what is the value of using a VPN browser extension incremental to the value of IP hiding

Question

My VPN service offers not only IP hiding and encryption via a desktop client but also an internet browser extension that is optional. Assume a person is using the VPN via the desktop client but not the optional browser extension. I want to understand the incremental value of the browser extension.

The quote is from a FAQ from the VPN service's website.

What does the browser extension do?

The browser extension provides a "Lite" VPN client, which does the same thing as the desktop one, but only in your browser. Any other applications you may be using on your computer will utilize your ISP provided IP address. Additionally it blocks thousands of ad beacons and trackers that could follow you across the websites you visit, and compromise your privacy even if you are already using a VPN. It also blocks various "social widgets", such as Facebook Like buttons, Twitter badges, etc, which are embedded into millions of websites and report all your activity to their respective companies. It also rotates your user agent (which identifies your browser), which further scrambles your online activities in the eyes of whoever is watching.

Why should I use both products?

Contrary to popular belief, a VPN client alone will not keep you anonymous or significantly help your privacy online, unless you take extreme measures, at which point using the Internet becomes a burden. Anonymous IP address alone provides some protection, however marketers, criminals and governments have stepped up their game which allows them to track you even if you already use a VPN. In order to combat this, browser level protection is also necessary to improve your chances of staying anonymous.

The FAQ describes "ad beacons and trackers that could follow you across the websites you visit". Then it describes "social widgets" that "report all your activity to their respective companies".

To use the phrase "report all your activity" seems an exaggeration which lowers the reader's confidence in the FAQ. For example, it seems doubtful that Facebook can determine my gmail password if I use gmail concurrently in the same browser. If the FAQ means to say that all your identifiable (meaning traceable to an individual) Facebook activity is visible to Facebook algorithms, it is not clear why that is even a privacy violation.

The statement about ad beacons and trackers is more worrying but it is not explained how "following you" is a privacy violation. What is the mechanism by which ad beacons and trackers disclose identifiable activity/information/clicks and to whom is it disclosed to, if in fact this happens. Is identity actually disclosed or is the disclosure merely that, for example, "somebody possessing a subscription to the Daily Planet newspaper website subsequently clicked an ad showing Zoom branded size 7.5 running shoes for women placed by the Gotham City Shoe Store". In other words the disclosure is information from which inferences can be made about identity without actually identifying a single individual. This might not be the most worrying example and it may not even be a feasible example.

What is the mechanism that enables traceable-to-an-individual privacy violation that can motivate use of the browser extension? You should assume that the other VPN services are applied so we are looking for the incremental value of the browser extension.

Answer 1

Your VPN provider (Windscribe) seems to be using this as marketing garbage, and in reality, the browser extension provides little protection when used in combination with the standard desktop client since your connection is already using the VPN.

The browser extension simply combines a VPN (that's only utilized within the browser and not system-wide) and an ad/tracker-blocker. When you enable it, it creates a VPN tunnel, and if the desktop client is already on, then it tunnels through the system VPN connection, creating a 'double-hop' connection since it's going to one VPN server, then to another VPN server, and then to its final destination on the web.

As for its tracker blocking capabilities, they're pretty much useless. The moment you sign in to any website, you give away your identity. There's also browser fingerprinting, which can track you even when you switch to 'incognito mode'. In reality, this browser extension does next to nothing to make you anonymous.

If you want a robust solution for anonymity online, use Tor Browser with Tor disabled and your VPN active. As long as you don't voluntarily give up your identity, you won't be able to be tracked when using Tor Browser

Answer 2

Made this into an answer.

What is the mechanism by which ad beacons and trackers disclose identifiable activity/information/clicks and to whom is it disclosed to, if in fact this happens.

What is the mechanism that enables traceable-to-an-individual privacy violation that can motivate use of the browser extension?

The fact that you can be tracked by advertisers while surfing the internet. The browser extension is more convenience than anything; nothing special in my opinion. In a nutshell, advertisers can use things like: javascript, Java, Flash, and more to serve you advertisements; which can also watch what you're doing at the same time.

You should assume that the other VPN services are applied so we are looking for the incremental value of the browser extension.

Some services will block all traffic from VPNs. I know for a fact that I can't play any Blizzard games while I'm on my VPN. So the browser extension can hide some of your internet surfing and you don't have to disconnect it to use those other services. It's also easier to install a browser extension than to set up your VPN connection through your OS. Normally it doesn't require admin rights to do so either.

