Use of a VPN

[Call_Me_Op]

I am curious as to whether Bogleheads use a VPN when online (using your home WiFi or home ethernet) and if so, for what category of websites? My understanding is that financial websites will already employ an encrypted connection, so what would be the point of using a VPN for those sites? Perhaps using a VPN to access already secure financial sites add a layer of vulnerability.(?)

[Rob5TCP]

I use it for privacy not security. FIOS doesn't need to know every single website I got to.

[dukeblue219]

A VPN provides a layer of encryption for your whole network connection by routing it through an intermediary. It effective when trying to disguise your location or when concerned that someone in between might see which sites you are visiting (e.g., a totalitarian government etc).

It does not particularly make your online banking transactions any safer than a modern TLS encrypted http connection. I don't use one and see little point.

It can also be employed by a business or university to authenticate users and allow access "behind the firewall" rather than allowing any network connection to attempt to access resources.

[Call_Me_Op]

I use it for privacy not security. FIOS doesn't need to know every single website I got to.

OK, makes sense.

[Call_Me_Op]

A VPN provides a layer of encryption for your whole network connection by routing it through an intermediary. It effective when trying to disguise your location or when concerned that someone in between might see which sites you are visiting (e.g., a totalitarian government etc).

It does not particularly make your online banking transactions any safer than a modern TLS encrypted http connection. I don't use one and see little point.

It can also be employed by a business or university to authenticate users and allow access "behind the firewall" rather than allowing any network connection to attempt to access resources.

Good points - thanks.

[cheesepep]

I usually use my iPad mini with unlimited data as a WiFi hotspot when I’m away from home. When using it r when using my home’s WiFi, I use no vpn. Any other times such as when I’m at a hotel, I do use a vpn.

[Scorpion Stare]

I use it for privacy not security. FIOS doesn't need to know every single website I got to.

Note that you are hiding your activity from your internet service provider, but you are exposing it to the VPN provider instead. This is beneficial if you trust the VPN company with your data more than you trust your ISP. That’s probably a reasonable choice in many cases, given the poor privacy practices of many ISPs... but it means the choice of VPN provider is critical!

[jebmke]

I use it for privacy not security. FIOS doesn't need to know every single website I got to.

Note that you are hiding your activity from your internet service provider, but you are exposing it to the VPN provider instead. This is beneficial if you trust the VPN company with your data more than you trust your ISP. That’s probably a reasonable choice in many cases, given the poor privacy practices of many ISPs... but it means the choice of VPN provider is critical!

Question: does the ISP still "see" the destination if one uses a different DNS? I don't use my ISP's DNS - mostly because it seem slower and sometimes goes down (even if the internet is up).

[Wiggums]

I use it for privacy not security. FIOS doesn't need to know every single website I got to.

Note that you are hiding your activity from your internet service provider, but you are exposing it to the VPN provider instead. This is beneficial if you trust the VPN company with your data more than you trust your ISP. That’s probably a reasonable choice in many cases, given the poor privacy practices of many ISPs... but it means the choice of VPN provider is critical!

Question: does the ISP still "see" the destination if one uses a different DNS? I don't use my ISP's DNS - mostly because it seem slower and sometimes goes down (even if the internet is up).

All an alternative DNS provider offers is a different lookup between a domain name and an IP address - the IP data still goes through your ISP, along with your request headers, which have to include the domain name

[Wiggums]

I don’t use a VPN at home. When traveling you may not always be able to connect to a trustworthy network, which means prying eyes may be able to access the data you transmit.

[jebmke]

I use it for privacy not security. FIOS doesn't need to know every single website I got to.

Note that you are hiding your activity from your internet service provider, but you are exposing it to the VPN provider instead. This is beneficial if you trust the VPN company with your data more than you trust your ISP. That’s probably a reasonable choice in many cases, given the poor privacy practices of many ISPs... but it means the choice of VPN provider is critical!

