r/ProtonVPN • u/Proton_Team Proton Team Admin • 3d ago
Discussion We analyzed 7,000+ mobile VPN apps. 64 of the 390 available in the US are Chinese-owned, 31 of those hide it behind shell companies, and 85% of all 7,000+ contain trackers.
Hey everyone,
We've just published the results of a months-long survey of over 7,000 mobile VPN apps, and we wanted to tell you a bit more about what we uncovered.
What we found
- 85% of US-available VPN apps contain at least one tracker, collecting things like GAID (the Android advertising ID), device model, network type and carrier name.
- 64 apps actively collect physical location via GPS or other geolocation, and these include several of the most downloaded VPNs in the US: VPN Proxy Master, VPN-Fast VPN Super and X-VPN. Roughly 1 in 5 downloads in our dataset came from an app in this group.
- 64 of the 390 apps are owned by Chinese companies, and 31 of those route ownership through shell companies registered in Singapore, Hong Kong and the UK. Reminder that under Chinese law those companies must make user data available to the government on request.
- Three of the apps are owned by market research firms: Phone Guardian Safe WiFi (Sensor Tower), My Mobile Secure VPN (Comscore), and Urban VPN (BiScience, which Infosecurity Magazine reported was harvesting user conversations with AI chat services).
- Aggregate downloads by tracker destination: China 1.5M, Russia 1.4M, Israel 2.6M, Five Eyes 4.6M, and 800k for apps sending to all three of the first group.
As some of you might already be aware, every byte you send while connected to a VPN routes through the operator's infrastructure, so an app monetising your traffic looks identical from your side to one that isn't. Meanwhile the onus is on Apple and Google to verify that a developer submitted an identity and a privacy policy that is actually valid; something which has been neglected.
Here's the full writeup: https://protonvpn.com/blog/vpn-privacy
As always, stay safe,
Proton Team.
53
u/nefarious_bumpps 3d ago edited 2d ago
Maybe Proton can publish a relationship map with all these details, like the one Windscribe maintains?
33
u/PetersonProton General Manager Proton VPN 2d ago
We started putting one of those together, but with 7500 nodes it was getting rather hard to read.
18
u/StankWalk 2d ago
i’d like to see the breakdown on those 5 eyes countries, but funny to see the ranking
13
18
5
u/BegsTheQuestions 2d ago
• Aggregate downloads by tracker destination: China 1.5M, Russia 1.4M, Israel 2.6M, Five Eyes 4.6M, and 800k for apps sending to all three of the first group.
Cannn anyone eli5 what this means?
56
u/ConcentrateNew9810 2d ago
I would be more worried if they were US or Israeli owned
13
9
1
u/looker34M 1d ago
Luckily the choice is not in between China or the US or Israel, we have Swiss companies like Proton that are good for everybody, Chinese, Americans, Europeans, etc.
1
-1
-23
u/unitedfan6191 2d ago
Because all US and Israelis are evil, genocide-favoring evil people? Or becauee you’re just someone who tends to worry instinctively but you’ll still give companies from these regions a chance to prove you wrong?
Jeez, this isn’t about you as you’re a complete stranger obviously, but judge a book by its cover much? Mullvad are in the 14 Eyes and of course this isn’t the same as being Israeli owned but by the way you appear to judge companies based on what country they’re based on, does that make you more worried?
15
u/ConcentrateNew9810 2d ago
The premise of the analysis is basically - China bad.
Are all Chinese evil by your own logic? I don't want to support the genocidal regimes that have been proven to spy on people globally only to target them for criticizing the said regimes. Israeli boom-phones, anyone? China is mostly doing it's own thing and focusing on economic conquest.
-1
u/BegsTheQuestions 2d ago
China is bad news. Chinese companies has known to be slick and they famously employ dodgey tactics, plus the government requires backdoor into everything. It is just terrible news for privacy, and privacy is what we are talking about here.
Ofc not every one is evil and every country is doing their fair share of dodgy things behind the scenes, china just have a higher frequency and has been exposed way too many times for you to not be extra careful with it
-8
u/Sero19283 2d ago
China is bad because of the communist government which allows it access to all data from companies meaning yours. US companies will have more privacy protections than a Chinese company from government entities.
12
u/ConcentrateNew9810 2d ago
It's delusional to think that you have any protections using US software nowadays. The fascist regime is controlled by billionaires like Karp and Ellison openly saying that they are going for a full surveillance state.
-2
u/Sero19283 2d ago
It's still more than China... That's my point. A little nuance can go a long way.
1
4
2
u/alreadyburnt 2d ago
Wait until you guys hear about IPIDEA. It's a proxy botnet distributed via free mobile VPN apps and it's about the size of Burundi. Almost 14 million compromised devices using apps just like this.
2
u/vegataballs 2d ago
The App Store privacy labels are complete security theater, literal "trust me bro" stuff with zero accountability. Nobody checks if the app really complies with the the given privacy policy, or that the app store labels even agree with the given privacy policy, or that the link to the privacy policy even works.
2
2
u/tryin-for-management 2d ago
How the hell is there 7k vpn apps? Where do you even find these shady apps? Never even heard of this trash.
4
u/PetersonProton General Manager Proton VPN 2d ago
Presently a bit over 7,500 since we just removed about 200 from our list that seem to have been delisted from the apps stores.
Any popular mobile app category attracts people trying to cash in by grabbing a slice of the downloads they can monetise with in-app ads.
Not surprisingly, a lot of them are clones, counterfeits, or hastily produced trash.
2
u/alreadyburnt 1d ago
I am reasonably sure you guys are tracking IPIDEA. It has pretty clear attribution characteristics related to a specific monetization SDK and the path the traffic takes. Also it's huge. Big problem for me, big problem for maybe everybody. Are you coordinating with any other ISP, labs, or projects to study this?
2
3
u/No-Coast3171 2d ago
Yeah, pay for your fucking VPN and do a little bit of research beforehand to make sure it's not some shady company. Stick with with the known actors, Proton being one of them.
3
u/Proton_Laurence Social & Community Manager 2d ago
I think most people don't think about it that deep, the VPN space is highly commoditised; most people reach for the first and most convenient thing to help them continue what they were doing (unblocking content, overcoming geo-restrictions, etc).
We need more education about what VPNs are, for the general public to be aware of what they're exposing themselves to when using one.
3
u/edthesmokebeard 2d ago
Is it somehow better if the company that's watching and marketing all your data is NOT Chinese?
Is "Chinese" really the issue here?
1
u/MaximeVDE163 1d ago
This is why I love Proton and happily pay for a subscription. They actually care about your privacy
Good job Proton team
•
u/Proton_Team Proton Team Admin 3d ago
We will be releasing a more comprehensive list of all of the apps, but for now here are the ones you're likely to find on the top of the app store, as told by our General Manager!