this post was submitted on 31 Oct 2026

134 points (95.9% liked)

Privacy

11126 readers

284 users here now

A community for Lemmy users interested in privacy

Rules:

Be civil
No spam posting
Keep posts on-topic
No trolling

founded 3 years ago

MODERATORS

iopq@lemmy.world

134

Looking for a good alternative to ProtonVPN (feddit.online)

submitted 1 week ago* (last edited 1 week ago) by smoothspoon@feddit.online to c/privacy@lemmy.world

68 comments fedilink hide all child comments

In the wake of the Proton controversy, I've been looking towards alternatives towards their services. Unfortunately, I can't seem to find a good alternative to ProtonVPN. I'm looking for the following in a VPN service:

Port forwarding support
Open source
Android app and Firefox extension available
Relatively cheap, around $3-4 month (okay with annual pricing)

The only options I found were Private Internet Access and Windscribe, but I found issues with them. If I'm cutting ties with Proton based on ideals I disagree with, I should be rejecting alternatives on the same basis.

Based on what I saw in the PIA subreddit, Private Internet Access seems to have some issues with service reliability and concerns about its ownership having ties to Israel, implying Zionist affiliation. Windscribe seems to have better service, but they have had a questionable social media history: edgy marketing including an AI-generated Hitler and a controversy where, according to them, they joked about a guy being mentally ill but their post easily looked like they were saying trans people are mentally ill.

Is there an option I missed? Should I try one of these options despite their faults? I'd like to know your thoughts.

top 50 comments

sorted by: hot top controversial new old

[–] Burn_The_Right@lemmy.today 3 points 5 days ago

Njalla is the most trustworthy vpn, imo. The founder is one of the founders of the Pirate Bay. He is quite committed to privacy.

[–] thrillhousedev@lemmy.world 8 points 6 days ago (1 children)

Get yourself a cloud host with locations you want and run your own Algo VPN. It deploys in minutes, is disposable, and is completely under your control. Keeping one up 24/7 might cost $5/month depending on your host.

Repo: https://github.com/trailofbits/algo/

[–] Allero@lemmy.today 3 points 6 days ago* (last edited 6 days ago) (1 children)

Even easier and super censorship-resistant (battle-tested in Russia of all places, where all conventional options are blocked): AmneziaVPN

https://github.com/amnezia-vpn/amnezia-client (Also available on official website, Google Play and App Store. No Firefox extension is available, but Linux/Windows/MacOS apps are all in place)

All you need to do is spin up a server on any VPS and give AmneziaVPN app root credentials to it. The rest will be done automatically within seconds. You don't need to set up anything manually. In fact, you never need to ssh to your VPS at all.

(Obviously, do not use this installation method if you have anything else on the server. For that case, manual AmneziaWG install is available)

[–] hirihit640@sh.itjust.works 3 points 5 days ago (1 children)

A major selling point of VPNs is mixing the traffic of all users.

If you are in a surveilled country, you're the only one using your VPS, and the destination server is in a surveilled country, then all your traffic will look like: you -> VPS -> destination. You would have to have multiple VPS servers in non-surveilled countries, and constantly rotate the servers to avoid the intermediate hops from getting associated to your identity, and that's hoping that the VPS company doesn't get subpoenad (since they likely have your credit card info and can leak your identity).

[–] Allero@lemmy.today 1 points 5 days ago

Indeed, that's an important point to remember.

Personally, I place exit server in a jurisditction that doesn't answer to my local authorities, and have several other people use the server.

[–] dotslashme@infosec.pub 7 points 6 days ago (1 children)

I am going to recommend AzireVpn, I used to be a customer and was very happy, but switched to proton some years ago because I had my email with them. Not sure if their apps are open source and if they have browser extensions though.

[–] mnemonicmonkeys@sh.itjust.works 2 points 6 days ago

Ooh, they have port forwarding. I'll definitely look into them further

[–] Eudaimonia@lemmy.world 2 points 5 days ago

I'm still waiting for my mullvad VPN (fascist CEO) to end and decided to then switch to iVPN.

