VPNs Explained Without the Hype: Uses, Risks, and How They Actually Work

Expanding on VPN definition from page 119 – The Weight of Technology

A VPN is often sold like an invisibility cloak for the internet.

It isn’t.

Used well, it does meaningfully increase your privacy and security. Used blindly, it can hand all your trust to a single company you know almost nothing about.

Let’s unpack what a VPN actually is, how it works, where it helps, where it doesn’t, and how to use one without kidding yourself.

1. What is a VPN?

VPN stands for Virtual Private Network.
At its core, a VPN is:

A secure, encrypted tunnel between your device and a remote server, through which all your internet traffic is routed. Cisco+1

Instead of talking directly to websites and apps, your device talks to the VPN server first. The VPN server then talks to the internet on your behalf.

That does three big things:

Encrypts your traffic in transit – making it hard for local observers (like your ISP, Wi-Fi owner, or anyone sniffing the network) to read what you’re doing. Fortinet+1
Masks your IP address – websites see the VPN server’s IP, not your home or phone IP. Kaspersky+1
Virtually relocates you – pick a VPN server in another region, and most sites will think you’re in that country.

Think of it as sending all your web traffic through a locked, opaque pipe that pops out somewhere else in the world.

2. How a VPN connection actually works (step-by-step)

Under the hood, a few things happen when you “turn on” your VPN:

You start the VPN app
The app negotiates a secure connection with a VPN server using a protocol like OpenVPN, WireGuard, or IPsec. These protocols define how the tunnel and encryption are set up. Canadian Centre for Cyber Security+1
A secure tunnel is created
Your device and the VPN server exchange cryptographic keys and establish an encrypted tunnel. Anything sent through that tunnel looks like unreadable gibberish to outsiders. Fortinet+1
Your OS rewires your traffic
Your operating system updates its routing table so that almost all (or selected) traffic goes through that tunnel instead of directly to the internet.
Your IP address is swapped
From the outside, websites no longer see your home or mobile IP. They see the VPN server’s IP and its approximate location. Kaspersky
The VPN server forwards your requests
- Your browser asks for example.com.
- The request goes through the encrypted tunnel to the VPN server.
- The VPN server sends the request to example.com, gets the response, and sends it back through the encrypted tunnel to you.

To the website, the “user” is the VPN server.
To your local network/ISP, your traffic is encrypted blobs going to one remote server.

3. Types of VPNs

We tend to lump all VPNs together, but there are a few major categories: Cisco+2NCSC+2

Remote access VPN (corporate)
- Used by companies so employees can securely access internal systems from home or on the road.
- Example: connecting back to the office network to reach internal file servers or tools.
Site-to-site VPN
- Connects two networks together (e.g., company HQ ↔ branch office) over the internet.
- Acts like a private cable between networks.
Consumer VPN services
- What most people mean today by “VPN”.
- You pay a provider, install their app, and route your internet traffic through their global network for privacy, streaming, torrenting, etc. Linux Security+1

Each type solves slightly different problems, but they all share the same core idea: create an encrypted tunnel over untrusted networks.

4. Legitimate uses of a VPN

A VPN isn’t just for “hackers”, torrenters, or people trying to dodge geo-locks. Many completely mundane scenarios benefit from one: Canadian Centre for Cyber Security+2Linux Security+2

4.1 On public Wi-Fi

Cafés, airports, hotels, and malls often run unencrypted or poorly secured Wi-Fi. Without a VPN, anyone on the same network (or controlling it) can potentially:

See which sites you connect to
Attempt to intercept unencrypted connections
Launch man-in-the-middle attacks against misconfigured apps

A VPN encrypts your traffic from your device to the VPN server, so the Wi-Fi operator (or a snooper) mainly sees “encrypted tunnel to VPN provider”, not what’s inside.

4.2 Reducing ISP snooping or profiling

Without a VPN, your internet service provider (ISP) can typically:

See which domains you visit (e.g., example.com)
Log connection metadata (time, duration, amount of data)
Build profiles for analytics, marketing, or handing data to third parties under certain legal regimes

With a VPN, your ISP mostly sees:

That you connect to a VPN server
How much data you send through it

They lose visibility into individual websites and services (with some caveats around DNS and traffic analysis). Kaspersky+1

4.3 Bypassing geo-restrictions & censorship

A VPN server in another country can sometimes:

Access content libraries limited to that region
Reach blocked news sites or apps in censored environments
Avoid certain forms of ISP-level blocking

Note: Many platforms now actively detect and block known VPN IP ranges, so this is no longer guaranteed.

