A US senator wants the NSA to stop being vague about VPNs and start naming names.
The senator is asking the agency to issue public guidance on best practices for using virtual private networks to shield communications from foreign adversaries. VPNs route a user's traffic through an encrypted tunnel to a remote server, hiding both the content and the user's IP address from anyone in between. US agencies have recommended VPN use before, but none have specified which services or configurations actually hold up. That gap is the target of this request.
The ask matters because VPNs are leakier than their marketing suggests. The encrypted tunnel typically ends at a server that decrypts the traffic before forwarding it, which means a compromised or malicious server operator can see everything. VPNs also don't hide metadata like timestamps, which is exactly the kind of data nation-states use to build behavioral profiles.
In other words, a VPN is a lock on one door in a house with several open windows. Telling people to "use a VPN" without saying which ones resist those leaks is advice that sounds protective and mostly isn't.