Security Knight in Shining Armor: What and Who VPN Providers Claim to Shield Consumers Against

Abstract

Consumer virtual private network (VPN) providers promise online security and privacy by tunneling user traffic through their servers. However, there is a growing disparity between the users’ perceptions of achievable security and privacy and the actual limitations of such services. In a large-scale, multi-step mixed methods study, we holistically investigated the degree to which 78 consumer VPN providers support or undermine proper mental models for their products and services. We collected search queries from 300 participants - coming from five countries across four continents - to identify suitable VPN providers and, subsequently their security and privacy promises. Among VPN providers’ statements, a large share contains misleading or false information, and more than half do not mention any threat agent at all. Our results extend the current research on consumer VPNs and provide a more realistic, holistic, and accurate overview of information on VPN provider websites.