I recommend Privacy Badger since it is VERY easy to use and works really well to block tracking. To quote their FAQ page: Privacy Badger was born out of our desire to be able to recommend a single extension that would automatically analyze and block any tracker or ad that violated the principle of user consent; which could function well without any settings, knowledge, or configuration by the user; which is produced by an organization that is unambiguously working for its users rather than for advertisers; and which uses algorithmic methods to decide what is and isn't tracking.

In a nutshell, if Privacy Badger sees an advertiser tracking you without your permission, it blocks that advertiser. There used to be more info on their main page, but they moved it to the Privacy Badger FAQ page. And what I mean by traceable is that if you log into a website, you give them permission to watch certain aspects of your browsing. Google does this whenever you're logged into their services. If you're logged into Google, a VPN won't hide who you are at all to Google. Their use of cookies to keep you logged in and the way their advertisements work will identify you no matter where you go or how many VPNs you connect to.

Contrary to popular belief a VPN will not hide you very well at all. With Device Fingerprinting, you can still be partially tracked through a VPN; and if you visit sites with and without the VPN, they'll know who you are just as if you had logged into them.

To use the phrase "report all your activity" seems an exaggeration which lowers the reader's confidence in the FAQ.

What they mean by "report all your activity" is that they know where you're surfing. It's like a private eye that watches where you go. They don't always know what you do there, but they know where you've been and when you were there. Facebook can track you after you've logged out. They can also track you wherever you go.

Is identity actually disclosed or is the disclosure merely that, for example, "somebody possessing a subscription to the Daily Planet newspaper website subsequently clicked an ad showing Zoom branded size 7.5 running shoes for women placed by the Gotham City Shoe Store".

Normally, your identity isn't disclosed per se, but if you enter any information, it could be depending on the advertiser and cooperation of the website. As above, they know where and when you were somewhere.

For anyone wondering why privacy is so important, keep in mind that several governments have been known to spy on people, and punish them for various reasons. If you look at the USA, recently Automatic Number-Plate Recognition has come under scrutiny since they were potentially using them to determine what a person's religion, sexuality, and more was. The EFF has more information on the usage of ALPRs. Such privacy breaches can be very bad for you. This kind of information could be used to scam or blackmail you. If a threat actor sees you making a purchase for flight tickets, they could attempt to contact you and try to get money or something else out of you.

TL;DR: Privacy is very important and you should protect yours as much as possible.

I'm a systems administrator that likes to keep track of things like this. Admittedly, I've only been partially keeping track of a lot of this stuff, so I could be mistaken on what I've said.

Answer 3

Basically instead of a VPN the company offers also a proxy used through a browser extension. Proxies are less reliable than VPNs and offer less security. That's the only differences in it.

Besides hiding your IP normally VPNs also hide DNS servers you are using, in fact overriding them (unless there are DNS leaks which are a security issue). You can think of VPNs like a shield or a shell. Anything that happens won´t directly affect your ISP, therefore giving you a second layer of protection, making sure that services you use do not recognize your location, operating system etc., therefore protecting your real life identity as well.

Using your IP without a VPN or proxy (which is less reliable) could allow people who use OSINT services to know very intimate personal details (with just your IP address. And even if you are not connected to any social media), like for example, usage of your bandwidth. That's another reason why security folks try to hide from analytical data since the more analytical data the more changes yours will end up in a service to have it collected and ordered and used against you.

The more information an attacker knows about you the easier it will be too, for example, to cyber attack your device in one way or another (by social engineering i.e).

By using a VPN/proxy you are mixing all the data together and making it more secure in the end.

Added this to answer Schroeder comment: Vpn + proxy (because of the proxy and not because of the vpn) adds a layer of insecurity to your security but also a layer of confusion in case of ip leaks. (this is mere personal opinion, the extension is part of a browser which gets more usage than other components of the Operating System and this is the reason I consider you are less secure when using it) Besides that, in case of this company if the browser extension also functions as proxy ip (which op told us so already) most probably will incur in additional bugs as it is adding more features to one single app. I would consider it marketing but without audiction of the extension there is not a reliable answer. There are other browser extensions doing the same things however, so if your question is "would be good to use the extension they use" Yes (as long as it does blocks trackers, etc and see back for why it would be good for security to block them), but is not an original aproach, and you can´t trust their extension/app is better than others.