GCHQ (Government Communications Headquarters)

Britain’s version of America’s NSA. and it performs extensive surveillance of UK citizens.

Geo-restrictions (Also Geo-blocking)

Limiting access to online services based on geographic location. For example, only US residents are permitted to access Hulu, and only UK residents can access BBC iPlayer. Geo-restrictions are usually enforced so that copyright holders can make lucrative licensing deals with distributors around the world, at the expense of consumer choice.

Geo-spoofing

Using a VPN, SmartDNS, or proxy to ‘spoof’ your geographic location, making it appear like you are connecting from a different country. This allows you to bypass geo-restrictions and access content denied to you based on your actual location. For example, accessing Netflix to view content that’s not available where you live. See our geo-spoofing guide for more information.

HTTPS (Hyper Text Transfer Protocol Secure)

This is a protocol that uses SSL/TLS encryption to secure websites. It is used by banks, online retailers and more. It is the backbone of all security on the internet. When you visit an HTTPS website, any outside observer can see that you have visited the website, but that’s all. They cannot see, for example, any details you might have entered. You can easily see if a website is using HTTPS by looking for a closed padlock icon in your browser’s address bar, and because the website address (URL) will begin with “https://”.

Malware

Malware is a catch-all term for any number of dangerous, intrusive programs that hackers/scammers attempt to use. Examples of malware include trojans, ransomware, worms, keyloggers and more. You can learn more in our guide to the different types of malware.

Metadata

If data is “the what” – Emails, phonecalls, websites, etc, then metadata is “the when, where and who” that goes along with it. Metadata can provide a vast amount of highly personal information about our movements, who we know, how we know them, and so on. Governments and surveillance organizations are keen to downplay the significance of collecting ‘only’ metadata, but if it is so harmless, why are they so keen on obtaining it?

Non-Fungible Token (NFT)

A non-fungible token (NFT) is a unique digital code that represents some kind of digital item. Most commonly, this representation is with a piece of artwork or even just a 

Think of it in terms of owning a one-of-a-kind baseball card or the like – Your particular NFT is the only one like it. NFTs are secured and stored on a public blockchain, and the buying and selling of NFTs is usually through cryptocurrencies such as Ethereum.

OpenVPN

The most commonly used VPN protocol used by commercial VPN providers, OpenVPN is Open-source, and, when backed by a strong encryption cypher (such as AES), is thought to be secure against even the NSA. Where possible we generally always recommend using OpenVPN.

P2P (Peer-to-Peer)

A term often used almost interchangeably with downloading, torrenting, or file sharing, and often associated with copyright piracy, a peer-to-peer network is a distributed and decentralized platform for sharing data (such as files) between users. The most famous application of P2P is the BitTorrent protocol. Because there is no central database, and files are shared among users, P2P networks are very resilient to attack.

PGP (Pretty Good Privacy)

The best way to keep your private email private is to use PGP encryption. However, the concepts involved are complex and often confusing; a problem compounded because setting up PGP encrypted email is unintuitive, and poorly explained in a lot of existing documentation. Secure email providers like StartMail and Posteo are attempting to make email encryption available to anyone regardless of their level of technical understanding.

WireGuard

WireGuard is, in short, the new hotness. It is the most up-to-date VPN protocol used by VPN providers. Compared to OpenVPN, it is easier to set-up, offers faster connections speeds and is even more secure. Some VPN providers, like NordVPN and ExpressVPN, offer their own custom versions of WireGuard as an option.

The technical

In this section, you’ll find some of the more obscure technical terms that you might see referenced across the site.

Adversary

This is a phrase used by IT security professionals. An “

Backdoor

A weakness or a secret cryptographic key deliberately built-in to encryption to allow it to be breached. Governments and law enforcement agencies around the world are pushing for tech companies to introduce these into their cryptography products, arguing that this is necessary in order to combat the use of encryption by terrorists and criminals.

Just about everyone else agrees that backdoors are a terrible idea, because to deliberately weaken encryption makes everyone unsafe, as a backdoor that is accessible to law enforcement will be just as accessible to criminals.

