[VonGuard]

Been saying it for YEARS: 95% of VPNs sell your data. It's where they make their money. It's absolutely insane the push-back I get when I say this online. I get downvoted to hell and back.

Source: I bought this data from VPN companies... Hell, you can inject ads and surveys if you want!

[Dylan16807]

> 95% of VPNs sell your data

This is believable.

> It's where they make their money.

I'm much more skeptical of this. I know linus tech tips is not exactly an expert organization, but I believe the discussions they've had about almost starting a VPN and backing out for ethical reasons, and they made it clear that the core VPN product would have huge profit margins. You can always do greedy things to make more money, but for a paid VPN I'd need some solid evidence to believe that data sales are a huge line item or especially that they're the main source of money.

If you're including the swaths of free VPNs then that makes your number a lot harder to use.

[flexagoon]

> Source: I bought this data from VPN companies

I'm more interested in this part - how does that work? Do you just reach out to them directly and ask "hey, let me buy your user data"? Or is there some sort of service they offer?

[Lammy]

I wouldn't be surprised if a lot of them have like a Crypto AG thing going on and have the capability to use paying customers as exit nodes as a way to launder consent-manufacturing bot bullshit through legitimate-looking residential and mobile connections.

[eloisant]

Fun fact: I once interviewed for a company offering a free VPN, which was actually using other users as endpoints for the VPN. Some kind of P2P VPN if you will.

How did they make money? Easy: there were also selling a botnet! So if you used their "free VPN", you could be part of a botnet for DDOS or to create fake reviews/upvotes from thousands of "legit" IP addresses.

[Ms-J]

Yes, I've heard of bad VPN companies that sell your data. I would like to learn more about how it is done exactly.

In your later comment you said "DNS is very useful, and unencrypted. OpenDNS makes its money on this same info." Is the VPN company only openly selling DNS info or are they selling more, such as connection logs?

How did you approach the VPN provider to ask to buy this info?

[throwawayq3423]

> Hell, you can inject ads and surveys if you want!

So am I right in saying that the data that's encrypted by VPNS is only in transit? It then sits on a server in plain text, ready to be queried by third parties for money.

[andrecarini]

Yes, VPNs add encryption only between you and the VPN servers.

[mr_mitm]

How does that work with HTTPS being practically ubiquitous?

[rileymat2]

HTTPS spills what services you are communicating with, but not the content…

…except approximate content sizes and timing patterns.

[zubiaur]

They sell metadata. DNS queries, locations, apps using data, device info. Usually anonymized, but both unscrupulous and "better" providers do have access to your account and payment info.

[tredre3]

I reckon that if HTTPS was sufficient to hide your online activity, then you wouldn't need a VPN to hide it in the first place.

[Lammy]

If HTTPS were for privacy it would be called HTTPP. Security features tend to make things less Private, like how opening apps on a Mac makes it phone home for OCSP check.

[mrmuagi]

what VPN companies?

[freetime2]

And what types of data?

[jesterson]

> 95% of VPNs sell your data. It's where they make their money. It's absolutely insane the push-back I get when I say this online.

People love to stick to what they irrationally believe in. I would give you push back as well by saying 95% is a very conservative number. I would say 98-99%

But hey, they say they don't sell my data isn't it?

[VonGuard]

And look! I am downvoted again!

How does this work? They harvest your DNS! They inject surveys into your YouTube packets. They tabulate just how much traffic goes to which specific games on Twitch. How? The provider is the endpoint, not you.

It's not the whole picture, but it's enough to sell to marketers.

This is what happens EVERY time I say this! Look again! It happened, I have 1 upvote... It's almost as if the VPN companies don't want you to believe this is true!

Story time! I have been cashed out of three startups. $600 total, across them all. It's the people in the Valley who've struck out over and over who know the truth, not the successes.

One of those startups was about tracking the games played on Twitch, and selling that info to Esports entities, marketing firms, etc. The company did not succeed because, honestly, it's not hard data to scrape yourself. BUT, we tried. And where did we get our data? VPN providers. Major VPN providers. We don't care about your personal data. We care about whether you watched a Twitch stream of GTA or Madden.

And for a time, yes, we could buy injected surveys. Packets, literally injected into your streams of data. This was expensive, iffy, and controversial, but it was on the rate cards.

DNS is very useful, and unencrypted. OpenDNS makes its money on this same info. Stop putting your heads in the sand. Ya'll have seriously lost the path.