@palladin9479 : I don't *totally* disagree with you, and generally I'd say that you're giving good advice. But this VPN stuff is a topic with several layers – so... let's start by discarding the deliberate honeypots, the free products that harvest your data, and the well-meaning but dangerously incompetents. They're real issues you need to consider, but not all VPN providers are frauds.
Disclaimer: I've obviously never done anything bad myself, nor can I point to cases where other people have been busted. Be skeptical of my claims. It's generally safer to be distrustful, but don't fall into paranoia.
Disclaimer: I'll focus almost exclusively on VPN related issues in this post. If you do shady stuff, you're more likely to get into trouble from a bunch of other things. You won't find the information you need to avoid trouble on these forums, and I will not even attempt to provide guidance. But in the interest of keeping people safe: picking a nonstandard browser, adding some cookie-blocking extensions and disabling Javascript is not enough.
I'll start the VPN part by making some general observations, then try to add a bit of nuance. First: it's important to establish your security/privacy parameters – what do you *need*, and which consequences can you expect from various choices. Do you have a fuzzy "I want privacy!" goal? Are you a political dissident in an oppressive regime? (You'd hopefully be looking for advice somewhere better-equipped). Do you have currently-legal political beliefs or a sexual orientation that might be threatened after some near-future election cycle?
I'll cover a fair amount of stuff – a bunch of it won't apply to regular people in semi-functional democracies who just want to surf the pirate bays a bit.
A VPN provider that's willing to go to court deserves respect. A paranoiac might claim that this could be a false showcase to make people feel safe, but that's a bit far-fetched IMHO. Do keep in mind that willingness to take a court fight is only *temporary* "evidence", though – a track record is definitely something you should include in your threat modelling, but you have no guarantee against new legislation, infiltration of the company, software vulnerabilities, or something as banal as a new CEO that needs to maximize shareholder interest.
You should know you're dealing with two parts: the hard guarantees you are getting from the underlying technology, and the confidence you're placing in the company providing the service. If you're doing something that's illegal, ultimately the tech part will be your only source of protection – policies can and *will* change.
At the technology level, a traditional VPN tunnel is a *very strong link* between your source network and your VPN provider. The traffic between you is encrypted, so other people (even your ISP, the cops and security agencies) won't be able to eavesdrop. But your VPN provider knows your source address, they can do netflow tracing, they have *some* financial records (even if it's just bitcon wallet addresses). Your provider might not keep persistent records, they might not be law-enforcement friendly – but it's a traffic concentration point, which makes them interesting. VPN infrastructure is a juicy target for criminals as well as law enforcement.
They might not be logging anything today, but they could be forced tomorrow – through wide-reaching legislation, a standard court order, or insidious stuff like the US's National Security Letters. (And sure, you can avoid a bunch of these concerns by picking a European VPN provider, we have a lot of consumer safeguards. Unless you're doing bad enough stuff to be interesting to the Nine Eyes.)
@palladin9497 mentions NSA-style passive observation – this is something that happens, and if your threat model includes that level of adversary, you should know that a VPN isn't going to help a whole lot; they have similar capabilities by being adjacent to the VPN operator data centers, and having pretty hardcore metadata correlation analysis capabilities. They don't flex those muscles for petty crime, though.
The same goes for TOR – you can do "fun stuff at home" without repercussions, but if you get into freedom fighting or the heavy end of libertarian trading systems, you need several layers on top of that (and realistically, even if you're good, you can only keep this up for a limited amount of time – the compartmentalisation you need to practice just isn't sustainable).
So, what are some common scenarios where people want privacy or anonymity?
You want to watch streaming content from a different geographical region. Unlikely to get you in trouble, but you might as well just go torrenting. You're violating ToS and disagreeing with the insane Digital Restrictions Mafia, but trying to convince yourself you're A Good Boy because you're paying the outer-layer streaming provider.
Your ISP is snooping on you (outside of law enforcement because you did something nasty) – I didn't consider this scenario until now, it's a pretty alien scenario in the EU. Same category as "I want safety on public wifi", pick a reputable non-free provider that doesn't have gran anonymity claims.
You're torrenting. Depending on where you are, this might be dangerous to do directly from your ISP, and if you're lucky, a VPN might make the situation better because it's a small-fry crime that your provider can shield you against. On the other hand, perhapsyou've chosen a "privacy-focused" VPN provider, which suddenly gets targeted by LEO because of its "privacy focus", and you go down for petty crime with several thousand other people.
You're a political dissident. and the sites you're visiting aren't getting enough attention that your VPN provider is compromised. However, you thought you were being safeguarded by the VPN, but to avoid fingerprinting you would've had to use (at least) a compartmentalized Whonix client + router VM setup, from a randomized selection of public access points... but now you've been jailed, probably looking forward to a bit of torture.
...And that's my attempt at a more thorough "you porbably shouldn't be doing VPN". There might be scenarios I haven't thought of, and there's a couple of alternatives I haven't covered – like setting up your own VPN on a VPS provider, which will at least cloak your IP and require some money trail tracing... but that's an advanced scenario where you need to be very realistic about your goals.
Facebook
Twitter
Instagram