What a VPN Can't Do After the Tunnel Delivers You
- The Tunnel Can't Make You Anonymous
- Phishing Happens at the Far End
- Put Phishing Resistance on the Login
- Encryption Can't Disinfect a File
- Weak Accounts Stay Weak
- Cookies Don't Care Which Server You Chose
- A Privacy Book Goes Beyond the Tunnel
- Data You Submit Arrives on Purpose
- A Different IP Can't Guarantee Access
- The Tunnel Doesn't Rewrite the Law
- A VPN Can't Recover the Only Copy
- Give Every Risk Its Own Control
A fake bank page doesn't become real when you turn on a VPN. The tunnel can carry your stolen password with excellent encryption. It changes the route. It doesn't judge the destination, clean the file, strengthen the account, or stop you from handing data to the wrong person.
That's not an argument against VPNs. It's an argument for giving the tunnel the job it can actually do.
Use a VPN to protect covered traffic on the way to its server and replace the public IP destinations see. Use something else for risks that live inside a page, account, file, browser, device, law, or decision.
The Tunnel Can't Make You Anonymous
Connect to a VPN and open a website without signing in. Your ISP sees the VPN-server connection. The provider handles the next hop. The site sees the VPN IP plus browser traits, cookies, and anything the page can collect.
Now sign into your usual account.
The ISP still sees the tunnel. The VPN provider still handles the next hop. The site still sees the VPN IP—and now it knows exactly which account made the request.
Changing one network address can reduce a useful tracking clue. It can't separate activity performed under the same username, cookie, advertising identifier, phone number, payment method, or device profile.
The VPN provider may also know account or connection information. Strong anonymity means separating identities and reducing what every observer receives, not adding one server and hoping the rest disappears.
Phishing Happens at the Far End
Phishing works by convincing you to trust a message, page, person, or prompt. The VPN can't tell whether the login form belongs to your bank or a convincing copy.
Use a saved bookmark for important accounts. Check the domain before entering credentials. Let a password manager refuse to fill a lookalike site. Treat an unexpected request for a code, recovery phrase, payment, or urgent download as the attack it may be.
A VPN may encrypt the connection to the fake page. That protects the thief's delivery route, not you.
Put Phishing Resistance on the Login
Multifactor authentication adds another check when a password is stolen. Stronger, phishing-resistant methods bind the sign-in to the legitimate service rather than asking you to copy a reusable code into any page that requests it.
CISA's current MFA guidance recommends phishing-resistant methods where they're available.
- Connects through USB-C or NFC, covering many newer computers and compatible phones
- Adds a phishing-resistant physical check to passkeys and supported multi-factor logins
- Works without a battery, code display, or wireless pairing process
YubiKey 5C NFC supports compatible FIDO sign-ins over USB-C or NFC. Confirm support on each account, register recovery options, and keep a spare safely before treating one key as essential infrastructure.
The division of labor is clean: the VPN changes the route to the login service; the security key helps the service reject an impostor page.
Encryption Can't Disinfect a File
A malicious attachment, fake installer, or hostile script can travel through the tunnel like any legitimate download. Encryption prevents an observer on the first hop from casually reading it. It doesn't remove the payload.
Keep the operating system, browser, and apps updated. Download software from official sources. Use reputable device security where appropriate. Don't weaken warning screens because a VPN icon is green.
If malware already controls the device, rerouting its traffic won't evict it. The compromised system can record what you type before encryption or read what arrives after decryption.
The safer response is isolation, investigation, cleanup, and credential changes from a known-clean device—not a different server city.
Weak Accounts Stay Weak
A reused password can fall to credential stuffing when attackers try credentials leaked by another service. A missing second factor, insecure recovery email, or stolen session cookie can expose the account without anyone learning your home IP.
Use a unique password for every important account. Protect the email account that controls password resets. Review active sessions and revoke devices you don't recognize.
A VPN can hide the ordinary IP from the account provider. It can't stop somebody who already holds a valid session token from arriving through their own connection.
