As you have probably already read in the news, it has come to light that back in March 2018 one of NordVPN’s servers was compromised. This allowed hackers to see which websites users were visiting.
NordVPN has known about this for months but says – in a blog post – that it chose not to disclose the breach to the media or its users until it had finished conducting an audit of its other 5000 servers.
Whether you’re a NordVPN subscriber, considering subscribing or a user of another consumer VPN server, you’re undoubtedly wondering what it all means and, above all, if the service is safe to use.
How and why was NordVPN hacked?
The reason why the server (which was located in Finland) was compromised was because it was owned and operated by a third party, not by NordVPN. Unfortunately, renting servers in this way is common practice for consumer VPNs which effectively use the same cloud technology as other services.
The datacentre which ran the server installed some remote access software on it without informing NordVPN, and this software had a vulnerability which was exploited in March 2018 by a hacker.
Tech Advisor was sent a copy of an email from this datacentre, which explained that the software was installed on all their servers and was well known to have security holes. It claimed that other VPN providers also used its servers and paid more attention to security, asking the datacentre to block access to the tool until they need it. It went on to say “NordVPN seems do not pay more attention to security by themselves and somehow try to put this on our shoulders”.
At the time of the attack, NordVPN was not encrypting the hard disks in its rented servers, so the hacker was able to steal encryption keys. These have since expired and NordVPN says the keys could not have been used to decrypt NordVPN traffic in any case.
Nord’s blog post includes a full apology for “an egregious mistake” and admits that the company “should have done more to filter out unreliable server providers and ensure the security of our customers”.
It also said that the breach was an isolated incident and none of its 5000 other servers were compromised.
Netflix actively blocks NordVPN
The following may be shocking to you but it is completely true. Despite NordVPN and other VPN services claiming that they support Netflix, the claim cannot be supported by the guys at Netflix themselves. In fact, Netflix actually actively block NordVPN on a daily basis, and employs tools and personnel to block and prevent users from accessing videos via NordVPN.
If you are a Netflix user using NordVPN + Netflix, you may be running a risk of getting your account suspended or banned permanently.
If you experience sudden disruption to service or temporary ban in your account, it means that Netflix has detected use of NordVPN. NordVPN does not currently offer certain server technologies that are needed to avoid detection from Netflix.
NordVPN servers have overloaded traffic
The issue in Reason #1 means that NordVPN are consistently restarting servers and creating new servers in a response the servers that have been detected and blocked. In other words, NordVPN and Netflix are at a constant tug-of-war on a daily basis.
The result of this is a bad experience for all NordVPN users, who may mass migrate to another server when the one they are using starts slowing down or stop working completely.
NordVPN + Netflix users would also try every NordVPN server until they find one that works. The end result is a overloaded server due to migration every time a server stops working.
Torrenting Only Supported On Some Servers
At first, Torrenting was a bit of an enigma with NordVPN. Then I recalled that not all their servers supported peer-to-peer file sharing. The settings for this were found under “Auto-connect at startup” where you can choose to have a selection made automatically or choose a specific type of server to connect to.
For NordVPN, these are categorized into Dedicated, DoubleVPN, Onion Over VPN or P2P. While not exactly user friendly, I find that this allows a much greater flexibility in control.
While I’m happy that NordVPN does support torrenting, it can be quite disappointing to be limited to only certain servers if you’re a torrenting fan. I also noticed that Torrent speeds were not really as good as I was expecting, based on the speed tests I conducted.
Abysmal Speeds In Malaysia
I had to add this part in as a con as well since I was shocked at how badly NordVPN’s Malaysia server performed in speed tests. Just to be clear, I tried the Malaysian server across three different days and multiple times a day – the speeds NordVPN connects to here are simply awful. I consistently encountered appalling 3 to 11Mpbs speeds, which are simply unacceptable.
Slow App And Server Connections
If you’re using a client app such as the one NordVPN has for Windows, there’s one thing you’ll have to take note of which is that it takes awhile to hook up to a server. I ran a stopwatch on the Windows client (I’m running Windows 10 on a solid-state drive) and it takes on average 14-30 seconds to establish a connection. This is not including the time the client takes to load.
Now to some people, this might not seem like a lot. But if you’re like me and used to SSD-speed loading times then you might understand. Or think of it this way if you’re on a standard hard drive – that 14-30 seconds is how much longer your computer will take to fully boot up as compared to what you’re facing now.
I think the only exception to all of this is if you’re going to be running NordVPN off your router, in which case it will be ‘always on’.
OpenVPN Configuration Isn’t User-Friendly
If you prefer to use OpenVPN rather than L2TP or some other protocol, you might be in for a little shock. First, you’ll need to download a ZIP file of NordVPN’s servers, which contains the configuration file for each of their servers. Each server has two configurations – one for TCP and one for UDP.
That means inside that ZIP archive is over 8,000 configuration files (9,341 at last count, to be exact) with names like al1.nordvpn.com.tcp443 or za12.nordvpn.com.tcp443. As to WHERE each configuration file server is, you must find that out by trial and error.
Seriously, this is one of the most ridiculous methods that NordVPN could have thought of to distribute OpenVPN configurations and is a massive pain in the neck.