4.4 Safer torrenting & P2P

Some people use VPNs to:

Mask their IP address in torrent swarms
Reduce the risk of IP-based copyright complaints
Avoid ISP throttling of P2P traffic

This doesn’t make illegal activity “safe” or invisible. It just changes who can easily see your IP.

4.5 Corporate remote access

Companies use VPNs to:

Let employees securely access internal tools over untrusted networks
Protect sensitive data in transit over the public internet

Here, the VPN is more about network security and less about anonymity.

5. What a VPN can and cannot protect

This is where the marketing hype often collides with reality.

5.1 What a VPN can help with

Encrypting traffic between you and the VPN server
Hiding your IP and approximate location from websites
Shielding your traffic from local observers (Wi-Fi owners, ISPs, local network admins)
Reducing simple tracking based on IP address
Circumventing some geo-blocks or censorship

5.2 What a VPN cannot do on its own

Make you anonymous to websites you log into
If you sign into Google, Facebook, TikTok, Amazon, etc., they know exactly who you are, VPN or not.
Stop tracking via cookies, browser fingerprinting, or account logins
VPNs don’t erase your ad/tracking cookies or browser fingerprint.
Protect you from malware on your device
If your laptop or phone is compromised, a VPN won’t save you.
Override physical access risks
Someone with access to your device can bypass your VPN by watching the screen, installing spyware, etc.
Magically defeat all government surveillance
VPNs may help in some situations, but governments can target providers, endpoints, and users in other ways.

The honest framing: a VPN is one layer in a larger privacy/security strategy, not a force field.

6. Advantages of using a VPN

When used thoughtfully, there are real benefits: Linux Security+3Fortinet+3Kaspersky+3

Stronger privacy on untrusted networks
Encrypting your traffic on public Wi-Fi makes it much harder for casual snoopers or malicious hotspot owners to spy on you.
IP masking and location flexibility
Your real IP stays hidden from most sites. You can also appear to be in another country (subject to services blocking certain VPN IPs).
Some protection against ISP profiling
Your ISP no longer sees every website you visit, which may reduce profiling and some forms of throttling.
More control over where your traffic exits
Instead of your traffic exiting from your home network under your ISP’s policies and jurisdiction, it exits from your VPN provider’s infrastructure in another location.
Potentially better security posture (with the right provider)
Reputable providers often use strong protocols (WireGuard, OpenVPN), strong encryption, and hardened infrastructure. Cisco+2NCSC+2
Useful for power users & professionals
- Developers and admins can create secure tunnels into lab environments or internal tools.
- Journalists, activists, and researchers may use VPNs as part of a broader operational security setup.

7. Risks, limitations, and failure points

Now the part VPN ads don’t like to dwell on.

7.1 You are moving trust, not removing it

Without a VPN, you are mostly trusting:

Your ISP
Any networks you connect to

With a VPN, you are now trusting:

Your VPN provider plus your ISP (for basic connectivity)

The VPN provider can see a lot:

Your real IP address (at least when you connect)
When you connect, how much data you use
Potentially DNS queries or even traffic content if they misconfigure or intercept it

So you’re not eliminating trust—you’re concentrating it into a single company whose infrastructure and business model you probably don’t fully understand.

7.2 Logging and “no-log” marketing games

Logging is one of the most critical risk areas:

Many VPNs claim “no logs” while still collecting enough metadata to identify users. Top10VPN+2VPN.com+2
Some keep connection logs (times, IPs, session IDs) that can link activity to you.
Others, especially free or shady services, may log and sell your activity or use it for targeted advertising. Check Point Software+2Praxis Computing+2

Better providers increasingly undergo independent audits of their logging claims—for example, repeated audits of “no-logs” policies by third-party firms for services like Proton VPN and NordVPN. TechRadar+2Tom’s Guide+2

But even then, you’re still taking a risk: audits are snapshots in time, not permanent guarantees.

7.3 Malicious or shady VPN providers

There is a long tail of VPNs that:

Inject ads or trackers into your browsing
Bundle malware or unsafe SDKs
Are effectively data collection businesses masquerading as privacy tools Check Point Software+2Praxis Computing+2

Free VPNs are especially risky: if you’re not paying with money, you may be paying with your data.

