Why your VPN isn’t as secure as you think

Macworld

There are two main reasons for using a VPN. The first is to circumvent geoblocking when watching films or TV shows, or accessing cheaper services abroad. The second, and perhaps more serious, is to achieve stronger data security.

As far as the second group of users is concerned, VPNs are vital tools for surfing the web with peace of mind. The VPN server provides an additional layer of security and encrypts your data–something that’s especially important if you can’t vouch for a Wi-Fi network. If you’re on holiday, for example, you may be forced to fall back on free Wi-Fi at the hotel or a cafe, thereby putting yourself at the mercy of hackers who would love to steal your data.

If you just want to check the news headlines or briefly browse YouTube, this risk is probably acceptable. However, if you need to transfer company data or hold a sensitive Teams conference, it would be sensible to put additional protections in place.

How hackers can beat a VPN

Using a VPN raises the level of your data security, but it’s important to be aware that this doesn’t make you impervious to attack. Hackers, unfortunately, have tricks up their sleeve that can outwit a VPN, which has led to criticism of their security in recent years. One expert, Michael Horowitz, has even argued that VPNs on iOS are a scam.

One potential threat, for example, is the TunnelVision attack method. If a hacker gains administrative control over the local network, they may be able to activate a DHCP setting called option 121, which means some or all of the transmitted data is no longer protected by the VPN.

If you want optimum protection, in other words, simply using a VPN is not enough. You need to pay attention to the additional security features on offer.

See our round up of the Best VPNs for Mac, which includes the best options we have reviewed.

The importance of a kill switch

The key feature to seek out is called a kill switch, something that is offered by reputable VPN providers such as NordVPN (reviewed here) and Surfshark (reviewed here). The name might sound alarming, but it just means an emergency switch. It’s an important element in your security setup.

The problem is that a VPN connection can sometimes be interrupted without the user immediately realizing this has happened; the user then inadvertently sends and receives data outside of the VPN’s protection, which makes it easier for hackers to strike. In this situation, a kill switch automatically terminates the internet connection and warns the user. Such a kill switch is often able to block attacks such as TunnelVision, at least under macOS. However, this function is not provided by all VPN providers and may vary between macOS and iOS.

Even the free version of Proton VPN (reviewed here) for iOS offers an emergency switch, for example, whereas Norton’s paid-for VPN (reviewed here) unfortunately only works on macOS, Windows, and Android.

Depending on the system, the kill switch can either affect the entire system or just individual apps. With Nord VPN, for example, you can use the macOS version to specifically protect selected apps via the kill switch, whereas with iOS the entire internet connection is affected and all apps are protected. This is the case with most VPN services on iOS.

However, this option is not always active in the default setting; you may need to activate the function first via the app’s default settings. Needless to say, this is strongly recommended.

Also see our Best VPNs for iPad.

Extreme security: Going beyond the kill switch

While a strong VPN service with a kill switch should provide more than enough protection for a desktop Mac, there remains a residual risk on iOS. In practice, at least in my opinion, this threat is negligible. But if you want to be on the safe side, some products offer yet more security options. ExpressVPN, for example, offers a function called Network Protection, which provides additional security on the iPhone. (Bear in mind that this also blocks useful network functions such as Personal Hotspot and CarPlay.)

Mullvad (reviewed here) has also developed an additional security function for iOS called DAITA (Defence Against AI-guided Traffic Analysis). With this option, the VPN server adds additional data and changes the packet size. The aim is to make it impossible for outsiders to decrypt the intercepted encrypted data. However, this only works with certain servers, and for most home users a good VPN with a kill switch should be completely sufficient.