Question: does the ISP still "see" the destination if one uses a different DNS? I don't use my ISP's DNS - mostly because it seem slower and sometimes goes down (even if the internet is up).

All an alternative DNS provider offers is a different lookup between a domain name and an IP address - the IP data still goes through your ISP, along with your request headers, which have to include the domain name

Thanks. I wasn't sure and don't really care - I don't go very many "places" on the internet and not concerned who "knows."

If I am somewhere like a hotel or condo I typically use a small travel router in WISP mode more for convenience and isolating from the local network.

[ruralavalon]

I am curious as to whether Bogleheads use a VPN when online (using your home WiFi or home ethernet) and if so, for what category of websites? My understanding is that financial websites will already employ an encrypted connection, so what would be the point of using a VPN for those sites? Perhaps using a VPN to access already secure financial sites add a layer of vulnerability.(?)

I don't use a VPN.

[DeliberateDonkey]

Only for work. I think it's important to ask what type of risk you're trying to mitigate before adding new layers of complexity to your computing setup.

For what it's worth, some of the largest companies in the world host their email and internal documents in Microsoft's cloud via Office 365. Most of them do not require their employees to use a VPN to connect to those services and publish or retrieve said data, even from personal devices. I am, therefore, not terribly concerned about using a VPN to connect to Fidelity and review my account balance.

[ThereAreNoGurus]

I am curious as to whether Bogleheads use a VPN when online (using your home WiFi or home ethernet) and if so, for what category of websites?

A VPN can be used to circumvent location-based content blocks. For example, some live sporting events may restrict viewing based on the visitor's location.

[jebmke]

I am curious as to whether Bogleheads use a VPN when online (using your home WiFi or home ethernet) and if so, for what category of websites?

A VPN can be used to circumvent location-based content blocks. For example, some live sporting events may restrict viewing based on the visitor's location.

Don't the terms of service exclude this most of the time, technical workaround notwithstanding?

[dan7800]

I am curious as to whether Bogleheads use a VPN when online (using your home WiFi or home ethernet) and if so, for what category of websites?

A VPN can be used to circumvent location-based content blocks. For example, some live sporting events may restrict viewing based on the visitor's location.

Don't the terms of service exclude this most of the time, technical workaround notwithstanding?

How would anyone find out?

When I was in China a few years back, I used a VPN all the time. I didn't want the govt spying on me and many US sites were blocked.

[jebmke]

I am curious as to whether Bogleheads use a VPN when online (using your home WiFi or home ethernet) and if so, for what category of websites?

A VPN can be used to circumvent location-based content blocks. For example, some live sporting events may restrict viewing based on the visitor's location.

Don't the terms of service exclude this most of the time, technical workaround notwithstanding?

How would anyone find out?

When I was in China a few years back, I used a VPN all the time. I didn't want the govt spying on me and many US sites were blocked.

so, you are suggesting violating the terms of a contract because nobody will find out?

[ThereAreNoGurus]

I am curious as to whether Bogleheads use a VPN when online (using your home WiFi or home ethernet) and if so, for what category of websites?

A VPN can be used to circumvent location-based content blocks. For example, some live sporting events may restrict viewing based on the visitor's location.

Don't the terms of service exclude this most of the time, technical workaround notwithstanding?

Not the VPN's I have used. In fact many VPN's advertise it as an advantage of using a VPN. Here's an example: https://www.avg.com/en/signal/what-is-a ... ou-use-one# (scroll down).

On that page it also says: "A VPN lets you access shows from your home country when you’re traveling abroad."

(I've never used this VPN, but a quick search turned this one up first.)

[jebmke]

I am curious as to whether Bogleheads use a VPN when online (using your home WiFi or home ethernet) and if so, for what category of websites?

A VPN can be used to circumvent location-based content blocks. For example, some live sporting events may restrict viewing based on the visitor's location.

Don't the terms of service exclude this most of the time, technical workaround notwithstanding?

