Which VPNs have published an independent audit, with sources
top10vpns.com
top10vpns.com
> We asked Cure53 to focus solely on one OpenVPN and one WireGuard server. The scope included paying attention to anything that would impact privacy alongside their regular white-box security testing. Cure53 were given access to both servers, as well as the Ansible code used to deploy them.
> For this audit we deployed two VPN servers in our staging environment. Our staging environment is configured identically to production, bar that no customers connect to it, and the servers are virtual on hardware we own.
How is it an audit if you're not auditing production? Maybe some use cases can get away with it, but when the objective is privacy and security, environment differences can have helluva lot of implications.
They also don't seem to have been audited for no-logs. But they are very popular here for being a privacy focused service. What gives?
Proton becomes increasingly pricier every year. It provides lot of servers but they are not owned by proton, those are residential proxies. Many of the names listed are discussed in forums having questionable privacy.
But good thing with proton is, you are bound to find a server which can open a specific website. I routinely find myself getting blocked by reddit or internet archive, unlimited google captachs, YouTube needing sign in, but there is always a server which can unblock this. However, if you check the isp for it, it lists some residential proxy.
Their desktop client is bloated, takes a lot of time to load, their vpn connections randomly disconnect or slow down.
When I got frustrated with their pricing and their vpn client, I switched to mullvad.
Sign up was really simple. Since they only charge a constant price, their onboarding experience felt smooth.
Their desktop client is small enough, it starts quickly.
But issues with mullvad surfaces during use. Many websites are blocked. I haven’t found a server which can open reddit. YouTube always need sign in. Only few servers open internet archive. Some servers even get blocked by HN.
Speed is extremely slow than proton. Their were no disconnects or reconnects, but I just couldn’t open websites which I frequently visit.
In the end, I went back to proton, I needed to browse the internet without getting blocked. Rest of the cons I grudgingly manage.
This article is good enough as a cursory read to know which vpn to begin exploring, but provides no information of the authors own experience.
For eg, mullvad has resellers, if you purchase from their, you can compromise your privacy completely. I don’t know why mullvad has this arrangement, considering their promise.
Also mullvad website has a dns leak check, which will always show dns leaking if you are not connected to mullvad. But if you check literally any other dns leak website, even their competitors like nord or surfshark, it gives a “not leaking” response. This is scummy behaviour from mullvad.
Only if you connect with mullvad, their status shows green.
Similarly, In the article about proton, there is no mention about proton using affiliates or resellers. Neither any mention about proton controlled servers.
Comparison page which has disconnected information , is not useful.
Perhaps the author can do better by actually using VPN’s, navigating their website, policies, vpn clients, than depending on Claude to do the writing. Otherwise, there is little value in such articles.
Genuine interest: Why? I bought one of their vouchers in the past. How did I compromise my privacy?
Let's say you know that I bought a Mullvad voucher, from first-party or third-party store. What would be your next steps you would take to get to know me?
A good selection of resellers is important because it allows users to choose where to put their trust. For example:
If you buy from the Mullvad reseller proxystore.de in Germany, you can go there in person and pay with cash. It's a real place.
Without such resellers, the only other way to pay Mullvad with cash is to mail an envelope to them.
Do you believe that every VPN service paid without cash (or maybe Monero et al) is inherently compromised? That would follow from your argument, right?
It is also not "even Amazon" knowing about the sale. When you buy from a reseller using a non-cash payment method, you shift the link to your identity from Mullvad to the reseller. You are compartmentalizing the transaction to isolate the payment flow from the account registration. To stick with your example: If you buy from Amazon, you remove that payment information from Mullvad and add it to Amazon, a generic mass market online shop.
The reseller does not know if you will activate the voucher, and if you do, they don't know if you will activate it yourself or give it to someone else. Mullvad does not know the ID that might have been used to buy the voucher.
Having niche as well as mainstream resellers is also a good thing: Many users buy from Amazon all the time. For those people, being able to use Amazon means they do not have to add payment details to another store, which might result in an unusual payment compared to their usual purchasing behavior. For users not wanting to use Amazon, there is no harm in ignoring this specific reseller on Amazon.
Having the ability to use resellers adds privacy.
In your initial comment, you wrote:
> I don’t know why mullvad has this [reseller] arrangement, considering their promise.
We have now (briefly) talked about threat modeling, compartmentalization, linkability/observability, obfuscation, as well as having user choice regarding the shop.
So now you know why Mullvad has this reseller arrangements, considering their promise.
You disregard privacy policy of organizations you deal with. You have no audit reports of amazon or any other retailer to know what they do with your private and purchase information. Since you don’t have that, you are only hypothesising that 3rd party platforms will keep you safe.
Therefore, arrangement between mullvad and their resellers are questionable.
Like I said, you do you.
Assuming someone already has an amazon account so they have a name, address, and credit card on file, when it comes to the VPN, that purchase history is all they'd get right? That'd be the same as everything you buy. If I use amazon to buy a toaster, they know I bought a toaster. They don't know if I give it to someone as a gift, or what times I used that toaster, or if I ever use it at all, or what I do with the toaster I bought.
Assuming Amazon sells your purchase history to a data broker it would show them that you paid for a VPN service, but not if you ever used it, or when you used it, or what you used it for. If you live somewhere where using any kind of VPN at all is illegal I suppose that would bad, but otherwise is getting flagged as "has paid for and maybe used a VPN server" something that can make you unsafe? Is it any more/less safe than being flagged as "has bought and maybe used a toaster"?
I've seen people suggest similar scratch off cards as age verification, and that has real security issues because the cards are to be used at websites who shouldn't have any idea what your identity is. The website knows what IP used which code, at what time though and so it might be possible to link the use of a code to the place where it was purchased, and identify the person who used it that way. When pre-paid calling cards were a big thing this is how they tracked down people who abused them. That's not an issue for VPN scratch off cards though, because the codes are only used at the VPN provider's website. Anyone not using the cards is already giving that website their identity, so using the cards would just be mean there are extra steps to figuring out who paid for them.
Disclosure: I used Claude to do the first pass of the research and to build the page. It fetched every source URL and I checked the ones it flagged as uncertain by hand (Norton, NordVPN, hide.me, CactusVPN).
Results: 23 have at least one audit. 48 have never published any. 30 audits in the last 24 months, almost all no-logs attestations; only a handful cover apps or infrastructure.
Surprises: NordVPN's reports are only readable inside a customer account. Cloudflare's KPMG examinations cover the 1.1.1.1 resolver and never mention WARP, so WARP is listed as unaudited. Several big names have exactly one audit from years ago.
> I checked the ones it flagged as uncertain by hand
I think it is fine to use LLMs. But only checking results or sources in cases where AI flagged them would feel like a major methodological oversight.