We’ve watched this movie before. A VPN provider gets breached, or a researcher finds their “no-log” policy is meaningfully less than advertised, or a jurisdiction issue surfaces that makes their privacy promises structurally impossible to keep. The provider issues a statement. The statement is carefully worded. Users who read the fine print find out the promise wasn’t quite the promise they thought it was.
This isn’t an indictment of VPNs as a category. There are legitimate use cases: accessing geo-restricted content, securing a connection on an untrusted network, adding a layer of obfuscation when that matters. What this is an indictment of is the way VPNs have been marketed to consumers as a general-purpose privacy tool — because for most of what consumers actually want, VPNs are the wrong layer.
What the pattern looks like
Every incident has the same shape:
- A court order, subpoena, or law enforcement request lands on the VPN provider’s desk
- The provider discovers their “no log” policy has asterisks — billing data, connection timestamps, or server logs that seemed harmless individually turn out to be correlation-friendly
- A user gets identified who thought they were anonymous
- The provider updates their privacy policy. The changelog is not featured prominently.
Or the breach variant:
- The server infrastructure gets compromised
- All that traffic that was “securely tunneled” through the provider was also centralized through the provider — which is exactly the attack surface that gets exploited
- The provider discloses (eventually)
The fundamental architecture problem
When you use a VPN for privacy, you’re not eliminating a surveillance point — you’re moving it. Your ISP no longer sees your traffic. Your VPN provider now does. Whether that’s an improvement depends entirely on which entity you trust more and which legal jurisdiction they’re actually operating in (not just where they’re registered).
There’s also the aggregation problem: millions of users funneling traffic through a small number of servers creates an exceptionally attractive target. Compromise one provider, get correlation data on millions of users at once.
What DNS blocking does differently
DNS blocking has no central infrastructure to breach in this way. Your filter list is a text file. It resolves locally or at your own DNS resolver. There’s no provider logging which domains you looked up in aggregate with millions of other users.
The attack surface is your device and your network — which you control. Not a third-party server farm in a jurisdiction you can’t audit.
This isn’t about VPNs being bad. It’s about using the right tool for the right threat model. For the vast majority of consumers who want to stop ads, trackers, and malware from loading — DNS blocking is more effective, faster, architecturally simpler, and doesn’t require trusting a company with a log of every site you visited.
Every time a major VPN incident makes the news, we’ll break it down here — what happened, what it means for users, and whether you should care. Subscribe via RSS if you’d rather not check back manually.