Not the VPN's I have used. In fact many VPN's advertise it as an advantage of using a VPN. Here's an example: https://www.avg.com/en/signal/what-is-a ... ou-use-one# (scroll down).

On that page it also says: "A VPN lets you access shows from your home country when you’re traveling abroad."

(I've never used this VPN, but a quick search turned this one up first.)

That isn't the TOS I'm thinking of. The one I'm thinking of is the streaming host.

[ThereAreNoGurus]

That isn't the TOS I'm thinking of. The one I'm thinking of is the streaming host.

Oh. Well, of course. The poster above circumventing China's censorship and spying activities is one such example.

Edited to add: There is a cat and mouse game between the VPN's and certain websites where they will try to block ip's of known VPN's.

[tennisplyr]

Interesting topic, put another way, why wouldn't someone use a VPN?

[Normchad]

I don’t use a VPN, except for work where it’s required.

There is a lot of interest in VPNs these days for states like Utah and Virginia. My neighbors tell me their kids are asking about them…..

[jebmke]

Interesting topic, put another way, why wouldn't someone use a VPN?

I'm certainly not an expert but two reasons I have seen cited are (a) the resource load on the device/network and (b) the uncertainty about the privacy of the VPN provider through which all the data is flowing.

I don't have a strong sense either way except my tendency is to not implement a layer of technology for which I have no use case. Note, I'm not saying others don't have a use case, only that I don't.

[Normchad]

Interesting topic, put another way, why wouldn't someone use a VPN?

I'm certainly not an expert but two reasons I have seen cited are (a) the resource load on the device/network and (b) the uncertainty about the privacy of the VPN provider through which all the data is flowing.

I don't have a strong sense either way except my tendency is to not implement a layer of technology for which I have no use case. Not, I'm not saying others don't have a use case, only that I don't.

This is very well said and makes a lot of sense. For me, what problem is it actually solving?

I just personally don’t spend much time or concern worrying about my privacy. I like my privacy, but I figure it’s all out there somewhere.

Since I use Amazon and google so heavily, I assume I don’t have any actual online privacy. They already know everything…..

If you haven’t done it yet, go to google or apple, and ask them for a copy of all the data they have on you. It’s Amazing. Facebook would be the same I’m sure.

But yeah, a VPN wouldn’t make my life any better….

[aristotelian]

I have Opera browser which includes a free VPN. However, I don't use it unless I have a special need, such as getting around a blackout restriction for a certain sports game.

[dukeblue219]

so, you are suggesting violating the terms of a contract because nobody will find out?

I'm not saying it's right, but paying for Netflix and using a VPN to pretend to be in France so one can watch Friends instead of subscribing to Peacock which has US rights is hardly the crime of the century.

It happens.

[Wiggums]

Interesting topic, put another way, why wouldn't someone use a VPN?

Might elect to not use a vpn if you are on a private network like verizon fios or verizon wireless.

Your employer might require a vpn to access internet facing company resources.

[LambertStrether]

so, you are suggesting violating the terms of a contract because nobody will find out?

I'm not saying it's right, but paying for Netflix and using a VPN to pretend to be in France so one can watch Friends instead of subscribing to Peacock which has US rights is hardly the crime of the century.

It happens.

From Netflix's Terms of Use (https://help.netflix.com/en/legal/termsofuse), emphasis added.

4.3. You may access the Netflix content primarily within the country in which you have established your account and only in geographic locations where we offer our service and have licensed such content. The content that may be available will vary by geographic location and will change from time to time. The number of devices on which you may simultaneously watch depends on your chosen subscription plan and is specified on the "Account" page.

If Netflix wanted to prohibit using VPNs outright, they would, and they have the tools to enforce it.

[dukeblue219]

Interesting topic, put another way, why wouldn't someone use a VPN?

Tends to be slower to access websites, messes up geolocation (sure we all want privacy, but it's convenient sometimes when websites already know the nearest store), that kind of thing. Also your traffic is mixed with other users who are hiding for nefarious reasons, so it's not uncommon to be on a VPN node that gets blocked by some servers (guilt by association).