Cookies Don't Care Which Server You Chose
Browsers store cookies and return them to the sites that created them. Change from a home IP to a VPN IP and the same cookie can calmly identify the returning browser.
Logins are even clearer. Email, social networks, shopping, streaming, and cloud storage can attach activity to the profile because you told them which profile it was.
Browser fingerprints combine signals such as screen size, language, time zone, fonts, graphics behavior, and other capabilities. A VPN changes the public IP, not that entire bundle. Extreme customization can even make a browser easier to distinguish.
Use browser isolation, privacy settings, permission controls, and separate profiles when the risk calls for them. Some VPN apps block known tracking domains, but that's an additional filtering feature with incomplete lists—not a property of the tunnel.
A Privacy Book Goes Beyond the Tunnel
Network routing is one layer of privacy. Accounts, phones, records, purchases, location histories, and data brokers live outside it.
- Connects everyday data collection to real choices about freedom, power, and control
- Explains why privacy matters even when you have nothing to hide
- Turns a broad social issue into practical questions you can apply to your digital life
Privacy Is Power connects those wider collection systems to practical choices about control. It's useful here because the information you volunteer can matter more than the IP address you withheld.
Data You Submit Arrives on Purpose
Type a name, address, phone number, photo, medical detail, or card number into a form and the destination receives it. The VPN protects the route to its server; HTTPS protects the secure web connection; neither controls the company's later storage, use, sale, sharing, or breach response.
Ask whether the field is required. Provide only what the task needs. Use account controls, privacy rights, retention settings, and deletion requests to address data already held by a company.
The observer comparison doesn't change: the ISP sees less of the route, the VPN provider takes the middle, and the service receives the form because you sent it there.
A Different IP Can't Guarantee Access
A server in another country can change the IP-based location a website sees. It can't move the device, rewrite GPS, alter the account region, supply a subscription, or override a platform's terms.
Streaming services, banks, games, shops, and forums can block known VPN addresses or demand additional verification. A server that works today may fail after the service changes its checks.
Treat access as a test result. Don't buy a long subscription on the assumption that one site, country, or shared address will work forever.
The Tunnel Doesn't Rewrite the Law
Using a VPN doesn't change laws covering fraud, harassment, copyright, unauthorized access, or other conduct. Providers can receive legal demands, and accounts, devices, endpoints, payments, records, or mistakes can identify activity.
Rules governing VPN use also vary by country and can change. Check current local requirements when the consequences matter. A blog post about another jurisdiction isn't legal advice for yours.
Technical possibility, service permission, and legal permission are three separate questions. A new route answers only the first.
A VPN Can't Recover the Only Copy
Ransomware, device failure, deletion, theft, and fire can destroy data without touching the network route. A VPN doesn't create a backup or prove that a saved copy can be restored.
Keep tested backups with appropriate separation from the device. Encrypt sensitive portable storage and protect the recovery credentials somewhere else. Open a sample restore before an emergency turns the backup label into a guess.
- Uses 256-bit hardware encryption to protect the 16GB drive independently of cloud storage
- Supports password or passphrase access plus safeguards against repeated guessing and altered USB firmware
- Offers read-only settings when you want to open files without allowing changes to the drive
IronKey Vault Privacy 50 provides hardware-encrypted portable storage for a small set of sensitive files. It can be one backup component, not the only copy. A USB drive sitting beside the laptop shares the same theft, fire, and loss event.
Give Every Risk Its Own Control
Use the VPN for an untrusted local network, ISP visibility into covered destinations, a different public IP, or authorized access to a private network.
Use phishing-resistant authentication for account theft. Use updates and security tools for malicious code. Use browser and permission controls for tracking. Use tested, separated backups for data loss. Use careful disclosure for forms and profiles.
Return to the fake bank page. The VPN did its networking job perfectly and still couldn't save the password, because the mistake happened after the tunnel delivered you to the destination.
That boundary is the lesson. A VPN can be valuable without being magical. Keep it on the route—and put the rest of your defenses where the risk actually lives.