Is Hotspot Shield Safe to Use?

There are two main ways through which you can determine if a VPN is safe to use. The first is encryption, i.e. how secure your connection is to the VPN. The second measure is how the VPN provider treats your data; this can be determined through an analysis of the provider’s privacy policy. This guide will review Hotspot Shield’s security and privacy policy to determine if it is safe to use or not.

Security

Hotspot shield supports the use of top-of-the-line 256-bit AES encryption; however, it also supports the weaker 128-bit AES encryption as well.

Tip: While 128-bit AES is technically weaker than the 256-bit variant, 128-bit encryption is still considered more than sufficiently secure and is perfectly safe to use. The 128 or 256 number refers to the total number of possible keys. A 128-bit encryption key could be any one of 2^128 values. This number of possible values is considered infeasible to guess even with the dedicated use of super-computers for centuries.

The proprietary “Catapult Hydra” VPN protocol that powers Hotspot Shield has not been as thoroughly analysed for weaknesses and vulnerabilities as the standard protocol, “OpenVPN”. This means that there could be security issues that haven’t been identified yet.

Privacy

The privacy policy, unfortunately, is where things look a little worse. Throughout Hotspot Shield’s marketing information, they claim that they don’t log your browsing activity. However, the privacy policy repeatedly states that Hotspot Shield does “not log or record online activities that you conduct over a VPN connection in any way that can be tied back to you”. The phrasing of this is highly ambiguous.

While the privacy policy claims that they do not have any data to share with law enforcement agencies and their marketing information suggests that they don’t log any details. The privacy policy could be interpreted in such a way that your identity is logged, as is your usage data, but they’re just not logged in such a way that the two can be linked together. Just because your browsing data can’t be linked to you doesn’t mean that it can’t be included in aggregate analytics.

Additionally, the ad-supported free VPN client includes Google ads that provide your device’s “mobile advertising identifier”, IP address, and device information for the purpose of Google serving you more personalised ads. These identifying details could be used to tie your non-VPN browsing profile to your VPN browsing profile, allowing highly targeted ads and fundamentally breaking the tracker beating purpose of the VPN.

Tip: A “mobile advertising identifier” is a unique id that is tied to your mobile phone and is used to identify you to advertising agencies. Its purpose is to help tie your activity to you, so that a more accurate advertising profile of you can be built.

Conclusions

Hotspot Shield’s encryption is definitely good enough, although there is likely minimal reason to support AES-128. The Catapult Hydra VPN protocol lacks OpenVPN’s long history of community and expert analysis, meaning it could contain vulnerabilities that haven’t been identified yet. In general, however, the security of your VPN connection is good.

Hotspot Shield’s privacy policy is inconsistent and ambiguous, in a way that could allow them to log, sell, and perform aggregate analysis of everyone’s usage data. Furthermore, the free VPN client includes ads that can provide identifying details to advertisers that could be used to tie together your VPN and non-VPN browsing data profiles.

Realistically, if you’re just wanting to use a VPN because it’s fast and secure when you’re out and about and aren’t concerned with the privacy implications of the data you’re providing. Then Hotspot Shield is safe enough to use. However, if you are concerned about your privacy and how your data is used, you may want to give this provider a miss and use an alternative that actually won’t log your browsing usage.