[mkc]

[Topic is now in Personal Consumer issues. Thank you to the member who reported it and explained what was wrong. mod mkc]

[CardinalRule]

Interesting topic, put another way, why wouldn't someone use a VPN?

Tends to be slower to access websites, messes up geolocation (sure we all want privacy, but it's convenient sometimes when websites already know the nearest store), that kind of thing. Also your traffic is mixed with other users who are hiding for nefarious reasons, so it's not uncommon to be on a VPN node that gets blocked by some servers (guilt by association).

There is definitely a bit of a performance penalty. I subscribe to Malwarebytes Privacy (not sure if I will renew next year) and often have it turned off. This morning I ran the Speedtest app and noted the following:

With VPN (Mbps)
Down 150, up 33

Without VPN (Mbps)
Down 343, up 40

It's not really noticeable with my high-bandwidth plan - 150 Mbps is obviously enough for most practical purposes. Toggling it off and on as I do might not be ideal - if I have it on, certain websites won't recognize the newly assigned "private IP address," pushing me to MFA. I do select a local VPN server location - Malwarebytes has a server for my city. This helps with shopping, directions, etc. ,

[TacoLover]

Yes I use one. Every once in a while my bank doesn't allow me to login so I turn it off to login to the bank. My mortgage lender doesn't allow me to login with a vpn either so I turn it off the 2 or 3 times a year I login to check that account. Otherwise it's on. I'd like less people not more people knowing my business.

[rockstar]

so, you are suggesting violating the terms of a contract because nobody will find out?

I'm not saying it's right, but paying for Netflix and using a VPN to pretend to be in France so one can watch Friends instead of subscribing to Peacock which has US rights is hardly the crime of the century.

It happens.

From Netflix's Terms of Use (https://help.netflix.com/en/legal/termsofuse), emphasis added.

4.3. You may access the Netflix content primarily within the country in which you have established your account and only in geographic locations where we offer our service and have licensed such content. The content that may be available will vary by geographic location and will change from time to time. The number of devices on which you may simultaneously watch depends on your chosen subscription plan and is specified on the "Account" page.

If Netflix wanted to prohibit using VPNs outright, they would, and they have the tools to enforce it.

I traveled abroad, downloaded a bunch of Netflix content to tablet before I went, and then made the mistake of connecting to my hotel wifi in a different country. All of my downloaded content went poof. So I had to download content based on what was available in the country I was staying. The fact that content has national border is super frustrating.

I've been experimenting a VPN for the last week. It's interesting. They are not all equal. Some have port forwarding. Some don't. Some will effectively change your location for streaming. Some won't. Some use WireGuard and OpenVPN. Some only use of the two or their own home brew.
And then privacy practices by VPN vary widely as does the country they're domiciled in and where there servers are located. I read that Iceland has the best privacy practices, but it's hard to find VPN servers there. And speed by VPN varies widely too.

[Call_Me_Op]

Here's one use for a VPN. I was concerned that a local bank I use never asks for 2-factor authentication. So today, I logged in using a VPN, with my location set to Canada. I was pleased that their system prompted me for 2FA right after I provided my username. (Wouldn't even let me get to the password prompt without 2FA verification- which is good.)

[jebmke]

The fact that content has national border is super frustrating.

Not just national. Sports events are often blacked out in specific geographies in the US.

[rockstar]

The fact that content has national border is super frustrating.

Not just national. Sports events are often blacked out in specific geographies in the US.

Watching sport content in general is super frustrating. I like EPL and La Liga. I never know each season how I'll watch it. Though EPL seems to be mostly NBC these days.

And then privacy laws are all over the place too.

Also, don't forget that net neutrality got tossed out.

[TacoLover]

The fact that content has national border is super frustrating.

Not just national. Sports events are often blacked out in specific geographies in the US.

