I am interested in understanding VPNs and being able to evaluate which commercial one to use.
I understand that using the wrong one is a big compromise and I am very skeptical that checking for books I find many that are not from reputable editions. So my concern is that I could end up using an unsafe one.
In case it matters the platforms I am interested in is Kubuntu and android.
What do you recommend I do?
If you are trying a VPN because they protect you against hackers, against sites tracking you, to have a faster connection or any other claims you saw on sponsored Youtube videos, don't. You don't need a VPN.
There are few reasons people need VPN:
Remote Work: in this case the employer will provide a VPN, endpoint and everything, unless you are the one deploying the VPN and would know the specific VPN you will install.
Oppressive Countries: if you live on a country with harsh regulations for online habits, a VPN can help. Using the wrong one, or not understanding what a VPN can protect and what it cannot can lead to serious consequences.
Privacy: If you think your ISP is spying on you. In this case, a VPN could help but you would have the VPN provider in the position of spy on you. DNS over TLS or DNS over HTTPS could help too.
At this point, I will refrain from telling you when or when it makes no sense to use a VPN. The previous commentators have already done this sufficiently.
At this point, you should also never forget that the VPN always remains the single point of trust regardless of the provider, no matter who you entrust your traffic to.
Nevertheless, there are providers that I would consider as VPN providers and those that I would never even mention. Personally, it is particularly important to me that payment is anonymous and that I am not forced to disclose credit card details, for example, which means that there is a mapping between the VPN user and their real-world data right from the start, which should not be the case. In addition, of course, I don't know what else happens to the data during the payment process. Where is this data stored and what happens if the service provider itself is forced (legally) to disclose data or is even hacked/compromised?
This brings us to the next point: The provider should not have attracted negative attention in the past, so reputation plays a very important role here in this domain.
Finally, there should be a policy that no data is logged at all.
Apart from that, there are also points regarding convenience, such as the fact that apps should exist for different platforms in order to simplify use. But these are optional aspects, as I said.
There are a lot of things sold as "VPNs" where the vendor provides part of the service rather than just products. IMHO there is nothing "private" about these - they are nothing more than anonymization services.
Product recommendations are off topic here.
However, and like most such exercises, you should start by defining your requirements properly.
You have said you need support for Linux and Android - that's a starting point. You might start by checking what capabilities are already present (particularly on the Android side). Having a client already deployed and managed by the existing patching mechanisms is a big win.
You should also consider how many sites (or individual devices) are going to be on the same VPN. IME most open-source and a lot of commercial VPNs operate on a hub-and-spoke model which does not scale well (tailscale is a notable exception here).
Another consideration for scaling is how you will implement authentication and (potentially) key distribution. Commercial software is often better at this stuff than open-source, but part of that is because the vendors want to sell you a complete solution while open-source is typically components you assemble to implement YOUR solution. e.g. your open source VPN might ONLY offer authentication against users known to the remote host - but you could have configured that host to use MS Active Directory, other LDAP, RADIUS, a MySQL database....
In the case of open-source software you have plenty of opportunity to see the documentation, the historic CVEs, whether other people have encountered problems with the software. For commercial software and for services....not as much.
While lots of vendors assert that their product uses IPSEC or TLS or some other standard for connecting, it can be difficult to get products from different vendors to talk to each other. Commonly this is due to the support firewall ("Have you tried turning it off and on again?") but can also be due to vendor secret sauce creating incompatibilities.
Look for services that operate transparently, offer flexible and/or modern technology for connectivity as well as privacy friendly payment methods. It’s a lot of boring, simple research
To assess transparency, look for:
You can also review the technology and configurations they offer/support to draw some conclusions about how competent they are or how seriously they take privacy and security
You can look for services that support Wireguard, which is widely considered to be the most secure VPN technology available today from several angles (communications security, attack surface, etc.)
Wireguard happens to be very easy to deploy, so in my opinion, it’s fair to deduct a point from VPN services not offering (or planning to offer) it. If it isn’t mentioned, reach out to their customer support and see what they say and how they handle the inquiry
Finally, it’s generally a good idea to try to avoid any services that pay for a lot of advertising or explicitly make claims about hiding customers from law enforcement
Mullvad and IVPN are two examples of services with exceptional transparency, flexible and secure connectivity options (including Wireguard), and many payment methods. Take a look at their sites and services and use them as a benchmark