Blockchain

A distributed database or public ledger that cannot be tampered with. Blockchains are most closely associated with cryptocurrencies such as Bitcoin, where they are used to record and verify every transaction made using a whole or a fraction of that currency in order to prevent fraud and other irregularities. Other uses for the blockchain are also being developed, such as for tracking shipping containers or food distribution and provenance. You can learn more in our Blockchain Explained article.

Browser fingerprinting

A technology that uses various attributes of a web browser to create a unique ‘fingerprint’ of visitors to a website. This is then used to identify and track them as they browse the internet. Browser fingerprinting is pernicious because it is very difficult to block (in fact, every add-on used to prevent other forms of tracking only serves to make a browser more unique, and more susceptible to fingerprinting).

Closed-source software

Most software is written and developed by commercial companies. Understandably, these companies are keen to make sure that others can’t steal their hard work or trade secrets, so they hide the code away from prying eyes using encryption and threats of legal action. This is all quite understandable, but when it comes to security, it presents a major problem. If no-one can ‘see’ the details of what a program does, how can we know that it’s not doing something malicious?

The short answer is, we can’t. So we simply have to trust the company involved, which is something us paranoid security types are loath to do (with good reason). The alternative to closed-source is Open-source software.

Data authentication

In order to verify encrypted data and connections (such as VPN), something known as a cryptographic hash function is commonly used. This is an algorithm that takes an arbitrary amount of data input – a credential – and produces a fixed-size output of encrypted text called a hash value, or “hash” which can be used to verify a user’s identity. By default, OpenVPN uses SHA-1 thought this has been considered vulnerable to attack since 2015. Some VPN providers therefore offer more secure data authentication, such as SHA256, SHA512, or even SHA3.

EU Data Retention Directive (DRD)

The EU adopted the extensive and highly controversial mass surveillance legislation, the mandatory Data Retention Directive in March 2006, requiring all ISPs and communications providers to keep data for at least 12 months. Over the next few years most (but not all) EU counties incorporated the DRD into their local legislation. In April 2014, however, the European Court of Justice (ECJ), the highest court in the EU, declared the EU-wide DRD invalid on human rights grounds.

Despite this ruling, most EU counties have yet to abolish local implementation of the law (and the UK has gone so far as to strengthen it).

Encryption key length

The crudest way of determining how long a cypher will take to break is the raw number of ones and zeros used in the cypher. Similarly, the crudest form of attack on a cypher is known as a brute force attack (or exhaustive key search), which involves trying every possible combination until the correct one is found. Ciphers used by VPN providers are invariably between 128-bits to 256-bits in key length (with higher levels used for handshake and data authentication).

ETags

These are a part of HTTP (Hyper Text Transfer Protocol), the protocol for the World Wide Web. Their purpose is to identify a specific resource at a URL, and track any changes made to it. The method by which these resources are compared allows them to be used as a kind of digital fingerprint, as the server gives each browser a unique ETag, and when it connects again, it can look the ETag up in its database. ETags are sometimes used to by websites to identify and track visitors for advertising purposes.

Five Eyes (FVEY)

A surveillance alliance comprising Australia, Canada, New Zealand, the United Kingdom, and the United States. Intelligence is freely shared between security organizations of member countries, a practice that is used to evade legal restrictions on spying on their own citizens. There are other such alliances in place, including Nine Eyes, Fourteen Eyes and others.

Handshake

This is the process used by SSL/TLS to exchange and authenticate certificates, and to establish an encrypted connection. To ensure this process cannot be tampered with, OpenVPN can use either RSA encryption possible (up to RSA-4096).

History stealing

History stealing is a way of exploiting how the Web is designed. It allows a website to discover your past browsing history. The simplest method, which has been known about for a decade, relies on the fact that web links change color when you click on them (traditionally from blue to purple). When you connect to a website, it can query your browser through a series of yes/no questions to which your browser will faithfully respond, allowing the attacker to discover which links have changed color, and therefore to track your browsing history. You can read more about it in our “

I2P (Invisible Internet Project)

A decentralized network built using Java on similar principles to the Tor network, but which was designed from the ground up as a self-contained darkweb. As with Tor, users connect to each other using peer-to-peer encrypted tunnels, but there are some key differences, including the use of a distributed peer-to-peer directory model. The end result is that I2P is faster than Tor, more secure, and more robust. It is however not at all user-friendly, and has a high learning curve.