I use Mullvad. It allows me to set my home. So my computer can be in Iceland or Russia that I would think would allow me to watch sports anywhere. I would think. Don’t know.

[HawkeyePierce]

A VPN is an unfortunate hack at best and snake oil at worst.

If your goal is:

1) To hide your traffic from your internet provider, ask yourself why a VPN provider is any more trustworthy. Prove to me your VPN provider isn't also hostile to you or already compromised (hint: you can't).

2) To keep yourself safe on public wifi, understand that HTTPS already provides all the security you're looking for. A VPN does not help here.

3) To access corporate network resources, fine. Hopefully this use case dies out over the next few years but for now it's an unfortunate reality at too many companies.

(I'm going to ignore the media blackout circumvention use case)

Most people want a VPN to hide traffic from their network operator, but HTTPS is better at this than a VPN anyways. Yes, the network operator can still see which sites you're visiting (but not the page or any of its contents) but using a VPN just shifts that from the ISP to the VPN operator.

There is zero risk in accessing banking or investment sites over public wifi without a VPN.

[roamingzebra]

Here's one use for a VPN. I was concerned that a local bank I use never asks for 2-factor authentication. So today, I logged in using a VPN, with my location set to Canada. I was pleased that their system prompted me for 2FA right after I provided my username. (Wouldn't even let me get to the password prompt without 2FA verification- which is good.)

I once ordered something from an online retailer I had never done business with before. The order went through, then a couple of days later it was cancelled. I asked them why and they said that the internet server I was using was located too far distant from my home address. It turns out that I was using a VPN server in Europe while claiming my home address was in the US (yes, I sometimes change server like this for variety). I quickly changed my VPN server back to the US, re-ordered, and the order went through.

So some companies do location checks to make sure there isn't a mismatch. That's something to keep in mind.

Overall, though, I have found it extremely rare for a website to give me problems based on using a VPN. Captchas that I sometimes encounter have more to do with ultra-strict browser settings than anything to do with a VPN.

[roamingzebra]

A VPN is an unfortunate hack at best and snake oil at worst.

If your goal is:

1) To hide your traffic from your internet provider, ask yourself why a VPN provider is any more trustworthy. Prove to me your VPN provider isn't also hostile to you or already compromised (hint: you can't).

It would be great if ISPs accepted cash or gift cards, but the vast majority don't. VPNs are more likely to offer this as a payment method. Someone who really needs a VPN to, for example, be proactive against coming changes in the state laws regarding certain personal behaviors, then it would behoove them to use a VPN that accepts cash/gift cards (i.e., gift card purchased with cash) and/or has a solid track record of audits, etc.

Agree with everyone on the use of VPNs primarily for privacy not security, though of course there is overlap between the two.

I personally use a VPN just because I like privacy. Period. Privacy used to be the default state of the citizenry. Now, along with a rise in authoritarin regimes around the world, there is the growing use and power of Big Data and the two in combination are, well, not a great combination.

[Yuen]

Most people want a VPN to hide traffic from their network operator, but HTTPS is better at this than a VPN anyways. Yes, the network operator can still see which sites you're visiting (but not the page or any of its contents) but using a VPN just shifts that from the ISP to the VPN operator.

The premise is that VPN users are more privacy-focused and are not logging even the fact you connected to a https site. Obviously this is a matter of trust but many VPN providers explicitly say they do zero logging so there is nothing to provide to advertisers or the government. Your ISP generally makes no such promises.

You can say "they can't see what you're doing, so who cares?" Unfortunately, inferences can be made based on what site you were going to even if someone can't see what. "I saw your car in the parking lot of the porno theater downtown but I didn't see what movie you went into." Replace the location with any controversial place and you will see there is a lot of information gained just by knowing the site you visited.

There is zero risk in accessing banking or investment sites over public wifi without a VPN.

That's demonstrably false. There is never zero risk. Spoofed wifi access points, man in the middle attacks are all possible when relying on the wifi you assume to be legitimate turns out to not be.