[–] mentalcel@reddthat.com 1 points 5 days ago (1 children)

Ivpn, not really cheap though

Riseup is also trustworthy, but its unbearably slow

[–] TheSyndZ@lemmy.dbzer0.com 1 points 5 days ago

No port forwarding at IPVN

[–] tobebannedbygaymods@lemmy.zip 1 points 6 days ago* (last edited 6 days ago)

Maybe Softether vpngate client , or paid OpenVPN

[–] moldy_rice@piefed.keyboardvagabond.com 1 points 6 days ago

Ivpn, AirVPN, or cryptostorm

[–] manuremy@sopuli.xyz 1 points 6 days ago

I'm in the same ship and pretty stuck. Was just about to start paying for plus too, I was just waiting for Black Friday sales. What now? I liked Proton VPN because it is easy - download from Bazaar, log in, advanced kill-switch and auto-connect-minimised on. There doesn't seem to be easy competitors?

[+] iopq@lemmy.world -8 points 6 days ago (1 children)

You can self-host for free on Oracle. It only costs you your time

[–] WhatAmLemmy@lemmy.world 14 points 6 days ago (1 children)

Might as well sign up for googles VPN and install Metas AI agent as root.

[–] iopq@lemmy.world 1 points 6 days ago (1 children)

You realize you can encrypt your traffic, get your DNS over HTTPS and use encrypted client hello (ECH), right? Oracle sees that you connect to some cloudflare or google IP, mostly. They can't even see which site you're going to.

[–] hirihit640@sh.itjust.works 1 points 5 days ago* (last edited 5 days ago) (1 children)

Isn't ECH and DoH basically just using cloudflare as a VPN? I feel like a lot of privacy folk don't trust cloudflare, considering how much of the internet is now centralized on them I'm sure they're a juicy target for subpoenas.

Edit: also, if you use ECH and DoH and trust cloudflare, then what would be the point of the Oracle VPS?

[–] iopq@lemmy.world 1 points 4 days ago (1 children)

You don't need to use cloudflare at all, use cloud 9 or adguard if you like those better

If you don't trust any of them, you can use ODoH, where cloudflare gets an encrypted request from a proxy. The proxy is only aware of your IP and CF is only aware of the request and the proxy's IP. So if the proxy doesn't report your IP to CF, CF doesn't know who you are.

You can host the ODoH relay on your VPS and it will protect your DNS queries from the provider, while being able to monitor that the provider doesn't send your IP to CF. CF gets queries from the VPS, but not able to see your real IP. Your ISP similarly only sees encrypted blobs.

[–] hirihit640@sh.itjust.works 1 points 4 days ago* (last edited 4 days ago) (1 children)

Tbh ODoH sounds like Tor but with much greater chance of collusion between proxy and resolver. I'd still trust it less than a reputable VPN.

And hosting the ODoH on an Oracle VPS doesn't make it more trustworthy. Oracle has your credit card info. They could report or sell the info, and Cloudflare would now know that the VPS belongs to you, making the setup identical to just sending DoH requests directly to Cloudflare.

Edit: also it seems like ECH only proxies the first packet, and your normal traffic would still go directly between you and the server, or your Oracle VPS and the server. A big part of VPNs is hiding your identity from the server. And VPNs mix the traffic of many customers, unlike a private VPS.

[–] iopq@lemmy.world 1 points 3 days ago (1 children)

The question is whether Oracle working together with Cloudflare is a more likely scenario or the "trusted" VPN provider literally selling your data anyway.

I think a trusted DNS server and an Oracle proxy is going to be more secure than trusting one provider with all your data

[–] hirihit640@sh.itjust.works 1 points 2 days ago (1 children)

They don't need to work together, they can just sell the data to the same company (Google, Facebook) or both get subpoena'd by the government.

Their main business is not privacy. If they are caught selling data, they'll still survive. A VPN provider on the other hand would be staking their entire company.

[–] iopq@lemmy.world 1 points 2 days ago (1 children)

How would you correlate those two things? Let's say I access cloudflare DNS from one proxy and the request over the other proxy. How would Google know that they are the same device?

[–] hirihit640@sh.itjust.works 1 points 1 day ago (1 children)

I'm not sure how many proxies you are using here but let's just take the example we covered earlier. You -> Oracle VPS (ODoH) -> Cloudflare -> DNS Server

Oracle sells your data, so now Google knows you own that VPS. Cloudflare sells data too, so now Google knows that a ODoH request came from the VPS and requested the name resolution for xxx-website.com. Google connects the dots and knows that you tried to visit xxx-website.com.

