Because this post got a lot of traction, some more context:

Last year (2025) I had drinks with another VPN dude at a meeting, and he worked for a holding company that owned many VPN companies. They acquired them pretty regularly and integrated them best they could.

I asked why keep all the separate brands and marketing if it’s all basically the same thing, and he explained the market is segmented. Some users believe a particular VPN is better for gaming, or business, or torrenting, or porn, or cheapest or whatever.

It actually hurt them the couple times they tried to merge brands, so now they try to merge all they can behind the scenes technically but keep the brand identities separate.
#DEFCON #VPN #Tor

Next up, a #DEFCON #VPN service sounds awesome. Like with email there is plenty of expertise on how to build VPNs. Technically it is a realistic goal, so let's investigate!

To be attractive to a large customer base you need to offer a lot of locations with an ever changing pool of addresses for when some get blocked by someone in the world.

Those two things mean you need a pool of providers and great automation playbooks where you can easily spin up and provision "secure" VPN gateways all over the world.

Because of the reliance on 3rd parties, unlike with email, you now have to worry about the legal concept of the 3rd party doctrine, so have some more lawyers ready to do battle.

Then two things happened, I spoke with two different people with experience in the VPN game. First someone who served as a CTO to a large VPN provider.

They spent all their time trying to save money, automate more, and respond to non-stop customer complaints from over seas business people. China would block some VPN addresses and they could no longer connect to their company back home and they needed to do that RIGHT NOW. So a sort of daily fire drill. The increasing VPN competition meant they had to keep spending on advertising and cost control.

The second person put the final nail in the coffin. They explained as far as they could tell about half of all VPN providers had ties to intelligence services. Either as fronts or investors or super friendly "partners". Iran, Russia, China, North Korea, some Middle Eastern countries, all play in this space.

This means half of the VPN providers have a different business model than the other half. Their goal is maximum people at the least cost to cast as large a monitoring net as possible, and revenue from paying customers doesn't have to actually cover your operating costs.

Building a #VPN service the right way would mean we would be more expensive, in fewer locations, and support only the strongest technologies - all things that would reduce your pool of potential customers.

So, like the private email idea, it was interesting to investigate, we learned a lot, and we will never enter the VPN market.

Instead we run free #Tor relays and support @torproject Please support Tor and other privacy technologies.

Also
- @ooni
defending the public's right to know: https://blog.torproject.org/Defending-the-right-to-know/
- @unredacted building infrastructure to keep the doors open: https://blog.torproject.org/keeping-the-doors-open-unredacted/, and
- @0n_odv experimenting with seize-proof type relays: https://blog.torproject.org/exploring-stateless-relays/

As well as many organizations, tools, and projects fighting against censorship and for access to information & secure communications including @guardianproject, @securedrop