I want to use a commercial VPN. It's more reliable when using their own client, since it can automatically select and switch servers etc. But what about the security?

On my Android phone, the apps are isolated from each other, so having a VPN client installed (with no privileges granted) shouldn't be a big risk - it cannot collect information about me apart from sniffing on my traffic (which is encrypted).

But on Windows, installing a VPN client requires giving it admin privileges, which means this client can collect and send away any information from my PC - all my keystrokes and passwords, all my files, everything, it can even eavesdrop on me via the microphone. And it can install malware and manipulate my PC at will.

Is there any way to protect myself against this (apart from setting up the VPN per hand without installing third party software)? For example, are there any open source scripting languages specifically for VPN setup with otherwise very limited rights (so that VPN scripts cannot compromise my PC)? Or are there any VPN clients not requiring admin privileges that I can run in a separate, non-admin account?

The VPN provider I signed up with brags about their servers being audited by some big name company, but nothing was said about the client. Which is strange, because traffic passing through the server is mostly encrypted anyway nowadays, while the client has full access to all data on the PC and the ability to transmit it.

How do other people deal with the danger from VPN clients - or do you just live with the fact that any personal information from your PC can appear on some Russian sites for sale thanks to a compromised employee at the VPN provider?

  • 1
    Why not use an open source client like OpenVPN? It's not malicious, and is arguably far better designed and more exhaustively audited than any "big name" provider's crappy homemade client. And whatever that client can do, OpenVPN can probably do (or easily be made to do) as well, including automatically selecting and switching servers.
    – forest
    Mar 14, 2022 at 22:50
  • Who is the commercial provider? I'm evaluating some also. Mar 14, 2022 at 23:06
  • PSA: Commercial VPNs are not good for serious anonymity, only anonymity against the most casual of adversaries (think MPAA and RIAA). Don't fall for their advertising. Remember, the "P" in VPN refers to private IP address ranges (like, not the right to privacy.
    – forest
    Mar 14, 2022 at 23:15
  • Can OpenVPN automatically get updated VPN server lists and choose servers? I tried it, it seems you have to configure each specific server per hand, just like with the stock VPN functionality in Windows. The commercial provider I am thinking about is ExpressVPN, but my concerns about the client apply to every provider out there. I need a VPN to access sites blocked by government censorship, not for privacy.
    – cuckoo
    Mar 15, 2022 at 8:13
  • @cuckoo OpenVPN supports some pretty advanced functionality, including scripts.
    – forest
    Mar 15, 2022 at 22:30


You must log in to answer this question.

Browse other questions tagged .