IP Leak

If for any reason a website or other internet service can see your true IP address or detect your ISP, then you have an IP leak. To determine if you are suffering an IP leak, visit our VPN Leak Testing Tool page.

This is the default system used to define IP address values (see the IP Address entry in the Basics section). Unfortunately, thanks to the unprecedented rise in internet use and connected devices over the last few years, IPv4 addresses are running out, as IPv4 only supports a maximum 32-bit internet address. This translates to 2^32 IP addresses available for assignment, or about 4.29 billion total, and we’ve already used almost all of them.

Internet Protocol Version 4 (IPv4)

This is the default system used to define IP address values. The range of IPv4 addresses runs from 0.0.0.0 to 255.255.255.255, which means there can be a maximum of over 4 billion unique addresses which, back in the day, was thought to be more than enough!

Unfortunately, thanks to the unprecedented rise in internet use and connected devices over the last few years, IPv4 addresses actually ran out back in 2011 and we’ve been re-using them ever since. IPv4 has now been superseded by IPv6.

Internet Protocol Version 6 (IPv6)

While various mitigating strategies have been deployed to extend the shelf-life of IPv4, the real solution comes in the form of a new standard – IPv6. This utilizes 128-bit web addresses, thus expanding the maximum available web addresses to 2^128 (340,282,366,920,938,000,000,000,000,000,000,000,000 or 340 trillion trillion trillion), which should keep us supplied for the foreseeable future.

Unfortunately, adoption of IPv6 has been slow, mainly due to upgrade costs, backward capability concerns, and sheer laziness. Consequently, while all modern Operating Systems support IPv6, many websites do not yet bother.

L2TP/IPsec

A VPN tunneling protocol and encryption suite. Built into most internet enabled platforms, L2TP/IPsec has no major known vulnerabilities, and if properly implemented may still be secure. However, Edward Snowden’s revelations strongly hinted at the standard being compromised by the NSA, and it may have been deliberately weakened during its design phase. Check out our Ultimate Guide to VPN Encryption for more information on L2TP/IPsec.

The National Security Agency (NSA)

The American organization responsible for global monitoring, collection, and processing of information and data for foreign intelligence and counterintelligence purposes. The NSA collects vast amounts of information on US citizens, and the staggering power and scope of both its domestic and foreign intelligence gathering are on a scale that few imagined possible.

The term ‘the NSA’ is sometimes used as a general catch-all phrase to refer to any hugely powerful government funded global agency.

Obfuscation/obfuscated

An “

Open-source software

An open access software development model where the software code is made freely available for any developer to improve, use, or distribute as they wish. This is particularly important for security and privacy related programs, as it means that ‘anyone’ can look at the code and make sure that it does not contain engineered weaknesses or backdoors, is not sneakily sending users’ details to the NSA, or doing something else malicious.

There are few people with the expertise, time, and inclination to audit often very complex code (usually for free), so the vast majority of Open-source code remains un-audited. Nevertheless, that the code can be examined offers the best guarantee that it is ‘clean’ we have.

Point-to-Point Tunneling Protocol (PPTP)

An old VPN protocol, available as standard on just about every VPN capable platform and device, and thus easy to set up without the need to install additional software, PPTP remains a popular choice both for businesses and VPN providers. It is, however, widely known to be very insecure, and can be easily cracked by organizations such as the NSA. Perhaps even more worrying is that the NSA has (or is in the process of) almost certainly decrypting the vast amounts of older data it has stored, which was encrypted back when even security experts considered PPTP to be secure.

PPTP will probably protect you against a casual hacker, but should only be used when no other option is available, and even then not for protecting sensitive data.

Proxies

A proxy server is a computer that acts as an intermediary between your computer and the internet. Any traffic routed through a proxy server will appear to come from its IP address, not yours. Unlike VPN servers, proxy servers do not usually need to devote resources to encrypting all traffic that passes through them, and therefore can accept simultaneous connections from a great many more users (typically tens of thousands).

A recent survey found that most public proxies are very unsafe, so if you must use a public proxy, then only use one that permit HTTPS, and try to stick to visiting only HTTPS secured websites.

