"All of them claim to be the best": Multi-perspective study of VPN users and VPN providers

TL;DR

This study provides a comprehensive analysis of the VPN ecosystem from both user and provider perspectives, revealing trust issues, misconceptions, and misalignments that impact VPN effectiveness and user security.

Contribution

It is the first to compare VPN user and provider perspectives through surveys and interviews, uncovering key insights and misalignments in trust, mental models, and motivations.

Findings

Users trust review sites motivated by money

Users have flawed mental models of VPN protection

Significant misalignment between user trust and provider transparency

Abstract

As more users adopt VPNs for a variety of reasons, it is important to develop empirical knowledge of their needs and mental models of what a VPN offers. Moreover, studying VPN users alone is not enough because, by using a VPN, a user essentially transfers trust, say from their network provider, onto the VPN provider. To that end, we are the first to study the VPN ecosystem from both the users' and the providers' perspectives. In this paper, we conduct a quantitative survey of 1,252 VPN users in the U.S. and qualitative interviews of nine providers to answer several research questions regarding the motivations, needs, threat model, and mental model of users, and the key challenges and insights from VPN providers. We create novel insights by augmenting our multi-perspective results, and highlight cases where the user and provider perspectives are misaligned. Alarmingly, we find that users rely on and trust VPN review sites, but VPN providers shed light on how these sites are mostly motivated by money. Worryingly, we find that users have flawed mental models about the protection VPNs provide, and about data collected by VPNs. We present actionable recommendations for technologists and security and privacy advocates by identifying potential areas on which to focus efforts and improve the VPN ecosystem.