Practical privacy and simple cybersecurity.
TheNewOil.org

2022 Review: IVPN

Disclosure: The New Oil is sponsored by IVPN. Per the terms of this agreement, IVPN does not have any input on our review, but we want to disclose any possible conflicts of interest up front. You can read all of our guidelines for sponsorships here.

What is IVPN?

A VPN – or Virtual Private Network – is a service that creates an encrypted tunnel between the device – be it a phone, computer, or router – and the VPN server. From there, your traffic continues on to your desired destination – such as TheNewOil.org – like normal. IVPN is a service headquartered in Gibraltar, a mostly-autonomous British territory. IVPN offers two plans, Standard and Pro. Both plans offer all protocols (Wireguard, OpenVPN, PPTP, and IPSec IKEv2) and the anti-tracker no-logs DNS service. The Standard Plan covers 2 devices while Pro covers 7 and includes port forwarding and multi-hop servers.

Why Do You Need a VPN?

You may not, to be honest. (Interestingly, IVPN openly shares this opinion. Check out their site “Do I Need a VPN?” here). A lot of people really hype VPNs as one of those absolutely, must-have, life-changing things that will solve all your problems. In all honesty, while I do believe that VPNs are an essential piece of your privacy strategy, there are many other free or low-cost strategies that will give you significantly more protection. A VPN these days pretty much only has two purposes: changing your IP address and protecting your traffic from local snoops. Changing your IP address is a valuable part of avoiding tracking, but it’s just one way and a VPN won’t protect you against those others like browser fingerprinting, tracking pixels, cookies, and more. Likewise, while it can be great to protect your traffic from your Internet Service Provider or a local cybercriminal, from a security perspective you’re already pretty well covered so long as you enable your browser’s HTTPS-Only mode and make sure you’re using the correct sites and not spoofed sites. Having said all that, I do still consider a VPN to be a critical part of your privacy and security posture. It can bypass censorship, stop your ISP from selling your browsing data, help obscure your IP address from tracking and logging, and protect your traffic from local attackers.

Why Not Tor?

Some people prefer Tor over VPNs. Tor is definitely right in certain situations, but not all of them. For one, many essential services – like banks – block known Tor IP addresses to prevent fraud and abuse, making using those services nearly impossible. Second, Tor loses almost – if not – all of its anonymity once you login to something. If you login to your email and then your Reddit account in the same session, they’re now tied to together and you’ve lost your anonymity benefit. For this reason, I recommend reputable VPNs for any services that are tied to your real identity or sensitive and Tor for random searches or accounts that are not tied to your real identity.

The Good

IVPN has some really impressive positive aspects. For one, they are committed to ethical marketing. Their site talks about how they don’t believe in paying for reviews or unethical ads, their commitment to transparency, and as I linked above they even have a website that aims to dispel many of the myths surrounding VPNs and what they can and can’t do – even if it costs them potential customers. They’d rather lose an educated customer who knows that IVPN won’t solve their problems than dupe a paying customer who won’t get the protection they really need.

IVPN’s security is also top notch. We have covered numerous stories on Surveillance Report about vulnerabilities in widespread VPN protocols or infrastructure, and nearly every one has noted “IVPN is not vulnerable to this,” usually because they patched their systems months ago or have some other mitigation in place that just so happens to protect against the vulnerability in question. (Of course, IVPN is not the only one immune to these bugs, but out of the three we endorse on The New Oil they’re the only one that is consistently ahead of the curve). I was also pleased to see that Wireguard was their default protocol – which is a recently-developed VPN protocol that’s considered to be faster, lighter, and because the code is so small it’s more easily auditable, which hopefully in the long run will mean less vulnerabilities. Though of course, the other protocols listed above are still available for those who want something a bit more time-tested or have a different need.

The information required at signup is none. Seriously. You can click “generate an IVPN account” on their homepage and it just does. They also accept Monero directly without a third-party exchange being involved, which means that if done right, IVPN is easily 100% anonymous. Of course, you can add an email if you feel so inclined, and you can pay with a card (including a privacy.com card), but at no point do they require any of this from you. It’s totally voluntary.

Finally, their country of origin – Gibraltar – offers some redeeming aspects. Gibraltar is legally a UK territory, but they are given a long leash by the government and operate mostly as an autonomous region. This turned out to be a good thing when post-Brexit, Gibraltar decided to legally adopt GDPR for themselves. From what I understand, it was largely untouched except for a few legal definitions to clarify that it was being applied to Gibraltar.