7.4 Technical vulnerabilities and leaks

Even good VPNs can leak:

DNS leaks – your DNS requests bypass the VPN and go to your ISP or another resolver. Check Point Software+1
IPv6 or WebRTC leaks – your IP address can slip out through features outside the VPN’s direct control.
Broken kill switches – if your VPN connection drops and there’s no working kill switch, your device may quietly fall back to a direct, unencrypted connection. Tom’s Guide+1

Poorly configured or outdated protocols (weak encryption, obsolete cipher suites) can also weaken security.

7.5 VPNs as big attack surfaces (especially for companies)

For organizations, VPNs can become single points of failure:

Compromised VPN credentials can give attackers wide access to internal networks.
VPN concentrators and gateways are high-value targets—and often lag in patching. Imprivata+2Check Point Software+2

This has led many modern orgs to migrate away from traditional “everyone on one big VPN” toward zero-trust architectures.

7.6 Legal and policy constraints

Depending on where you live:

VPNs may be regulated, monitored, or even blocked.
Authorities can pressure VPN companies based in their jurisdiction.
A provider could be secretly logging, compelled by law, or compromised without public knowledge.

Again, you’re shifting which jurisdiction and entities you’re most exposed to—not escaping them completely.

8. How to choose a VPN more intelligently

If you decide a VPN belongs in your toolbox, here’s what to look at beyond marketing banners: Tom’s Guide+6Top10VPN+6VPN.com+6

Transparent, detailed privacy policy
- Do they clearly spell out what they log (connection timestamps, IPs, bandwidth, DNS, etc.)?
- Are they vague (“minimal logs”) or precise?
Independent security / no-logs audits
- Have third-party firms examined their infrastructure and logging claims?
- Are the reports public?
Jurisdiction and legal environment
- Where is the company legally based?
- Are there mandatory data-retention laws or heavy surveillance laws?
Modern protocols and strong encryption
- Support for WireGuard, IKEv2/IPsec, or well-configured OpenVPN.
- Clear documentation of encryption standards.
Kill switch and leak protection
- Does it have a reliable kill switch that blocks traffic if the VPN drops?
- Any tools to mitigate DNS, IPv6, and WebRTC leaks?
Business model and ownership
- Who owns them? Is there a parent company with a sketchy reputation?
- How do they make money (subscriptions, ads, data)?
Track record and transparency
- History of incidents, disclosures, and how they were handled.
- Transparency reports, open-source apps, bug bounty programs, etc.
Avoid “too good to be true” marketing
- Lifetime deals, exaggerated “complete anonymity” claims, or aggressive upsells are all yellow flags.

9. Practical tips for using a VPN safely

If you bring a VPN into your daily routine, treat it like a tool—not magic.

Use it consistently on untrusted networks
Hotels, cafés, airports, co-working spaces—these are prime environments for passive snooping.
Enable the kill switch (and test it)
Turn it on, then temporarily kill the VPN process and see if your traffic actually stops.
Combine it with other protections
- Use a privacy-respecting browser (and/or browser profiles).
- Clear tracking cookies regularly or use containers.
- Consider DNS-level blocking or privacy-focused resolvers.
Don’t rely on VPNs for illegal or high-risk activity
Law enforcement has more tools than “check the IP”. Devices, accounts, payment trails, and social graphs are all leverage points.
Be cautious with “free” VPNs
If you must use one, research it deeply. Many free VPNs track, inject ads, or even distribute malware.
Remember the human side of privacy
A VPN can hide your IP, but it can’t stop you from oversharing on social media, clicking phishing links, or reusing passwords. Those are still on you.

10. The bottom line

A VPN is:

Useful for reducing certain kinds of surveillance and profiling
Helpful for securing your traffic on untrusted networks
Practical for shifting where and how your traffic exits onto the internet

But it is not:

A universal anonymity tool
A substitute for good digital hygiene
A “get out of consequences free” card

In the spirit of The Weight of Technology, you can think of a VPN as one of those quiet background systems: powerful, invisible, and very easy to misunderstand.

Use it as a conscious trade-off:

“I’m choosing to trust this company and this legal environment more than my ISP, this network, or my current jurisdiction—for these specific reasons.”