What VPNs Do and Do Not Do

A VPN replaces one trusted network with another trusted network. That is the whole idea, and it is useful — but it is a transfer of trust, not a removal of it, and the distinctions matter more than the product comparison.

What it changes

Your network — a café router, a hotel, an employer, an ISP — no longer sees the destinations you connect to. It sees an encrypted connection to a VPN operator’s server. The destination sees the VPN operator’s address instead of yours, and may apply its own geography-based access rules as a result.

The connection is encrypted in transit between you and the operator. Nothing about the content changes: a request to an http:// site is still plaintext to whatever handles it next.

What it does not change

The leak paths that matter in practice

DNS. If name resolution still goes to your ISP, the ISP learns the sites you visit even while the tunnel is running. This is the most common real-world gap, and it is why encrypted DNS matters alongside a VPN rather than instead of it. Some clients offer to route DNS through the tunnel; check rather than assume.

IPv6 and WebRTC. A tunnel over IPv4 that leaves IPv6 traffic outside the tunnel is a complete bypass. This is a configuration bug rather than a design limitation, and it has been found in real products.

Kill switches. A “killswitch” blocks traffic when the tunnel drops. Without one, a failed connection silently reverts to the unprotected path.

Reading a provider claim

The verifiable properties, in rough order of usefulness:

1. A named entity and jurisdiction. Anonymity requires that some operator can be compelled and has nothing to hand over. A company with no registered entity, or one in a jurisdiction with no applicable law, is a different proposition.
2. A specific logging policy. What is logged, and for how long. “No logs” without saying what is not a policy.
3. Independent audit. A published third-party audit of the no-logs claim is materially stronger than a policy page. Read the scope of the audit, not just its existence.
4. Transparency reporting. How many times the operator has been asked for data and what it produced.
5. Payment without an account. Paying with an account-linked method creates a record that links you to a subscription.
6. Published technical detail. Protocol, key exchange, DNS handling, and IPv6 behaviour.

When not to bother

• You mostly need a second factor and unique passwords.
• Your threat is malware or phishing.
• You are on a network you control and trust.
• You need to log into services that block VPNs, and the only way through is a shared address that many people also use.

If your goal is not to be identifiable at all, use Tor. If the goal is to stop a café or an employer from reading the sites you visit, a correctly configured VPN is a reasonable, cheap control.

Sources

• RFC 7457 — an IETF document cataloguing attacks on VPN deployments, including the ones above. Not a marketing document.
• Mullvad policy, Proton VPN no-logs and IVPN policy — read as source claims from three providers that publish specific policies, and compare what each commits to.