SoylentNews is people
SoylentNews
*** Note that Proton has a commercial interest in VPNs. This may be biased reporting ***
https://www.cnet.com/tech/services-and-software/proton-vpn-report-location-tracking-privacy/
With a fast VPN, your speed loss will be virtually unnoticeable.
Using a virtual private network is a surefire way to keep your information private when browsing the internet. But a new report from Proton, released on Wednesday, exposes some major holes in that concept.
A VPN is a tool that encrypts your internet behavior and hides your IP address and physical location, with the goal of keeping your identity and identifying information secure. But 64 of the VPN apps downloaded in the US, Proton found, are owned by Chinese companies and contain trackers that collect all sorts of user information, including device IDs, network information, device models and mobile carrier data.
And 25% of the apps in question were found to actively track your location.
In June alone, these apps were downloaded over 13 million times.
Narrowing down the numbers further, Proton found that 31 of those Chinese-owned VPNs use shell companies registered in jurisdictions such as Singapore, Hong Kong and the UK to further hide their identities.
An authoritarian government like China’s could use this information to track a person’s location. So if a public official, someone in law enforcement, a journalist or even someone attending a protest was using one of these VPNs for safety, this flaw would expose them to potential threats.
It should be clear that China isn’t the only country where companies harvest the data these apps collect, but it’s near the top of the list. Israel, Russia and the Five Eyes countries — Australia, Canada, New Zealand, the UK and the US — all have companies collecting tracking data from millions of people.
Transparency is a big issue here, with a load of bad VPN apps being readily available for download through Apple and Google. Proton’s report points out that both companies require developers to submit their own paperwork to verify their apps, with little verification (and no independent audits) being done on Apple’s or Google’s part. Apple and Google didn’t immediately respond to requests for comment.
This lack of guardrails in the verification process makes it hard to decipher which virtual private network apps protect your privacy and do what their policies promise and which are virtually doing the opposite.
“Proton's report is yet another example of why it's so important to know who's behind your VPN and what data they're collecting,” CNET Senior Writer Attila Tomaschek said. “It's also another reminder that just because a VPN app is popular in Apple's or Google's app marketplaces, it doesn't necessarily mean that the VPN app is safe to use.”
If you’re looking for a VPN, Tomaschek points to VPNs like Proton and ExpressVPN, which regularly rank near the top of CNET’s VPN recommendations. Each virtual private network is put through a rigorous testing process that includes a thorough examination of the app’s privacy policy, transparency reports, audits, corporate structure and legal jurisdiction.
When all else fails, avoid any VPN that is murky about any of those key principles. “Instead, opt for a trustworthy VPN that is crystal clear about where it’s based, who’s behind it and how it protects user privacy,” Tomaschek said.
(Score: 1) by day of the dalek on Saturday September 05, @08:58AM (1 child)
What SN does is above my pay grade of $0. So I don't know the specifics of this.
But I am trying to get better privacy protections in my state advocating for this in the legislature. One of the benefits of volunteering to help with campaigns is getting to share my concerns with people who may well be elected in November. While I don't much like Flock cameras, I've been telling elected officials and people running for office that there are even much bigger risks from other businesses like data brokers.
Last year, my identity got stolen, a fraudulent financial account was opened in my name, and I didn't find out until many months later when debt collectors started calling. Despite federal laws to know your customer, the financial institution never requested an ID, and there wasn't any sort of live selfie or other verification. The phone number and email address used weren't mine. There appears to have been no employment verification. They never checked any of the major credit bureaus. Despite the many red flags, they made virtually zero effort to verify the person's identity before letting someone enter in my name, address, DOB, and SSN online, and open a fraudulent account in my name.
When I found out and contested it, the financial institution decided I wasn't liable for the charges, and that manual approval would be needed if the account was used to apply for any other products from the institution. Their response implies that they never even bothered to disable and close the fraudulent account. Since this financial institution is known to sell customer information to data brokers, they may well have shared my name and address along with the attacker's phone number and email address. And that means a criminal's contact information gets mixed in with my real data, and that gets sold to other data brokers. That potentially puts me at risk if I need to have something like a background check done later.
If the account is still open, which I believe it is, and a second attacker managed to access it, they could presumably get personal information like my SSN and steal my identity again. This financial institution already had a massive data breach a few years ago. I never gave them my personal information, so they have no right to it, But because a criminal provided it to them, I believe my personal data is sitting on their servers where it can be misused or stolen again. Let's just say I'm already taking action to hold the financial institution accountable, and I expect to find out if they're going to be cooperative within the next few weeks.
You'd better believe I'm pissed off about the lack of regulations to protect my data. I have zero confidence in the Congress to do a damn thing. So the next time the state legislature is in session, you can count on me sharing my story to anyone who will listen, and I'll be pushing for bills to be introduced that include some very strict privacy regulations. The financial institution is an out-of-state business, so you'd better believe I'll be pushing for any new laws to apply to anyone handing the personal data of any resident of my state.
Perhaps I'll cross-post this in the poll and hope it doesn't get modded as spam.
Stay thirsty, my friends.
Leviticus 19:33-34
(Score: 3, Funny) by janrinok on Saturday September 05, @11:13AM
That is exactly the same pay grade that all SN staff are on too! All pay rises are based on a percentage of our current pay :)