[SerSwimsALot]

Great piece for showcasing the security and practical uses of a VPN, but I feel it's skimps on the best reason, which is privacy. Using a hosting provider with your VPN will allow the provider (eg Amazon) to see all traffic leaving your server. Even if you're using https, they can gather domain information. If you are the only one using the VPN, then all the traffic leaving the server is yours.

While I agree that third party VPN providers are not necessarily to be trusted, if they are deleting their logs as some claim they do, then no one knows which traffic is yours. Your privacy is protected from end to end only in this case.

[JorgeGT]

While this is true, I have the feel that third party VPN companies would be more interesting targets for intrusions, both from private and state-backed actors. Also, VPN-company traffic logs could be a tempting asset to sell or steal.

On the other hand, your lonely AWS instance is a drop in the sea of Amazon vast traffic. Amazon has plenty of other valuable assets and revenue streams that would be more interesting than traffic logs. Nor has Amazon a reason to analyze outbound traffic for each of their millions and millions of instances.

Of course, if someone is actually tracking you, identifies your instance and has the capability to collect and filter outbound AWS traffic leaving your instance, this approach is not valid.

Then again, if someone like this is tracking you, VPNs are probably the least of your worries...

[nickpsecurity]

"While this is true, I have the feel that third party VPN companies would be more interesting targets for intrusions, both from private and state-backed actors. Also, VPN-company traffic logs could be a tempting asset to sell or steal."

Exactly. They'll either be malicious themselves or have a pile of secrets in one place increasing the odds that those who come a hackin' have more skill and dedication than average. I also haven't seen evidence that they're great at securing systems on average. That could be a sampling error but lots of security suppliers aren't that secure. A well-vetted, open solution that can be deployed on user-controlled hardware or VM's is more trustworthy.