vikarti.anatra/safing-web
1
0
Fork 0
mirror of https://github.com/safing/web synced 2026-07-09 16:09:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

SPN vs VPNs post: rewrite comparison as factual and neutral

Browse source
This commit is contained in:
johnnyburnaway 2026-04-22 17:15:21 +02:00
parent 3218df812a
commit 9001f446d2
4 changed files with 34 additions and 45 deletions
Download patch file Download diff file Expand all files Collapse all files

6
_includes/spn_vs_vpns_tech.html
View file

@ -8,7 +8,7 @@
<thead class="card-table-header">
<tr class="card-table-header-row">
<th class="card-table-header-row-cell"></th>
<th class="card-table-header-row-cell"><span tooltip="Safing Privacy Network">SPN <i class="icon-info text-md"></i></span></th>
<th class="card-table-header-row-cell">SPN</th>
<th class="card-table-header-row-cell">Most VPNs</th>
</tr>
</thead>
@ -26,7 +26,7 @@
<tr class="card-table-body-row">
<td class="card-table-body-row-cell-title">No Network Logs</td>
<td class="card-table-body-row-cell"><i class="icon-tick text-2xl text-green-500"></i></td>
<td class="card-table-body-row-cell"><i class="icon-cross text-2xl text-red-500"></i></td>
<td class="card-table-body-row-cell"><i class="icon-cross text-2xl text-red-500"></i><span class="mx-2">/</span><i class="icon-tick text-2xl text-green-500"></i></td>
</tr>
<tr class="card-table-body-row">
<td class="card-table-body-row-cell-title">No Kill Switch Needed</td>
@ -51,7 +51,7 @@
<tr class="card-table-body-row">
<td class="card-table-body-row-cell-title">Private Account and Payments</td>
<td class="card-table-body-row-cell"><i class="icon-tick text-2xl text-green-500"></i></td>
<td class="card-table-body-row-cell"><i class="icon-cross text-2xl text-red-500"></i></td>
<td class="card-table-body-row-cell"><i class="icon-cross text-2xl text-red-500"></i><span class="mx-2">/</span><i class="icon-tick text-2xl text-green-500"></i></td>
</tr>
</tbody>
</table>

9
_includes/spn_vs_vpns_top.html
View file

@ -8,7 +8,7 @@
<thead class="card-table-header">
<tr class="card-table-header-row">
<th class="card-table-header-row-cell"></th>
<th class="card-table-header-row-cell"><span tooltip="Safing Privacy Network">SPN <i class="icon-info text-md"></i></span></th>
<th class="card-table-header-row-cell">SPN</th>
<th class="card-table-header-row-cell">Most VPNs</th>
</tr>
</thead>
@ -59,12 +59,7 @@
<i class="icon-tick text-2xl text-green-500"></i>
</a>
</td>
<td class="card-table-body-row-cell"><i class="icon-cross text-2xl text-red-500"></i></td>
</tr>
<tr class="card-table-body-row">
<td class="card-table-body-row-cell-title">Built for Privacy</td>
<td class="card-table-body-row-cell"><i class="icon-tick text-2xl text-green-500"></i></td>
<td class="card-table-body-row-cell"><i class="icon-cross text-2xl text-red-500"></i></td>
<td class="card-table-body-row-cell"><i class="icon-cross text-2xl text-red-500"></i><span class="mx-2">/</span><i class="icon-tick text-2xl text-green-500"></i></td>
</tr>
</tbody>
</table>

8
_layouts/blog.html
View file

@ -10,12 +10,10 @@ layout: publication_container
</p>
{% endif %}
<span class="header-four-container-title-author text-md">
{{ page.date | date: "%B %-d, %Y" }} • Written by {{ page.author | capitalize }}
{% if page.updated %}
updated {{ page.updated | date: "%B %-d, %Y" }}
{% else %}
{{ page.date | date: "%B %-d, %Y" }}
<br>Updated: {{ page.updated | date: "%B %-d, %Y" }}{% if page.updated_author %} • Updated by {{ page.updated_author | capitalize }}{% endif %}
{% endif %}
• Written by {{ page.author | capitalize }}
</span>
<div class="header-four-container-social">
<a class="link text-safing-gray-200 hover-opacity-in" href="{{ site.discord_url }}"> <i class="icon-discord text-lg"></i> </a>
@ -28,6 +26,6 @@ layout: publication_container
<div class="markdown-container">
{{ content | replace: '<!--break-->', '<a class="anchor" id="continue"></a>' }}
{% if page.progress_update == null %}
<p>{{ page.date | date: "%B %-d, %Y" }} • Written by {{ page.author | capitalize }}</p>
<p>{{ page.date | date: "%B %-d, %Y" }} • Written by {{ page.author | capitalize }}{% if page.updated %}<br>Updated: {{ page.updated | date: "%B %-d, %Y" }}{% if page.updated_author %} • Updated by {{ page.updated_author | capitalize }}{% endif %}{% endif %}</p>
{% endif %}
</div>

