What Is a VPN?
Using your Android phone or tablet on the free coffee shop Wi-Fi can be far more dangerous than you might think. First, you can't tell if the network has been configured incorrectly, allowing others on the network to see your data. Second, it's entirely possible that nefarious parties have simply set up an innocent-looking wireless network specifically to trick naive coffee drinkers. Fraudulent networks can be very difficult to tell from the real thing. Those are just some of the reasons why you need a VPN.
In both of the scenarios above, someone could monitor your network traffic. Everything you send, from emails to passwords, would be open to them. That's a lot of private information you'd probably rather keep private. One example of a classic man-in-the-middle attack is to use a bogus network to intercept victims' web traffic and replace legitimate sites with fake ones. When a victim goes to enter their information (everything from passwords to credit card numbers) on the site, the attacker gets it all.
VPNs are still a good investment even when you know the network is safe. Recent legal changes allow ISPs to sell anonymized user metadata to advertisers and other third-parties. Lots of other companies, like Facebook and Google, have benefited from access to user data, and ISPs have successfully argued that they should also get a piece of the tasty data pie. But, to my mind, it's a trickier issue because you can conceivably opt out of using Facebook but accessing the internet without an ISP is all but impossible.
Speaking of advertisers, they use advanced trackers that correlate your movements between websites. By placing trackers on a variety of sites and watching for requests from the same IP address, advertisers can get a sense of your habits. This is still true when you browse the web on your Android. What's more, many mobile apps still transmit data without encryption, letting various three-letter organizations keep an eye on you.
You might not think anyone would be interested in your data, but it's not always individuals that are targeted for surveillance or attack. While attending the Black Hat security conference, I saw some 35,000 devices connecting to a malicious Wi-Fi network, all without the knowledge of their owners. The malicious network was configured to mimic whatever Wi-Fi request was made of it. You can bet that many of those devices were mobile phones merely seeking a familiar Wi-Fi network.
When you connect through a VPN service, you interact differently with the internet. Your data is sent through an encrypted tunnel to a VPN server, either nearby or in a far-flung location. Anyone monitoring your network connection only sees the gibberish of an encrypted connection. Because your traffic exits onto the open web from the VPN server, advertisers and spies see the IP address of the VPN server and not your device. It's a smart and simple way to keep your information and identity secure.
What a VPN Isn't
As important as it is to understand what a VPN is, it's also important to know what it isn't. It isn't a true anonymization service, and you can't use it to connect to hidden websites on the Dark Web. For both of those activities, you'll want to use the Tor anonymization network. There are Tor client Android apps in Google Play, so you'll have no trouble connecting, no matter where you are.
While some VPN services claim to protect you against malware and phishing sites, standalone antivirus utilities definitely do a better job. Some VPN services also block ads—an especially useful feature on Android, where ad blockers are a rarity.
When you're connected to the VPN, your data is, indeed, encrypted. But that's not the case once it leaves the VPN server. If your browser or app doesn't secure your information, then it will be entirely readable to someone with the will and the means to try. Manually encrypting your files is one way to ensure that they aren't read. There are also apps, like Signal, that send encrypted text messages, keeping each message secure even if part of the journey to its intended recipient is unsecure.
VPNs Can Fool Dictators, Netflix
A common use of VPNs is location spoofing. By sending your web traffic through an encrypted tunnel to a remote server, you cause it to appear to originate from the VPN server and not your actual location. Journalists and activists have used this to get around restrictive internet controls imposed by various governments.
But for most people, this feature will probably be used to watch region-locked streaming content. If you live in the US and want to watch the free video streams from the BBC, you're out of luck. But with a VPN, you can fool the BBC website into believing you're a noble UK citizen. The same is true for sporting events, such as official MLB streams.
That said, companies and content providers are starting to get wise. Netflix in particular has begun blocking VPN connections. I've noticed that Hulu, too, frequently blocks access when I'm using a VPN. Note that streaming companies are well within their rights to block VPN users. Just because you're paying to watch Netflix in the US doesn't mean you are allowed to view UK Netflix.
