VPN Anonymous Registration & Payments criteria

Site Development
1

Preface: Previous post Reviewing Privacy Guides's Criteria for VPNs, and Cryptostorm and AirVPN was deleted due to having multiple criteria suggested instead of one per post for some reason, so breaking it up here. If you disagree with something, please be constructive and specific so a discussion can be had.

This is Post/Suggestion 1: Anonymous Registration & Payments

If you narrow VPNs down by those that have the “bare minimum” of generally accepted security and anonymity principles which I define to be one that has no logs, no analytics, anonymous payments (meaning they accept at least one of either XMR or cash), anonymous registration/logins (i.e. email is not required and/or generates a random alphanumeric “account”), and is (relatively) well known [such as showing up on Techlore’s list VPN Comparison Tool | Techlore VPN Toolkit ] you have (non-exhaustively of course, but using that as a baseline): Mullvad VPN, IVPN, Windscribe, hide\.me, AirVPN, Cryptostorm, AzireVPN, and ShockVPN. If (for reasons, see my others posts) you narrow those down to the larger of these providers that also support port forwarding and both OpenVPN and Wireguard (for compatibility and connectivity sake among different peoples and applications), this leaves you with AirVPN and Cryptostorm as some examples.

Now, comparing to what Privacy Guides recommends (Mullvad, Proton, and IVPN), this immediately eliminates Proton VPN, which doesn’t have anonymous registrations (requires email or phone number to sign up). According to Privacy Guides Criteria, https://www.privacyguides.org/en/vpn/, “We prefer our recommended providers to collect as little data as possible. Not collecting personal information on registration…” This I agree with; however, it also says, “No personal information required to register: Only username, password, and email at most,” which seems almost oxymoronic and contradictory to the former criteria. An email is definitely not necessary when there exists random account number generation like with Mullvad, Cryptostorm, etc. Though I think there’s a strong argument that this should be grounds for removal, I think at the very least it should be disclosed on the page under Proton that anonymous registrations are not fully supported since it requires an email. Even if the email is new/a throwaway, it’s still an extra factor by which you provide identification of yourself and constitutes an extra channel through which information could leak, which is certainly not “as little data as possible,” which again seems contradictory.

It seems weird to me that there’s other potential VPNs out there that have even higher standards of security than those on the guide with regard to the aforementioned criteria that aren’t listed on the guide when ones with lower standards are allowed. I don’t think Proton necessarily would have to be removed, but to have it but not some of the other options seems counterintuitive to providing solutions that maximize anonymity, such as Cryptostorm or AirVPN for example. (If you have a counterargument about auditing, see my other posts).

So, my question is, why not consider adding options like AirVPN and Cryptostorm (or others) to the list given some of the security/privacy/anonymity limitations discussed? Even if those limitations in your opinion don’t warrant the removal of some of the existing VPNs, certainly adding ones with higher customer privacy/anonymity standards than those already should be warranted.

2 Likes
2

You can just create a new email, they also run an email service. You don’t have to give your own email.

If you never use it it’s essentially the same as a random account identifier so I don’t see the issue really.

2 Likes
3

It’s because then we can find each suggestion more easily, mark them as approved or rejected individually, and because people were already commenting that they didn’t know which part to respond to.

I would’ve split it up myself when I got to a computer today, since we should discuss the things you had originally brought up, but thank you for the taking the time to do it yourself instead :slight_smile:

2 Likes
4

gotcha

5

It’s not about it not being technically possible. You really think the majority of people would do that, or do you think they’d just use their normal email? What would the average person do? Now, should the guides here assume you already have operation security such as making spoof emails for VPNs as a given? No… They should be written for the average Joe. And just because a custom email is something that’s possible to get around, doesn’t mean it should be the standard/the “ideal” to which the VPNs chosen should be striving.

Even if you don’t think it should be a criteria (although I strongly argue it should, because why leave gaps when you don’t have to?), it should at least be disclosed.

1 Like
6

Honestly it’s the default to generate a new email when you try to sign up so yes. I guess I could see someone maybe messing up and adding their own email instead but at some point you have to let people decide what they want to do. If a service has a random account number generator but gives you the option to add your own email, you can’t really blame the service if people decide on their own to do that.

I would agree with you if proton just had an email field but they let you generate a new email right there that’s only linked to that account, so I don’t really see much risk.

ok so when you go specifically to protonvpn.com and not proton.me it doesn’t give you the option to generate a new email address, I guess that could be a UI improvement.

1 Like
7

Who says that email needs to be a real one or one that you have been using? It absolutely doesn’t need to identify yourself.

The point is that you can. It is an option you are allowed and afforded. You don’t have to if you don’t want to or don’t know if you can or not. That is not upto the VPN, it would be upto the user to learn this and then do what they need to for themselves. The responsibility here is on the user, not the VPN.

