Invited Paper: "All of them claim to be the best": Multi-perspective study of VPN users and VPN providers
slides-biasws-all-of-them-claim-to-be-the-best-multi-perspective-study-of-vpn-users-and-vpn-providers-00

Invites talk of published paper:
https://www.usenix.org/conference/usenixsecurity23/presentation/ramesh-vpn

"All of them claim to be the best": Multi-perspective study of VPN users and
VPN providers

Authors:
Reethika Ramesh, University of Michigan; Anjali Vyas, Cornell Tech; Roya
Ensafi, University of Michigan

Abstract:
As more users adopt VPNs for a variety of reasons, it is important to develop
empirical knowledge of their needs and mental models of what a VPN offers.
Moreover, studying VPN users alone is not enough because, by using a VPN, a
user essentially transfers trust, say from their network provider, onto the VPN
provider. To that end, we are the first to study the VPN ecosystem from both
the users' and the providers' perspectives. In this paper, we conduct a
quantitative survey of 1,252 VPN users in the U.S. and qualitative interviews
of nine providers to answer several research questions regarding the
motivations, needs, threat model, and mental model of users, and the key
challenges and insights from VPN providers. We create novel insights by
augmenting our multi-perspective results, and highlight cases where the user
and provider perspectives are misaligned. Alarmingly, we find that users rely
on and trust VPN review sites, but VPN providers shed light on how these sites
are mostly motivated by money. Worryingly, we find that users have flawed
mental models about the protection VPNs provide, and about data collected by
VPNs. We present actionable recommendations for technologists and security and
privacy advocates by identifying potential areas on which to focus efforts and
improve the VPN ecosystem.