56
_publications/2022-09-06-spn-vs-vpns.md
View file

@ -2,14 +2,16 @@
# possible values: blog video podcast
category: blog
layout: blog
title: What Makes SPN A Better Alternative to VPNs
title: How SPN Compares to VPNs
date: 2022-09-06
author: daniel
custom_thumbnail_name: spn-vs-vpn
portmaster_plug: true
updated: 2026-04-22
updated_author: viktor
redirect_from:
- /blog/2020/01/22/how-the-spn-compares-to-vpns/
summary: VPN is an out-dated technology that was never intended to protect your privacy. It simply swaps your one identity with one different identity, creating only a minor obstacle for today's mass surveillance. <span tooltip="Safing Privacy Network">SPN <i class="icon-info text-sm"></i></span> on the other hand is built from the ground up and fully designed to protect your privacy. It gives you multiple identities by default. Therefore we believe people looking for privacy will prefer SPN.
summary: SPN routes each connection independently through separate exit nodes using layered encryption, providing a different IP address per connection. VPNs route all traffic through a single server. This post compares how the two architectures differ.
---
{% include spn_vs_vpns_top.html %}
@ -58,27 +60,27 @@ This is how this looks like:
![Illustration showing the SPN connecting via multiple exit nodes](https://safing.io/assets/img/spn/spn-community-web.png)
Instead of just "beaming" yourself to another place, you can now be everywhere at once. *__Connections are individually routed through the network in order to make sure you have the best possible privacy and speeds.__*
Instead of just "beaming" yourself to another place, you can now be everywhere at once. Connections are individually routed through the network, balancing privacy and performance.
### Automatic Geo-Unblocking
The longer your connections stay within the SPN, the more private they are. This is why the SPN selects the final server (exit node) as close as possible to the destination server (eg: server of a website).
This does not only provide vastly improved privacy, but automatically unblocks geo-restricted content, as you will be accessing the content in the country it originates from.
This also automatically unblocks geo-restricted content, as you will be accessing the content in the country it originates from.
In case you have special requirements, you can of course instruct the SPN to use a specific country for a website. _Note: currently this feature is tricky to set up - it will improve in the future_
Needless to say, VPNs cannot do this automatically, as they can only use one "exit" server at once, even if they are "multi-hop".
VPNs cannot do this automatically, as they can only use one "exit" server at once, even if they are "multi-hop".
### You Can Easily Exclude Apps or Domains from SPN
While there are some VPNs that are able to exclude the local network (LAN) or certain apps from the VPN, the SPN takes this to a new level.
Similar to Portmaster firewall rules, you can very easily exclude any combination of domains or apps from being routed through the SPN. By default, it excludes local network resources, as well as any captive portal. You do not need to turn it off to log into the WiFi when traveling!
Similar to Portmaster firewall rules, you can very easily exclude any combination of domains or apps from being routed through the SPN. By default, it excludes local network resources, as well as any captive portal. You do not need to turn it off to log into the WiFi when traveling.
### Both VPNs and SPN Are Easy to Setup
SPN is part of Portmaster, which seamlessly integrates into your system and has a super simple installation process.
SPN is part of Portmaster, which seamlessly integrates into your system and has a straightforward installation process.
Most VPNs provide a custom app that is easy to install - some require you to manually configure a client, though.
@ -88,58 +90,52 @@ An auditable and open source code builds a high level of trust in the software.
The beauty with this is, the bigger the community around a software gets, the more secure it becomes, often outperforming proprietary software. Zero-day exploits and long-forgotten vulnerabilities become rarer since someone from the community usually discovers them.
The SPN is fully open source. Everyone can inspect the code and make sure it does what we say. While there are some VPN providers that open source their clients, most of them do not publish their source code, requiring even more trust in how they handle modern privacy threats on the basis of ancient technology built for another purpose.
The SPN is fully open source. Everyone can inspect the code and verify what it does. While some VPN providers open source their clients, most do not publish their server-side source code.
### SPN is Built for Privacy
### SPN and Privacy by Design
VPNs use a technology first created over 20 years ago with the intent to securely connect two distant private networks. It was never meant to protect a single device from the network, but to enable even more connectivity through a separate channel. The term "Private" in "Virtual Private Network" does not stand for "private as in secret", but for "private as in property".
