NordVPN review: Incredible service with a transparency problem

Credit: IDG

NordVPN in brief:

• P2P allowed: Yes. Dedicated servers
• Business location: Panama
• Number of servers: 5,500+
• Number of country locations: 57
• Cost: $84 (billed annually)
• VPN Protocol: OpenVPN (default)
• Data encryption: AES-256-GCM
• Data authentication: TLS 1.2 with 4096-bit DH
• Handshake encryption: SHA-512

If there’s one word that can describe NordVPN it has to be “impressive.” This VPN offers incredible speeds, a high country and server count, and an excellent selection of VPN protocols, including Wireguard. It’s also removing the hard drives from its servers to increase privacy and security. And in its aim to be more than just a VPN, its expanding its data-privacy options to include a password manager and secure file storage.

Note: This review is part of our best VPNs roundup. Go there for details about competing products and how we tested them.

When you first open NordVPN on Windows, you get a very user-friendly interface. The left-hand rail includes a list of all available countries in alphabetical order. This section also has quick links to NordVPN’s specialty servers, such as dedicated IP (for an extra cost), double-hop VPN, Onion over VPN, and P2P file-sharing servers. The rest of the app window contains a map that you can drag around to select a specific country.

IDG

Both the list and the map let you quickly decide where to connect. Two interface options are a bit redundant, but it makes space for both power users and novices.

The list in the left-hand rail is where most of the power user advantages reside. Hover over a country listing and click on the three dots to the left of the country name. This reveals a pop-up window where you can choose the region of a country (if applicable), as well as any of the servers listed in that region.

If you choose to connect to the U.S., for example, you’d pick the “region,” which is really one of a number of major cities such as New York, Los Angeles, Chicago, Denver, or Phoenix. Then you can pick any of the servers listed there, and each server in the list displays its current load. If you don’t want to drill down that deep, NordVPN picks the fastest connection in the country of your choice.

The first time you use NordVPN it asks if you want to turn on the CyberSec feature. CyberSec blocks ads and protects against malware and phishing. If you ever want to turn it off you can do so in Settings > General. This section also has an internet kill switch, and an app kill switch. The latter stops any app from connecting to the internet if an active VPN connection drops, while the former does that for the entire PC.

IDG

There are also options to go invisible on the local area network, and a specialized auto-connect feature. Auto-connect not only connects you to the VPN automatically but lets you customize that connection. You can, for example automatically connect to a double VPN or a specific country. You can also choose whether to connect whenever the app starts or only on “insecure” wireless. The ability to customize the automated connection is an awesome little power user feature that you don’t often see on other VPNs.

Finally, you can set your own DNS if you like, as well as use obfuscated servers if you’re trying to use NordVPN is a place that blocks it.

NordVPN advertises that it’s compatible with Netflix, but in our experience it was hit or miss this time around. It seems the long arm of Netflix enforcement has, at least temporarily, caught up with NordVPN. I asked the company about this and a representative said there can be temporary issues due to the eternal cat-and-mouse game between VPNs and Netflix.

Privacy, anonymity, and trust

IDG

To create an account, NordVPN requires an email address. It accepts payments via credit card, Amazon Pay, and cryptocurrencies. NordVPN costs $84 per year, or you can get two years for $120, or three for $125.64.

NordVPN is ostensibly based in Panama, and it appears there are a few employees who actually live there, according to LinkedIn listings. The rest of the team works remotely from various countries around the world.

NordVPN is owned by Tefincom S.A., which is a company based in Cyprus. Tefincom doesn’t have a website, and may be little more than a shell. Multiple reference websites, including a whois listing, name a Marios Papaloizou as a representative for Tefincom. I asked NordVPN to confirm if Papaloizou was a founder or owner of NordVPN. The company said Papaloizou is a former director for Tefincom but is neither a founder nor the owner of NordVPN.

The company also told us that the founders can easily be found on LinkedIn (a claim we disagree with), and “at the moment they prefer to avoid public attention.” The company also told us that transparency is a focus for NordVPN in 2020, and the situation with the founders will change in the coming months.

NordVPN’s privacy policy says it has a “strict no-logs policy,” meaning it does not store time stamps, session information, used bandwidth, traffic logs, IP addresses, and so on. A third-party audit in 2018 confirmed this, and NordVPN tells us another audit is planned for 2020.

NordVPN also plans to follow in the path of VPNs such as OVPN and ExpressVPN by running diskless production servers. Currently, NordVPN has about half of its network running this way. Diskless servers don’t store any information on them at all. They are controlled and booted from a remote server and everything then runs in RAM. That makes it mighty difficult to pull any user data from these servers. NordVPN says it plans to go diskless for its entire server infrastructure within three to four months.

IDG

Another step NordVPN took to increase trust is joining the VPN Trust Initiative, an effort that includes ExpressVPN, Golden Frog (of VyperVPN fame), SaferVPN, Surfshark, Strong VPN, and IP Vanish. The VPN Trust Initiative’s goal is to strengthen trust and mitigate risk for VPN users.

The company also recently published a blog post detailing how it plans to prevent vulnerabilities like the one that occurred in 2018 (it was only reported in 2019). The new plan includes penetration testing, a bug bounty program, the new infrastructure audit, vendor assessments, and the aforementioned diskless servers.

That’s a lot of effort to get users to trust NordVPN, but we’ll feel a lot better once the founders and management go public. Anonymity for the people running a company that is supposed to be all about trust just doesn’t sit well with us. Especially when the service has a poorly understood parent company based on the other side of the globe from NordVPN headquarters.

Performance

Wow, is all we have to say about NordVPN’s speeds. In our tests over multiple days, NordVPN was able to maintain 60.40 percent of the base non-VPN speed. That’s still a little bit shy of our current speed champ, HotSpot Shield. Nevertheless, NordVPN is fast enough that you can use its connections to do pretty much anything reliably.

Conclusion

So what do we do with a problem like NordVPN? It’s a fantastic service that keeps getting better. The price is on the high side, but you get a lot more for that money than with other services. Still, we can’t bring ourselves to trust it as much as we do Mullvad or OVPN given the secrecy behind it. Once this situation changes we will re-evaluate.

Nevertheless, NordVPN’s excellent service can’t be ignored. For that reason, we’re creating a new category and calling NordVPN “the best full-featured VPN.” If you want something that appeals to power users, has multi-hop, solid speeds, and hopefully works with Netflix, then NordVPN is a solid choice. If, however, you want to remain as anonymous as realistically possible with a VPN, we suggest you look elsewhere for the time being.

Editor’s note: Because online services are often iterative, gaining new features and performance improvements over time, this review is subject to change in order to accurately reflect the current state of the service. Any changes to text or our final review verdict will be noted at the top of this article.