VPN, no BS | PivLab

VPN is one of the most over-hyped tools in cybersecurity. No marketing: what a VPN really gives you, what it does not, and how to pick a provider worth trusting.

1. What a VPN is NOT

› It does not give anonymity. It shifts trust from your ISP to the VPN provider. Sites still profile you via cookies, accounts and browser fingerprinting.
› "Military-grade encryption" is a slogan. It's ordinary AES-256 — the same as every HTTPS connection. Marketing, not an edge.
› It does not protect against malware or phishing. A VPN isn't antivirus. It encrypts traffic to a malicious site just as happily as to a good one.
› It does not hide you from your logged-in accounts. When signed in to Google/Facebook, they know it's you — regardless of your IP.

2. What a VPN actually does

› Encrypts traffic on untrusted networks — public Wi-Fi, hotels, airports. A snooper on that network sees only ciphertext.
› Hides your real IP from websites — they see the VPN server's address, not yours.
› Hides your destinations from the ISP — they only see that you connect to a VPN, not where you go next.
› Bypasses geo-blocks and network censorship.

3. A VPN shifts trust — it doesn't remove it

Without a VPN, your ISP sees your traffic. With one, the ISP no longer does — but the VPN provider does (and its jurisdiction). You're not hiding "from everyone" — you're choosing whom to trust. That's why the choice of provider matters more than simply "having a VPN".

4. How to choose a good provider

Criteria (must-have):

› Independent, published audit (security and the no-logs policy).
› Transparent ownership and jurisdiction — you know who's behind it and where.
› No-logs PROVEN — by audit or a court case, not just a claim on the website.
› RAM-only servers (diskless) — nothing persists after a reboot.
› WireGuard (modern, fast protocol) + a kill-switch.
› Anonymous payment (cash/crypto), if unlinkability matters to you.

⚠️ Red flags: free VPNs (they sell your data — you're the product), "lifetime licences", aggressive affiliate hype, slogans like "100% anonymity" / "military-grade", no audit at all.

5. Threat model: VPN vs Tor

Goal	Tool
Protection on public Wi-Fi	VPN (enough)
Hide IP from a site / geo-unblock	VPN
Privacy from your ISP	VPN
Anonymity (no one links traffic to you)	Tor (not VPN)

A VPN is one point of trust. Tor spreads trust across 3 relays, none of which knows the whole path. For anonymity: Tor / Tails, not a VPN.

6. Three levels — match it to your needs

BASIC

A reputable, audited VPN (Proton VPN or Mullvad), kill-switch ON, for public Wi-Fi and geo-unblocking. Regular payment. Goal: don't get sniffed in a café and hide your IP from sites.

ADVANCED

Mullvad paid with crypto/cash + an account number (no email, no personal data), the WireGuard protocol, the provider's ad-blocking DNS, multi-hop, split-tunneling. VPN built into the router (OpenWRT + WireGuard) → the whole network is tunnelled, not just one device. Regular leak tests (DNS/IPv6/WebRTC).

EXPERT

You understand that anonymity ≠ VPN → for that, Tor/Tails. Deliberate chains: VPN→Tor (to hide from the ISP the very fact you use Tor). Self-hosted WireGuard on your own VPS/router — only when you want to trust only yourself or need access to your home network (this is NOT anonymity — the server is tied to you). Your own DNS resolver, VLAN segmentation, leak monitoring.

7. Self-hosted WireGuard (example)

Client config — all traffic through the tunnel, your own DNS:

[Interface]
PrivateKey = <client_private_key>
Address    = 10.0.0.2/32
DNS        = 10.0.0.1          # your own resolver on the server

[Peer]
PublicKey  = <server_public_key>
Endpoint   = your-server.example:51820
AllowedIPs = 0.0.0.0/0, ::/0   # capture ALL traffic
PersistentKeepalive = 25

⚠️ AllowedIPs = 0.0.0.0/0 + a firewall rule "block everything except interface wg0" = a simple kill-switch. And again: self-hosting gives you control and self-trust, but not anonymity — the VPS is registered to you.

8. Honest picks

› Mullvad — an account number instead of email, cash/crypto payment, flat price (~€5/mo, no "deals"), audited, RAM-only. Strongest for privacy.
› Proton VPN — audited, Switzerland, a free plan with no data cap, Secure Core (multi-hop), open-source clients.
› IVPN — audited, minimalist, strong anti-tracking, anonymous payment.

We are not affiliated with any of the listed providers. Own opinions, no affiliate links. As of 07/2026 — always check the current audit.

9. PivLab — setup

We'll set up a VPN that actually works: WireGuard on an OpenWRT router (whole network in the tunnel, with a kill-switch), a self-hosted VPN for home access, or picking a commercial provider matched to your threat model — with no DNS/IPv6 leaks.

⚡ TL;DR

VPN ≠ anonymity. For anonymity → Tor.
A VPN protects on untrusted networks, hides your IP from sites and unblocks geo. That's it.
You shift trust from the ISP to the provider → pick an audited one (Mullvad / Proton VPN / IVPN).
Run from: free VPNs, "lifetime" deals, "military-grade", "100% anonymity".
WireGuard + kill-switch. Self-hosting = self-trust, not anonymity.

PivLab informational material. The right tools depend on your threat model — if in doubt, get your setup reviewed individually.

VPN — no BS