VPN technology was originally designed to connect corporate networks securely, not to protect individual devices from the network itself. VPN providers have adapted the technology for consumer privacy, with varying results. Features like kill switches and no-log policies address real risks within the VPN architecture.
Only later companies started to offer a "VPN" as an online privacy solution for individual users. In order to do that, they had to twist the VPN technology into a direction it was not created for: protecting a device from the network itself. This is why VPN providers have problems with IP leaks and DNS leaks and try to circumvent the negative side effects with "Kill Switches" and "No Log Policies".
SPN was designed from the start for consumer privacy on a per-connection basis. Because it is integrated into Portmaster's network stack, it does not rely on external kill switches or default-route manipulation.
*__The SPN technology, on the other hand, was created from scratch with a single purpose in mind: Protecting your privacy on the Internet. Every single part of the SPN is geared towards this goal. There are no dirty fixes or bandages. Everything is carefully engineered to protect you.__*
The SPN does not have IP or DNS leaks, because it is part of Portmaster, the privacy firewall that is in control of all your connections.
The SPN does not need a kill switch and it does not need "No Log Policies", because all traffic goes through multiple servers and is encrypted in layers. This means that no server ever knows both who you are (ie. your IP address) and where you are going to (ie. the website you are visiting).
The SPN does not have IP or DNS leaks because it is part of Portmaster, which controls all network connections on your device. All traffic goes through multiple servers and is encrypted in layers, so no server ever knows both who you are and where you are going.
![Illustration showing the SPN connecting via multiple exit nodes](https://safing.io/assets/img/spn/spn-community-web.png)
The SPN does one thing and it is very good at it: Protecting your privacy.
### Conclusion
### Conclusion: SPN Is the Superior Privacy Solution
Going back to the threat modeling we started with, we believe that many VPN users actually want a level of privacy that VPNs simply cannot offer. The SPN is built from the ground up to be superior to VPNs in every aspect - in regards to privacy.
Going back to the threat modeling we started with, users who need per-connection IP separation and onion routing across all applications may find SPN a better fit than a traditional VPN. Both tools address different threat models.
## Part 2: Technical Deep-Dive Comparison
If you are the curious, explore more technical details in the additional write-up below:
If you are curious, explore more technical details in the additional write-up below:
{% include spn_vs_vpns_tech.html %}
### Cryptographic Identity Protection
VPNs (Virtual Private Networks) are, well, networks that carry data packets through a tunnel from one point to the next. They are a more or less seamless part of the network. Packets destined for the Internet go into the VPN and out again without change. This means that packets are just relayed somewhere else and do not receive any advanced protection. Multi-Hop VPNs just relay your packets via one more server, but the problem remains: The packets do not receive any extra protection. Every server in that Multi-Hop chain can see all your traffic. Yes, the last server cannot see your IP address, but the previous servers can see all your traffic unencrypted and log everything you do. Oh, and just hope that your VPN client does not log into the last server in the chain too, then it even might have your VPN login data and again know who you are.
VPNs (Virtual Private Networks) are, well, networks that carry data packets through a tunnel from one point to the next. They are a more or less seamless part of the network. Packets destined for the Internet go into the VPN and out again without change. This means that packets are just relayed somewhere else and do not receive any advanced protection. Multi-Hop VPNs just relay your packets via one more server, but the problem remains: The packets do not receive any extra protection. Every server in that Multi-Hop chain can see all your traffic. Yes, the last server cannot see your IP address, but the previous servers can see all your traffic unencrypted and could potentially log your traffic. Additionally, if the VPN client authenticates with the last server in the chain, it may also have your VPN login data.
Instead of just doing some tricks with packet routing, the SPN protects your traffic and identity with proper cryptography. Every packet is end-to-end encrypted to every single server along the chain of servers the connection uses. This was originally invented for Tor and is called [Onion Routing](https://en.wikipedia.org/wiki/Onion_routing). This way, every server in the chain only knows the previous and the next hop. No server ever knows who you are _and_ where you are going to.
![Illustration showing the SPN connecting via multiple exit nodes](https://safing.io/assets/img/spn/spn-community-web.png)