A few other neat things I noticed in my time testing them out:

The Bad

IVPN does have a few drawbacks, but they’re very few and far between. The most noticeable one, in my opinion, is the low server selection. They offer only 77 servers in 31 countries. I personally didn’t find this to be an issue at all, but when going up against other providers who offer hundreds of servers in well over fifty countries, it's a bit surprising. IVPN also makes no promises of working on streaming services, and I can confirm this. One time, I put IVPN on pause for 3 hours while Henry and I recorded Surveillance Report. After we were done, I moved on and started watching a movie on HBO Max. After about an hour, HBO Max suddenly brought me to an error page. After a moment of frustrated confusion, I realized IVPN had turned back on and HBO Max had stopped buffering. Oops. Ultimately I’m still glad it came back on without me having to remember. I've also had a few issues sometimes with Spotify not loading, but usually this was as simple as turning the VPN off and back on. Finally, as a Qubes user, I was disappointed to see they offered no Qubes support, especially since they place such a high emphasis on security.

Now let’s talk about the speed test. A lot of people have come to expect blazing fast internet these days, and unfortunately I have found a noticeable – though personally minimal – decline in speed with IVPN. Using Speedtest.net, without the IVPN app even running, I was connected to Kapper.net in Vienna (I suspect this means that IVPN made some permanent changes to my DNS, you’ll see why in a second). My ping was 135ms, download speed was 281.09 Mbps, and upload speed was 21.90 Mbps. (Once again: dear ISP, if you’re reading this, I’m paying you for gigabit.) I then opened the IVPN app, which had previously been completely closed out, connected to the fastest server (which for some reason is in Vienna despite me being in Arizona). Running the test again, I was still connected to Kapper.net but my new speeds became a ping of 172 ms, a download speed of 45.62Mbps, and an upload speed of 16.84Mbps. Yikes. Having said that, I’m not an online gamer or streamer, so these speeds are not critical to me. Everything loaded in a reasonable time, from videos to web pages and apps. It was noticeable compared to my usual VPN, but it was certainly nothing debilitating that I couldn’t get used to and live with. Then again, I know some people expect their pages to load completely in less than a second from initial click to “finished loading.” If you’re one of these people who has not yet learned the art patience, this may not be the VPN for you.

Perhaps the biggest drawback lies in their home country. As I said before, Gibraltar operates largely autonomously and did go out of their way to legally apply GDPR to themselves after Brexit. However, they are still a UK territory. Hong Kong used to be mostly independent, too, until they weren’t. At the time of this writing, the UK is conducting a massive surge in anti-encryption rhetoric, with the government paying over a half-million pounds to a powerful marketing firm to launch a smear campaign against encryption and turn the public opinion against it. The reason we list a country of origin as a pro or con based on their Eyes affiliation is because it sets a tone. If a country is part of the Eyes, it shows that they have a lower regard for the privacy of their citizens and they are willing to share data and violate privacy. Likewise, while Gibraltar may value privacy, they belong to a country that clearly does not, and if the UK decides to crack down on their anti-privacy stance in Gibraltar, this could be very damaging to IVPN. Keep in mind: this is pure speculation. There is no evidence at this time that the UK is pressuring Gibraltar or IVPN or what forms that kind of pressure might take if it did come to pass. I also have zero doubt that Gibraltar and IVPN would push back against these unethical requests. However, at the end of the day, they fall under UK jurisdiction, and if they lose these battles, it could be a problem. Again, I cannot stress enough that this purely a “what if” scenario, but given the UK’s open and outright hostility against privacy, it’s worth having this concern on your radar.

Conclusion

My last couple weeks of using IVPN has been pretty pleasant. There were some roadblocks to overcome as I made the switch from my usual provider – probably mostly just cause of that human urge to resist change. I will be keeping Proton on the router for the sake of using streaming services, but overall my IVPN experience was great. Signup was shockingly smooth, apps were easy to find and install, and settings were explained well and straightforward. If you’re looking for a streaming-friendly VPN, Proton is probably the way to go. But if you’re not a big streamer and you want maximum security, IVPN is probably the best out there.

You can learn more and sign up for IVPN here. No affiliate link.

You can find more recommended services and programs at TheNewOil.org, and you can find our other content across the web here or support our work in a variety of ways here. You can also leave a comment on this post here: Discuss...