RSA encryption

In order to set up a secure VPN connection, SSL (and therefore OpenVPN and SSTP) typically uses the RSA asymmetric public-key cryptosystem (asymmetric because a public key is used to encrypt the data, but a different private key is used to decrypt it.) RSA acts as an encryption and digital signature algorithm used to identify SSL/TLS certificates, and has been the basis for security on the internet for the last 20 years or so. As we know that RSA-1048 has been cracked by the NSA, for VPN we recommend using the strongest RSA key length possible (RSA-4096 is very good).

Safe Harbor Framework/Privacy Shield

The Privacy Shield.

The European Court of Justice ruled in July 2020 ruled that Privacy Shield was not a suitable mechanism for the lawful transfer of EU personal data to the US. As of February 2022, there has been no replacement put in place for Privacy Shield, though negotiations are ongoing between the EU and US.

Shared IP addresses (Shared IPs)

Shared IPs (as opposed to static IP addresses); a common strategy used by VPN providers to increase customer’s privacy is to assign many customers the same IP address (which they’ll share). This makes it very difficult (but not necessarily impossible with enough effort) for both outside observers and the VPN provider to determine which user of a given IP is responsible for any specific action.

SmartDNS

This refers to services that allow you to evade geo-blocking restrictions by connecting to DNS servers in different counties. When a device is configured to connect to these, it appears to be located in that country. How many countries are supported depends on the service, but almost all have servers in the United States and the UK thanks to the popularity of their online TV services (such as Hulu and BBC iPlayer).

Because no encryption or other fancy stuff is involved, SmartDNS is much faster than VPN (so fewer buffering issues), but it provides none of the privacy and security benefits of VPN. If your only concern is to access geo-restricted media content from abroad, then SmartDNS may be a better option than VPN. If you are interested in finding out more, check out our list of the best VPN providers who also offer SmartDNS.

Software audit

This is when experts carefully examine a program’s code to determine if it is free of backdoors, deliberately engineered weaknesses, or other similar security concerns. Open-source software is open for independent audit at any time, although in practice there are few people with the expertise, time, and inclination do actually do it. Some companies (such as ProtonMail) have released products that are closed source, but which have been professionally audited by independent and respected experts.

This introduces the tricky question of which can be trusted more – code that is closed but has been independently audited, or code that is open as is therefore available for anyone to audit, but hasn’t been…

Secure Socket Layer and Transport Layer Security (SSL/TLS)

TLS is the successor to SSL, but the terms are often used interchangeably. It is the cryptographic protocol used to secure HTTPS websites (https://). OpenVPN uses an Open-source implementation of it, called OpenSSL. SSL encryption is considered fairly secure, but concern is growing over the certificate system used to authenticate connections.

SSL/TLS certificates

Certificates used by SSL/TLS to verify that the website you connect to is the website you think you are connecting to. If a browser is presented with a valid certificate, then it will assume a website is genuine and set up a secure connection. It will then display a locked padlock in its URL bar to alert users that it considers the website secure. SSL certs are issued by a Certificate Authority (CA).

Supercookies

A catch-all term used to refer to bits code left on your computer that perform a similar function to cookies, but which are much more difficult to find and get rid of than regular cookies. The most common type of super-cookie is the Flash cookie (also known as an LSO or Local Shared Object), although ETags and Web Storage also fall under the moniker. In 2009, a survey showed that more than half of all websites used Flash cookies.

The reason that you may never have heard of super-cookies, and the reason they are so hard to find and get rid of, is that their deployment is deliberately sneaky and designed to evade detection and deletion. This means that most people who think they have cleared their computers of cookies might still have these hiding in the corners.

Lots of people want to sell you stuff, and one way that has proven very successful at doing this is to display ads to tailored to individual internet users that speak to their own personal interests, tastes, hobbies, and needs. In order to deliver this kind of personalized advertising, the advertisers need to learn as much about you as they can. This is why companies Google and Facebook scan all your emails, messages, posts, likes, and searches made.

This allows them to build up a scarily accurate picture of you (including your political views, sexual preferences, and of course, the things you like to buy!). They and a host of smaller advertising and analytics companies also use a variety of deeply underhand technologies to uniquely identify you and track you across websites as you surf the internet.

