Study finds that most Android VPNs are not as secure as they claim, compromise on anonymity

If you intend to mask your data traffic and protect your anonymity, the first place you’ll turn to is a VPN (Virtual Private Network). A recent study has found, however, that most Android VPNs are not secure. In theory, a VPN will protect your data because it’s supposed to mediate your internet access. By using various techniques such as encryption and masking, a secure VPN will obfuscate traffic coming to and going from your device. It will also act as a firewall of sorts and protect you from malicious traffic. A study conducted by Australia’s Commonwealth Scientific and Industrial Research Organisation, the University of South Wales and the University of California analysed around 300 VPN apps for Android. As ArsTechnica reports, the results are disturbing. They point out that 18 percent of apps don’t encrypt traffic, 16 percent inject code into your data stream, 84 percent leak IPv6 and DNS data and more. You can read the whole horror story here. As the researchers explain, “Millions of users worldwide resort to mobile VPN clients to either circumvent censorship or to access geo-blocked content, and more generally for privacy and security purposes.” They go on to explain that most users don’t actually have any guarantees of safety and are unaware of the security and privacy settings to look out for. In conclusion, the study finds that while developers have access to a number of in-built tools for enabling a secure VPN service on Android, the lack of transparency on the part of most developers renders the service insecure, even for “tech savvy” users. It also finds some shortcomings in Android’s VPN permission model that can break Android’s sandboxing (an important security feature). Among the lone stars of the study was the F-Secure Freedome VPN service, which impressed the researchers with its security features.