But the SPN goes even one step further. Instead of using your username and password - which makes you identifiable - to log into the SPN, Portmaster authenticates itself not against the network itself, but against the SPN Account Service, which verifies you are allowed to access the network. It then give you special cryptographically blinded tokens, which prove your access permission, but are not linked to your account anymore.
But the SPN goes even one step further. Instead of using your username and password - which makes you identifiable - to log into the SPN, Portmaster authenticates itself not against the network itself, but against the SPN Account Service, which verifies you are allowed to access the network. It then gives you special cryptographically blinded tokens, which prove your access permission, but are not linked to your account anymore.
*__This way, no server in the SPN will ever know your username.__*
This way, no server in the SPN will ever know your username.
### Node Ownership and Logging
As VPNs are centralized, all their servers are operated by only one entity - the VPN provider itself. They can, therefore, monitor all you traffic and see what you are up to. This is why they tout their "No Logging" policies so loudly, because they know they can see everything.
As VPNs are centralized, all their servers are operated by one entity. Because traffic passes through their servers, logging policies are an important trust factor when evaluating a VPN provider.
SPN on the other hand invites the community to join the network and strengthen it by adding diversity to the operators of the network. This way - in addition to the cryptographic protections - it is made almost impossible that anyone will ever be able to track you through the SPN. Also, because of the cryptographic identity protection mentioned before, there are not even any logs with identifiable data to begin with!
SPN invites the community to join the network and strengthen it by adding diversity to the operators of the network. In addition to the cryptographic protections, this makes it very difficult for anyone to track you through the SPN. Because of the cryptographic identity protection mentioned before, there are no logs with identifiable data to begin with.
### SPN Does Not Need A Kill Switch
VPNs came up with the idea of kill switches, because they need to change the "default route", which is more or less what tells your device where to send all its traffic to.
If you install a VPN, it will add a "virtual network" to your device and will update the default route to point to that network. If your device sends network packets to that virtual network, they will be encrypted and sent to your VPN provider, who will then release these packets to the Internet to do their thing. So far so good.
But when (not if) the connection to your VPN provider breaks - for whatever reason - your operating system will disable the virtual network and automatically change the default route to point to your ISP. This happens in a blink of an eye - your VPN software will not even notice.
But when the connection to your VPN provider breaks - for whatever reason - your operating system will disable the virtual network and automatically change the default route to point to your ISP. This happens in a blink of an eye - your VPN software will not even notice.
SPN easily solves this since it is part of Portmaster, which tightly controls all the network connections of your device. It always knows what is going on and stops any leaks in its tracks.
@ -147,13 +143,13 @@ SPN easily solves this since it is part of Portmaster, which tightly controls al
For a truly private experience, it is not only important to protect connections, but also your identity when signing up and making a payment.
While there are VPN providers that offer very good options in this area, many of them require payment methods that identify you to 100%.
Payment options vary across VPN providers.
When you sign up for the SPN, you can just go with the pre-filled random generated username and choose a password. You need to fill out a country with a matching phone prefix for tax and legal reasons - just to make everything legal and well on our side. While we cannot verify what you fill in these fields - we do not look at your IP address - we trust that our users are well-meaning and trustworthy.
Payments can be done using Bitcoin, Ethereum and Monero as well as sending us cash (Euros) in a letter.
Payments can be done using Bitcoin and Monero, or by sending cash (Euros).
If you do not need to protect your privacy in that regard, we offer credit card payments and PayPal for your convenience.
### Conclusion
VPN is an out-dated technology that was never intended to protect your privacy. It simply swaps your one identity with one different identity, creating only a minor obstacle for today's mass surveillance. SPN on the other hand is built from the ground up and fully designed to protect your privacy. It gives you multiple identities by default, for each app you use. Therefore we believe people looking for privacy will prefer SPN.
SPN and VPNs both conceal your IP address by routing traffic through servers. SPN goes further: each connection travels a separate path through the network with layered encryption, providing a different IP per connection across all applications. Users whose threat model requires this level of per-connection isolation may find SPN better suited to their needs.