Threat model

When considering how to protect your privacy and stay secure on the internet, it is useful to consider exactly who or what you are most worried about. Not only is defending yourself against everything difficult to the point of being impossible, but any attempt to do so will probably seriously degrade the usability (and your enjoyment) of the internet.

Accepting that being busted for downloading an illicit copy of Game of Thrones is likely a bigger threat than being targeted by a crack NSA team for personalized surveillance will not only leave you less stressed, but likely also with more effective defenses against the threats that matter to you.

Tor (The Onion Router)

An anonymity network that provides free software designed to allow you to access the internet anonymously. Unlike VPN, where the VPN providers know your real IP address and can see your internet traffic at the exit point (the VPN server), with Tor your signal is routed through a number of nodes, each of which is only aware of the IP addresses in front of the node and behind it.

This means that at no point can anyone know the whole path between your computer and the website you are trying to connect with. Tor, therefore, allows for true anonymity while surfing the web, but does come with a number of important downsides.

Tor hidden services

One of the biggest dangers of using the Tor anonymity network is Tor exit nodes – the last node in the chain of nodes that your data travels through, and which exits onto the web. Tor exit nodes can be run by any volunteer, and who can potentially monitor your internet activities. This is not as bad as it sounds, as thanks to the random path your data takes between nodes, the exit node cannot know who you are.

However, a global adversary with unlimited resources (such as the NSA) could, in theory, take control of enough nodes to endanger the anonymity of Tor users. In order to counter this threat, Tor allows users to create “

Two-Factor Authentication (2FA)

Something you know + something you have. One factor authentication requires a single step to verify your identity, such as knowing your username and password (something you know). Two-Factor Authentication provides an additional layer of protection against hackers by also requiring you to have something. For online services, this is typically something in the shape of a text sent to your phone, or an email with a code. It can also be a third-party service like Google Authenticator or a USB key.

URL (Uniform Resource Locator)

The alphanumeric address of websites that humans use (e.g. afdolvpn.com). All browsers have a URL address bar at the top, where if you enter the URL, you will be taken to the named website. Computers do not understand the URL, so this is where DNS comes in. DNS converts that URL into the numeric IP address that computers understand.

Usage Logs

Our term for the collection and storage of details about what users actually get up to on the internet – as opposed to the collection of metadata (connection logs). Many VPN providers who claim to keep no logs are, in fact, only referring to keeping no usage logs, and do keep various (often extensive) connection logs.

Virtual Private Server (VPS)

A Virtual Private Server is where you rent a space on a physical (bare metal) server run by a VPS company. This provides a closed environment that acts as if it was a complete physical remote server. You can install any operating system on a VPS (as long as the provider allows it), and basically treat the VPS as your own personal remote server. Renting a VPS tends to be a cheaper option than actually purchasing or renting your own server in a data center, as each server can have multiple customers using it at the same time.

Warrant canary

A method used to alert people that a gag order has been served on a provider. This typically takes the form of a regularly updated statement that no gag order has been served. If the statement does not receive its regular update, then the 

However, this notion has not been legally tested in most counties, and it is entirely possible that courts would find the use of a warrant canary in contempt of the gag order and the need to keep warrant canaries up-to-date is routinely ignored, making their existence completely pointless!

Web storage (also known as DOM storage)

Web storage is a feature of HTML5 (the much-vaunted replacement to Flash), which allows websites to store information on your browser in a way similar to cookies, but which is more persistent, has a greater storage capacity, and which cannot normally be monitored, read, or selectively removed from your web browser. Unlike regular HTTP cookies, which contain 4 kB of data, web storage allows 5 MB per origin in Chrome, Firefox, and Opera, and 10 MB in Internet Explorer. Websites have a much greater level of control over web storage and, unlike cookies, web storage does not automatically expire after a certain length of time and is set to permanent by default.

WebRTC leak

A WebRTC leak is like a DNS or IPv6 leak in that it reveals your real IP address, even when you are connected to a VPN. A WebRTC leak can happen when you’re trying to establish video or audio communication through a browser that uses WebRTC technology. Google Hangouts uses WebRTC, as does the popular messaging platform Discord. WebRTC was developed by Google and is built into many modern browsers, including Edge, Firefox, Chrome, Safari and Opera.