> We asked Cure53 to focus solely on one OpenVPN and one WireGuard server. The scope included paying attention to anything that would impact privacy alongside their regular white-box security testing. Cure53 were given access to both servers, as well as the Ansible code used to deploy them.
> For this audit we deployed two VPN servers in our staging environment. Our staging environment is configured identically to production, bar that no customers connect to it, and the servers are virtual on hardware we own.
How is it an audit if you're not auditing production? Maybe some use cases can get away with it, but when the objective is privacy and security, environment differences can have helluva lot of implications.
They also don't seem to have been audited for no-logs. But they are very popular here for being a privacy focused service. What gives?
Proton becomes increasingly pricier every year. It provides lot of servers but they are not owned by proton, those are residential proxies. Many of the names listed are discussed in forums having questionable privacy.
But good thing with proton is, you are bound to find a server which can open a specific website. I routinely find myself getting blocked by reddit or internet archive, unlimited google captachs, YouTube needing sign in, but there is always a server which can unblock this. However, if you check the isp for it, it lists some residential proxy.
Their desktop client is bloated, takes a lot of time to load, their vpn connections randomly disconnect or slow down.
When I got frustrated with their pricing and their vpn client, I switched to mullvad.
Sign up was really simple. Since they only charge a constant price, their onboarding experience felt smooth.
Their desktop client is small enough, it starts quickly.
But issues with mullvad surfaces during use. Many websites are blocked. I haven’t found a server which can open reddit. YouTube always need sign in. Only few servers open internet archive. Some servers even get blocked by HN.
Speed is extremely slow than proton. Their were no disconnects or reconnects, but I just couldn’t open websites which I frequently visit.
In the end, I went back to proton, I needed to browse the internet without getting blocked. Rest of the cons I grudgingly manage.
This article is good enough as a cursory read to know which vpn to begin exploring, but provides no information of the authors own experience.
For eg, mullvad has resellers, if you purchase from their, you can compromise your privacy completely. I don’t know why mullvad has this arrangement, considering their promise.
Also mullvad website has a dns leak check, which will always show dns leaking if you are not connected to mullvad. But if you check literally any other dns leak website, even their competitors like nord or surfshark, it gives a “not leaking” response. This is scummy behaviour from mullvad.
Only if you connect with mullvad, their status shows green.
Similarly, In the article about proton, there is no mention about proton using affiliates or resellers. Neither any mention about proton controlled servers.
Comparison page which has disconnected information , is not useful.
Perhaps the author can do better by actually using VPN’s, navigating their website, policies, vpn clients, than depending on Claude to do the writing. Otherwise, there is little value in such articles.
I run a small VPN review site and kept finding "independently audited" in marketing copy with no report behind it. So I built a table of all 71 providers I cover and recorded only audits where there's a dated report or announcement from the provider or the auditor, with a link to each.
Disclosure: I used Claude to do the first pass of the research and to build the page. It fetched every source URL and I checked the ones it flagged as uncertain by hand (Norton, NordVPN, hide.me, CactusVPN).
Results: 23 have at least one audit. 48 have never published any. 30 audits in the last 24 months, almost all no-logs attestations; only a handful cover apps or infrastructure.
Surprises: NordVPN's reports are only readable inside a customer account. Cloudflare's KPMG examinations cover the 1.1.1.1 resolver and never mention WARP, so WARP is listed as unaudited. Several big names have exactly one audit from years ago.
I wonder how the deals page ( /deals/black-friday-vpn ) is ordered. It's not by price, name, offer scope or discount relative to the standard price. Is it by referral margin?
> I checked the ones it flagged as uncertain by hand
I think it is fine to use Claude. But only checking results or sources in cases where AI flagged them would feel like a major methodological oversight.
Going through mullvad's audit report,
> We asked Cure53 to focus solely on one OpenVPN and one WireGuard server. The scope included paying attention to anything that would impact privacy alongside their regular white-box security testing. Cure53 were given access to both servers, as well as the Ansible code used to deploy them.
> For this audit we deployed two VPN servers in our staging environment. Our staging environment is configured identically to production, bar that no customers connect to it, and the servers are virtual on hardware we own.
How is it an audit if you're not auditing production? Maybe some use cases can get away with it, but when the objective is privacy and security, environment differences can have helluva lot of implications.
They also don't seem to have been audited for no-logs. But they are very popular here for being a privacy focused service. What gives?
I have used proton and mullvad.
Proton becomes increasingly pricier every year. It provides lot of servers but they are not owned by proton, those are residential proxies. Many of the names listed are discussed in forums having questionable privacy.
But good thing with proton is, you are bound to find a server which can open a specific website. I routinely find myself getting blocked by reddit or internet archive, unlimited google captachs, YouTube needing sign in, but there is always a server which can unblock this. However, if you check the isp for it, it lists some residential proxy.
Their desktop client is bloated, takes a lot of time to load, their vpn connections randomly disconnect or slow down.
When I got frustrated with their pricing and their vpn client, I switched to mullvad.
Sign up was really simple. Since they only charge a constant price, their onboarding experience felt smooth.
Their desktop client is small enough, it starts quickly.
But issues with mullvad surfaces during use. Many websites are blocked. I haven’t found a server which can open reddit. YouTube always need sign in. Only few servers open internet archive. Some servers even get blocked by HN.
Speed is extremely slow than proton. Their were no disconnects or reconnects, but I just couldn’t open websites which I frequently visit.
In the end, I went back to proton, I needed to browse the internet without getting blocked. Rest of the cons I grudgingly manage.
This article is good enough as a cursory read to know which vpn to begin exploring, but provides no information of the authors own experience.
For eg, mullvad has resellers, if you purchase from their, you can compromise your privacy completely. I don’t know why mullvad has this arrangement, considering their promise.
Also mullvad website has a dns leak check, which will always show dns leaking if you are not connected to mullvad. But if you check literally any other dns leak website, even their competitors like nord or surfshark, it gives a “not leaking” response. This is scummy behaviour from mullvad.
Only if you connect with mullvad, their status shows green.
Similarly, In the article about proton, there is no mention about proton using affiliates or resellers. Neither any mention about proton controlled servers.
Comparison page which has disconnected information , is not useful.
Perhaps the author can do better by actually using VPN’s, navigating their website, policies, vpn clients, than depending on Claude to do the writing. Otherwise, there is little value in such articles.
I run a small VPN review site and kept finding "independently audited" in marketing copy with no report behind it. So I built a table of all 71 providers I cover and recorded only audits where there's a dated report or announcement from the provider or the auditor, with a link to each.
Disclosure: I used Claude to do the first pass of the research and to build the page. It fetched every source URL and I checked the ones it flagged as uncertain by hand (Norton, NordVPN, hide.me, CactusVPN).
Results: 23 have at least one audit. 48 have never published any. 30 audits in the last 24 months, almost all no-logs attestations; only a handful cover apps or infrastructure.
Surprises: NordVPN's reports are only readable inside a customer account. Cloudflare's KPMG examinations cover the 1.1.1.1 resolver and never mention WARP, so WARP is listed as unaudited. Several big names have exactly one audit from years ago.
I wonder how the deals page ( /deals/black-friday-vpn ) is ordered. It's not by price, name, offer scope or discount relative to the standard price. Is it by referral margin?
> I checked the ones it flagged as uncertain by hand
I think it is fine to use Claude. But only checking results or sources in cases where AI flagged them would feel like a major methodological oversight.