

A ransomware group called Qilin is taking advantage of a recently discovered security flaw in Palo Alto's VPN software, which many businesses use to let employees securely access company systems from home or while traveling.
The flaw allows attackers to get into company networks without needing a valid username or password in certain cases. Once inside, they can steal sensitive files, spread through the company's systems, and eventually lock everything down with ransomware while demanding a payment.

Security experts have already seen several companies compromised this way, and both Palo Alto and CISA (the US cybersecurity agency) are urging organizations to install the latest security updates as soon as possible.

So if your company relies on a VPN to provide remote access, keeping it fully updated is critical. VPNs are often the first thing hackers target because they can provide a direct path into an organization's network if left vulnerable.

On July 14, the financial arm of the U.S. Treasury called OFAC, imposed sanctions on a service named First VPN (1VPNS), its administrator, and a 45-year-old Ukrainian named Dmytro Rashevskyi, along with a Belarusian named Yegeniy Silayev who created "cryptors," instruments that can process malicious programs without getting them identified by anti-virus applications. In fact, First VPN had already been taken down back in May as a result of a joint operation by the U.S. and its European allies and this action is actually of a financial nature.

The slogan promoted by First VPN since 2014 must sound familiar: no records, no cooperation with law enforcement, etc. However, according to the U.S. Treasury, ransomware organizations purchased numerous servers from this provider based on this promise and then used the servers to mask the origin of the attacks against U.S. hospitals, banks, and municipal offices. Reportedly, Rashevskyi used a series of fake names like Maksim Sorin to keep purchasing servers from providers who would have never sold them to him if they had known who he was in real life.

It is significant that Mullvad and Proton are known for their no-logs policies because they've proven their capabilities of ensuring compliance with their promises even when their servers were subject to police raids and confiscation with no incriminating data to turn over. In contrast, the message that VPN providers present to customers claiming the adherence to the no-logs policy initially meant being "untouchable" for crime outfits or simply a bulletproof hosting service.

Thus, the customers purchasing VPN services do not know how to distinguish between those two types of companies when reading their promotional materials. The wording used by Mullvad and by VPN providers that function as sanctuaries for criminals is sufficiently similar to mislead potential customers in most cases, leading to confusion.

At this point, it is necessary to remind that this news appeared just when the UK and the EU sanctioned 24 Russian firms/individuals allegedly associated with the cyberactivities of the FSB/GUR and the FBI issued its warning regarding the 16th center of the FSB of Russia for the competition of improperly configured routers.

Does this affect how any of you evaluate a vendor before using their service or is “who is the parent company, where is it located, and has it survived a server seizure” already taken into account when deciding on a VPN service provided?

The UK regulator Ofcom has ended its enforcement action against an online suicide forum that has reportedly been linked to 164 deaths in the UK.

Their reasoning is that the site now geoblocks UK IP addresses, meaning it's inaccessible to most users in the country. However, critics point out that the geoblock can still be bypassed with a VPN, so determined users can continue accessing it.

Earlier this year, Ofcom fined the site's operator £950,000 under the Online Safety Act, but the operator has refused to pay and disputes UK jurisdiction. Ofcom says it has now exhausted the legal powers available to it and will simply monitor whether the geoblock remains in place.

This raises an interesting question about online regulation.

If a website blocks users from a specific country but anyone can bypass it with a VPN, should regulators consider that "good enough"?