See this for more info: https://www.okta.com/identity-101/evil-twin-attack/
https://blog.envisionitsolutions.com/co ... l-from-you

A VPN is a legitimate protection tool for privacy and security. It is not snake oil.

[rockstar]

Most people want a VPN to hide traffic from their network operator, but HTTPS is better at this than a VPN anyways. Yes, the network operator can still see which sites you're visiting (but not the page or any of its contents) but using a VPN just shifts that from the ISP to the VPN operator.

The premise is that VPN users are more privacy-focused and are not logging even the fact you connected to a https site. Obviously this is a matter of trust but many VPN providers explicitly say they do zero logging so there is nothing to provide to advertisers or the government. Your ISP generally makes no such promises.

You can say "they can't see what you're doing, so who cares?" Unfortunately, inferences can be made based on what site you were going to even if someone can't see what. "I saw your car in the parking lot of the porno theater downtown but I didn't see what movie you went into." Replace the location with any controversial place and you will see there is a lot of information gained just by knowing the site you visited.

There is zero risk in accessing banking or investment sites over public wifi without a VPN.

That's demonstrably false. There is never zero risk. Spoofed wifi access points, man in the middle attacks are all possible when relying on the wifi you assume to be legitimate turns out to not be.

See this for more info: https://www.okta.com/identity-101/evil-twin-attack/
https://blog.envisionitsolutions.com/co ... l-from-you

A VPN is a legitimate protection tool for privacy and security. It is not snake oil.

There are also issues with Net scaler that came out recently.

https://arstechnica.com/security/2023/0 ... loitation/

https://support.citrix.com/article/CTX5 ... ve20233467

But at the end of the day, it's more of a privacy tool. And the US doesn't rank high for privacy.

[jebmke]

But at the end of the day, it's more of a privacy tool. And the US doesn't rank high for privacy.

Based on how many people use Facebook, it doesn't seem to be a priority.

[warner25]

Interesting topic, put another way, why wouldn't someone use a VPN?

Tends to be slower to access websites

There is definitely a bit of a performance penalty... It's not really noticeable with my high-bandwidth plan - 150 Mbps is obviously enough for most practical purposes.

It's not just about bandwidth; there's also additional latency of going from A (your machine) to B (the VPN gateway) to C (the destination server) instead of a more direct path from A to C.

[rockstar]

Interesting topic, put another way, why wouldn't someone use a VPN?

Tends to be slower to access websites

There is definitely a bit of a performance penalty... It's not really noticeable with my high-bandwidth plan - 150 Mbps is obviously enough for most practical purposes.

It's not just about bandwidth; there's also additional latency of going from A (your machine) to B (the VPN gateway) to C (the destination server) instead of a more direct path from A to C.

What task are you doing that requires both privacy and low latency?

[HawkeyePierce]

Most people want a VPN to hide traffic from their network operator, but HTTPS is better at this than a VPN anyways. Yes, the network operator can still see which sites you're visiting (but not the page or any of its contents) but using a VPN just shifts that from the ISP to the VPN operator.

The premise is that VPN users are more privacy-focused and are not logging even the fact you connected to a https site. Obviously this is a matter of trust but many VPN providers explicitly say they do zero logging so there is nothing to provide to advertisers or the government. Your ISP generally makes no such promises.

You can say "they can't see what you're doing, so who cares?" Unfortunately, inferences can be made based on what site you were going to even if someone can't see what. "I saw your car in the parking lot of the porno theater downtown but I didn't see what movie you went into." Replace the location with any controversial place and you will see there is a lot of information gained just by knowing the site you visited.

There is zero risk in accessing banking or investment sites over public wifi without a VPN.

That's demonstrably false. There is never zero risk. Spoofed wifi access points, man in the middle attacks are all possible when relying on the wifi you assume to be legitimate turns out to not be.