Regardless of what you do, your ip packets have to start from your device and end at the destination server. You can try to make it go through multiple hops (using Tor, multi-hop VPNs, ODoH, etc), but if any single entity has data from every hop, then the entire path can be reconstructed and your device is linked to the destination server. With multi-hop VPNs, you just have to trust the VPN provider. With Tor, hops are picked at random and you just hope that the intermediate servers aren't colluding.

Oracle is not a privacy business, and they give away VPS for cheap or free. I wouldn't be surprised if they sold data of their customers.

And again, if you are the only one using your VPS proxy server, then all the traffic from that VPS becomes a "fingerprint" of its own that can eventually identify you. This is called pseudonymity. Everybody has their own tastes and preferences after all, and traffic patterns can reveal that. With a Tor or VPN, you can constantly switch proxies, and your traffic is mixed with thousands of others, so extracting a single person's traffic becomes much harder.

[–] iopq@lemmy.world 1 points 1 day ago (1 children)

How does Google know the request is for example.com? It's encrypted. They only know my VPS requested some domain name from CF.

You're assuming Oracle goes inside my VPS and dumps the RAM?

[–] hirihit640@sh.itjust.works 1 points 1 day ago (1 children)

Because CF has to know the DNS request to ask the name server to resolve it. And CF sells the data to google.

Oracle doesn't need to dump the ram. It can see the network packets coming from your device, to Cloudflare.

It's a two hop path to the destination: you -> Oracle -> CF -> nameserver. If both Oracle and CF sell data to Google, then it's the same as both hops colluding, which reveals the entire path.

[–] iopq@lemmy.world 1 points 9 hours ago (1 children)

It doesn't know it, it passes the encrypted content between the DNS resolver and the requester

The packets are encrypted! Oracle doesn't know the keys unless they read the RAM of the VPS

[–] hirihit640@sh.itjust.works 1 points 4 hours ago* (last edited 4 hours ago)

Doesnt matter if the packets are encrypted, they have a destination. It's like if you sent mail to a sketchy address, it doesn't matter if the envelope is never opened, the address is still on the envelope.

So in this case the envelope would be going to cloudflare. Both Oracle and Cloudflare tell google about the envelope, and Cloudflare opens the envelope and tells google that the envelope was asking about xxx-website.com.

[–] jws_shadotak@sh.itjust.works 32 points 1 week ago (9 children)

AirVPN user for the past few years. No complaints except their website user interface.

[–] brb@sh.itjust.works 3 points 6 days ago

Same. AirVPN seemed to be the only one offering static port forwarding at decent price when I was comparing options.

[–] mnemonicmonkeys@sh.itjust.works 2 points 6 days ago (1 children)

I tried them about a year ago but everything was miserably slow

[–] CrimeIsLegalNow@ani.social 2 points 5 days ago (1 children)

Not all of their servers are created equal.

[–] mnemonicmonkeys@sh.itjust.works 1 points 5 days ago (1 children)

I tried 3 different servers and they all sucked. At some point you stop giving them the benefit of the doubt

[–] CrimeIsLegalNow@ani.social 1 points 5 days ago

One of the things I noticed it that it was absolutely fine for downloading... things... from various file sharing type resources, but I had to fiddle with the settings to steam HD video. I just followed a setup guide I found with google to troubleshoot that, but it probably is worth mentioning that streaming can be a problem if you don't.

[–] atro_city@fedia.io 1 points 6 days ago (1 children)

Really? A friend left AirVPN because of the connection always dropping. Dunno what they moved to afterwards, but no complaints in the group chat since. It was difficult to have a call with them because the connection just kept dropping a few minutes into the call.

[–] jws_shadotak@sh.itjust.works 2 points 6 days ago (1 children)

Weird. I've never had an issue with their reliability. I have only ever used the Netherlands or US servers though

[–] atro_city@fedia.io 1 points 5 days ago

That might've been the issue. No idea which countries they were using.

load more comments (6 replies)

[–] CH3DD4R_G0BL1N@sh.itjust.works 15 points 1 week ago (10 children)

I’ve seen AirVPN and IVPN mentioned in this type of thread but haven’t fully evaluated them yet as I’m in the same situation of gathering options.

load more comments (10 replies)

load more comments