If one reads or researches enough, they will learn about it.

8

Doesn’t it? Doesn’t Proton require you activate your account via email? Take something like AirVPN that “requires” an email on paper, but even say “you can enter gibberish if you like.” I don’t think that’s the case with Proton, is it?

Why have recommend options that require additional operational security? It’s the argument between why should I use Brave when I can just “harden Firefox?” Yeah, you could, but is that your #1 option? No… You disclose it as such and also recommend the option that has higher good faith effort toward privacy/security at baseline.

It’s stated in the guide that it requires an email, but it’s not disclosed that this is an additional potential source of loss of privacy/anonymity.

1 Like
9

Again, who says the other email through which you get your new Proton account verified needs to be yours, or your old one or with any PII? It doesn’t need to be that.

I recently made a new one for my dad and also literally used an alias to verify and it worked. Why don’t you try this out yourself? Also, @SMSPool’s numbers work to verify your Proton account just as well and now they accept cash too. So, it can be anonymous if you want. Even Proton accepts cash so if you do want to upgrade it, send them cash and wait for it to get verified fully.

I don’t see it this way.

10

I don’t think anonymous registrations is important enough to be a criteria and as other users have mentioned you can get around this relatively easily.

nothing oxymoronic about it. Email is not PII unless the user chooses it to be.

11

email aliasing services exist

12

These are blocked by lots of domains and not always reliable. Also kind of not the point. VPNs that support this you could expect to prioritize data privacy/anonymity higher. It’s a hallmark of Mullvad for instance and people love it for that. 50% of it is really just the principal, and the other 50% is the ingrained benefit it provides without having to do something extra like that

1 Like
13

It needs to be yours if you have to verify it… (As for temporary email services, see below, and that really is a roundabout thing I shouldn’t have to do. A good VPN provider solves this issue much better.)

Idk, I’ve NEVER had luck with those SMS pools. And also, the whole point of this is to remain anonymous aghhhh. Why would I use a public SMS/email that could have my IP traced to the website. It’s just so counter to the goals of privacy and anonymity

I mean giving less info == more secure and safe. It’s not really a matter of opinion; it’s just a fact.

1 Like
14

I guess it comes down to what is a deal breaker for one and what isn’t - for your own reasons.

15

For me anon payment and registration is most important one, they may say no log but still log some info, who knows, with monero/cash they dont know much from beginning

2 Likes
16

Yesss finally someone else who gets it. It really is a “vibe” thing, but if you demonize people who don’t drive electric cars and use paper straws because of the environment, and you act down to earth when you’re flying around in your jumbo jets all over the world and sleeping in 5 star hotels, then why should anyone trust you? It’s about wanting to support companies that “eat, shit, and breathe” what they sell, not just say what they sell. Say LE somehow breaches them and they did keep logs, well, if my info is all anonymized from the start, then who has the last laugh? That’s the company I want to support.

1 Like
17

Even if it’s not a deal breaker, then why not have also VPNs that DO have this feature as an even extra layer of privacy then?

1 Like
18

I want to update my post but the website isn’t letting me for some reason so I’ll just add info here:

When I said that Proton doesn’t have anonymous registration and requries email or phone number to sign up, the first part is true about anonymous registrations, but I misspoke about it requring either phone OR email, when in reality I just verified the only way to verify is via email. Just as a recap: This is unlike Mullvad and Cryptostorm, which have random alphanumeric addresses as accounts, and AirVPN, which allows “fake” emails (and even says to use one right on the login page) as it’s just a username effectively and isn’t required to be an email. But Proton requires you use your own email or make one (and temp emails are not a reasonable solution to this due to privacy concerns of those services alone), but even if you make your own, that’s still an extra factor of privacy that you’re giving up and you now have to place additional trust on 1) the email service you chose itself and 2) any possible data traces that link you between the email and VPN provider. This is a headache that’s completely unnecessary with anonymous registration/login.

Some extra info in favor of this: On Proton’s onion site when you register, it requires Javascript to be enabled. So even if you wanted to offset some of the privacy loss of using an email by anonymizing yourself with Tor when that email is 1) created, 2) accessed, and 3) inputted into Proton (that’s 3 points of potential data leak ingress), you lose out on a large majority of that benefit since you have to have Javascript enabled.

Compare this to Cryptostorm, whose onion website requires no Javascript whatsoever, and that’s on top of having truly anonymous registration, and AirVPN, whose onion site does require Javascript, but allows you to have anonymous registration anyway, meaning there’s no need to use Tor to create a fake email because you don’t need an email in the first place, unlike with Proton.

1 Like
20

The issue is that sometimes Proton requires users to either complete a captcha or verify their phone number when creating an account. In some instances the captcha is not displayed forcing users to verify their number instead. This is where SMS verification services can be beneficial.