See this for more info: https://www.okta.com/identity-101/evil-twin-attack/
https://blog.envisionitsolutions.com/co ... l-from-you

A VPN is a legitimate protection tool for privacy and security. It is not snake oil.

Yes, many VPN providers say they don’t log anything. Then it turns out they’re lying.

https://www.theregister.com/2020/07/17/ ... _database/

Look, I don’t trust my ISP either but the VPN world is filled with false promises and there’s nothing to guarantee they’re acting as they claim.

[warner25]

What task are you doing that requires both privacy and low latency?

I'm puzzled by your question. I do academic research in this area, and it's a known trade-off but the goal is maximum privacy with minimal performance impacts. With high enough latency, you routinely see things like protocol handshakes timing out and needing to be initiated again, or TCP retransmissions causing goodput to crash, which is at least pretty annoying.

Personally, I have used a paid VPN service only when living overseas and wanting to appear like I'm still in the US. The performance impact was very substantial, but worth it for my use case. My research now involves Tor, so I use it in that capacity, but I'll be the first to tell you that it's not ready for everybody and every use case, in part due to the high latency.

[rockstar]

What task are you doing that requires both privacy and low latency?

I'm puzzled by your question. I do academic research in this area, and it's a known trade-off but the goal is maximum privacy with minimal performance impacts. With high enough latency, you routinely see things like protocol handshakes timing out and needing to be initiated again, or TCP retransmissions causing goodput to crash, which is at least pretty annoying.

Personally, I have used a paid VPN service only when living overseas and wanting to appear like I'm still in the US. The performance impact was very substantial, but worth it for my use case. My research now involves Tor, so I use it in that capacity, but I'll be the first to tell you that it's not ready for everybody and every use case, in part due to the high latency.

There has been a lot of research on Bufferbloat:

https://www.bufferbloat.net/projects/bl ... fferbloat/

I run either CAKE or fq_codel to mitigate it at home on a dedicated router even though my DOCSIS 3.1 cable modem has PIE.

I tested out the Bufferbloat on a VPN that I'm trying out this month, and it's in the 100+ ms unloaded. Now, I am running it on a guest os in vmware player. It's bad enough that I wouldn't play a MMO online with it, but I don't really care if someone knows that I play a given MMO. And the latency isn't as bad as the time before Bufferbloat received a lot of research and mitigations. For casually looking at websites, the latency isn't big enough to bother me.

I don't see VPN as a doable always on solution yet. But it's something that can be turned on and off as needed for use cases.

[stan1]

What task are you doing that requires both privacy and low latency?

Personally, I have used a paid VPN service only when living overseas and wanting to appear like I'm still in the US. The performance impact was very substantial, but worth it for my use case. My research now involves Tor, so I use it in that capacity, but I'll be the first to tell you that it's not ready for everybody and every use case, in part due to the high latency.

But it's something that can be turned on and off as needed for use cases.

What are these use cases? Living outside the US especially outside of developed market counties of US/Western Europe/Australia/NZ/Japan is one. Spoofing your geographic location such as for streaming video or access to other US only websites is another. Committing crime might be one but I'm sure no Boglehead would do that. I'd really have to think about personal or business relationships with foreign nationals from certain countries, but that opens you up to a lot of other threat vectors and targeting in general but that could actually make it worse. It might be easier to target a VPN in Panama than a US ISP. I'd try to minimize any data I send to such a person. Not sure what the others are?

[roamingzebra]

Personally, I have used a paid VPN service only when living overseas and wanting to appear like I'm still in the US. The performance impact was very substantial, but worth it for my use case. My research now involves Tor, so I use it in that capacity, but I'll be the first to tell you that it's not ready for everybody and every use case, in part due to the high latency.

WhiIe residing in the US, I routinely use VPN servers based in a variety of countries throughout the US, Europe and Asia. I personally don't notice any difference in speed, though I don't measure it.

But I once tried TOR, and it was excrutiatingly slow.

So from my personal perspective, VPNs are perfectly fine for everyday use; TOR is a no-go.