Sen. Ron Wyden has written to National Security Agency Director Gen. Joshua Rudd requesting updated public guidance on virtual private network configurations. The senator argues that existing recommendations to use VPNs lack sufficient detail to help Americans, particularly government personnel, defense contractors, journalists, and human rights defenders, make informed decisions about which services best protect their communications from foreign surveillance threats.
VPNs encrypt internet traffic and route it through remote servers, hiding users’ IP addresses from destination servers. However, the technology has notable limitations that undermine the protections many users assume they receive. Once encrypted traffic is decrypted at a VPN server before reaching its final destination, the contents may be accessible to compromised employees or attackers. Additionally, VPNs do not encrypt certain metadata such as timestamps, which nation-states can exploit for intelligence purposes.
Wyden’s letter poses specific technical questions regarding VPN architecture. These include whether single-hop VPNs, which use one server to decrypt and forward traffic, provide adequate protection against sophisticated adversaries. The senator also asks whether the NSA recommends multi-hop systems—which route traffic through multiple servers so that no single point can observe both sender and recipient information—such as Apple Private Relay, Tor, or Nym. He further inquires about technical features like random delays and cryptographic padding designed to prevent timing-based attacks.
The three services mentioned each present different tradeoffs. Nym offers decentralized routing through volunteer-operated servers with random delays and message reordering. Apple Private Relay uses two servers, one controlled by Apple and another by a third-party content provider, but functions only on Safari on Apple devices. Tor routes traffic through three volunteer-operated servers. A key concern across these services is the potential for volunteer operators to actually be nation-state actors gathering intelligence.
Experts note the absence of trustworthy standardization for evaluating VPN services. Wyden requested that the NSA provide its response no later than October 14.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI