Despite their nameand stated goal , Virtual Private Networks (VPNs) often introduce users to new security and privacy threats. For example, recent studies have shown that VPNs can leak user traffic to third-party trackers. In light of these developments, we set out to understand how and why a highly educated population, university students, chooses and uses VPNs, whether they are aware of data leakages by VPNs, and how their awareness and attitudes about VPNs affects their decisions to use them. To answer these questions, we conducted 32 in-person interviews , a survey with 350 respondents, and a controlled lab study with 11 users, all university students in the United States. We found that , surprisingly, access , cost, and performance trumped privacy concerns for many users ; many users even expected that their VPNs were collecting data about them . Even presenting information to users about the data leaked from VPNs to third-party trackers had little effect on their attitudes, suggesting that more work is needed to improve ways to show users what can be inferred from data collected about them .
In spite of their name , Virtual Private Networks (VPNs) may introduce users to new security and privacy threats. Recent studies have shown that some commercial VPNs leak user traffic to third-party trackers. In light of these developments, we aim understand how and why a technically savvy population---university students---chooses and uses VPNs, whether they are aware of data leakages by VPNs, and how awareness and attitudes about VPNs affects decisions to use them. To answer these questions, we conducted 32 in-person interviews and a survey with 349 respondents, all university students in the United States. We found that students were mostly concerned with access to content, and privacy concerns were often secondary. They made tradeoffs to achieve a particular goal, such as using a free commercial VPN that potentially collects their online activities simply to access an online service in a geographically restricted area. Many users even expected that their VPNs were collecting data about them , although they did not understand how VPNs work. Given the proliferation of choices among VPN providers, it is technically possible to achieve both access and privacy. We conclude with a discussion, informed by our results, concerning ways to help users make choices about VPNs that help them access content without compromising privacy .
R
Despite their nameand stated goal
In spite of their name
R
often
may
R
For example, recent
Recent
R
VPNs can
some commercial VPNs
R
set out to
aim
R
highly educated population, university students, chooses
technically savvy population---university students---chooses
D
their
D
their
R
,
and
R
350 respondents, and a controlled lab study with 11 users,
349 respondents,
R
, surprisingly, access , cost, and performance trumped privacy concerns for many users ; many users
students were mostly concerned with access to content, and privacy concerns were often secondary. They made tradeoffs to achieve a particular goal, such as using a free commercial VPN that potentially collects their online activities simply to access an online service in a geographically restricted area. Many users
R
. Even presenting information to users about the data leaked from VPNs to third-party trackers had little effect on their attitudes, suggesting that more work is needed to improve ways to show users what can be inferred from data collected about them
, although they did not understand how VPNs work. Given the proliferation of choices among VPN providers, it is technically possible to achieve both access and privacy. We conclude with a discussion, informed by our results, concerning ways to help users make choices about VPNs that help them access content without compromising privacy