There are some VPNs that work with Netflix. But in my experience, their effectiveness can change on a day-to-day basis as the streaming companies and VPN services play a cat-and-mouse game of spoofing and blocking.
There's also been much talk about whether a VPN can save net neutrality. The idea is that, if you tunnel past your ISP, it won't be able to throttle your connection or charge you to access specific online services. That makes sense on paper, but it will all depend on what the ISPs decide to do. They could simply throttle all VPN traffic, for example. To me, the issue of net neutrality is one that should be decided on by Congress and not left up to individuals to solve, ad hoc.
Android VPNs and Performance
It's not surprising that rerouting your connection to other, perhaps distant, servers can have a negative impact on your web browsing speed. Usually, a VPN greatly increases your latency, and reduces the speed of download and uploads. How annoying the impact is will depend on the location of the VPN servers and the network infrastructure the VPN provider can access, among other things.
Very rarely, a VPN service may actually improve your web browsing. Generally, that's because the VPN provider has access to higher bandwidth internet in other countries. But it is, as I've said, a rare thing.
Note that most VPNs can also protect you when you're connected to cellular networks as well. This might seem like overkill, but there are exotic attacks to intercept cellphone data. One such attack involves jamming the LTE and 3G bands, forcing nearby phones to attempt to connect via a 2G connection, the encryption of which has long been broken. The attackers use a portable cell tower, similar to a Femtocell, and trick nearby phones into connecting.
In my testing, I don't look at VPN performance over cellular connections. That's because I can't control how or when the phone connects with cell towers. By restricting my testing to Wi-Fi, I can control more variables and emulate the circumstances most people will probably experience.
The biggest hurdle to using a VPN on a mobile device is maintaining a connection. Annecdotally, I've found that it takes longer to establish connections when a VPN is engaged, and that dropped connections are more common with VPN than without. That's just my impression, however, and I know that VPN companies are working to ensure that their products don't intrude too much on your daily usage. I definitely recommend taking advantage of free trials with VPN services, so you can get a sense of how the product will work in your life firsthand.
What Makes a Good Android VPN?
Although Android phones and tablets are radically different in form factor than desktops and laptops, what I look for in a VPN remains the same.
The question I am asked the most is "which is the fastest VPN?" But I've found that speed is far from the most important metric when measuring value in a VPN plan. The number and distribution of available VPN servers provided by the company is far more important than speed. Lots of servers in lots of places means that you'll have an easier time finding a nearby server while traveling. When you're in a foreign country and you're desperate to get information (directions or translation, perhaps), you probably won't be worried about whether or not the Wi-Fi connection you've found is secure. VPNs give you some assurance in these situations.
The location of the VPN company is also important. Depending on where the company has its corporate headquarters, local laws may require the company to retain user data. That's not a good thing, especially if maintaining your privacy is your primary concern. Reading the company's terms of service is a great way to figure out the logging and data retention policies. Nearby servers are good, since they generally provide better speed and performance. A surfeit of servers also means that you'll have many options when spoofing your location, should you desire it.
You're also likely to find the VPN service's statement about P2P file sharing and BitTorrent in its terms of service. Most VPN services don't allow BitTorrent, since it's a drain on resources and opens a legal can of worms. A few services allow file sharing on specific servers, and even fewer will allow them on any server. While I seriously doubt many people will be using their Android phones for Torrenting, be sure to respect the rules for your chosen VPN service. Breaking them can sometimes mean being banned without a refund.
Finally, price and licenses are a very important factor to consider. VPN services range from free to incredibly expensive, and you'll want to make sure you can connect all your devices to the VPN service. In my experience, the average price of a VPN is a little under $11 per month. If you're looking at a service that falls outside this range, be sure that it's offering something unique to make up for it.
Most companies allow five or six devices to connect at a time. You'll want to make sure you have enough licenses to cover all your mobile devices and computers, too. Most VPN services have a pretty consistent design across platforms, but it's an unfortunately rare thing for developers to create a VPN for macOS that actually blends in. I highly recommend trying several VPN services on all your machines and finding the ones that work best for your particular mix of devices.