Privacy and Security Concerns With Norton

Introduction

Our latest research on VPN usage has found that 40-percent of VPN users opt to use VPNs for general privacy. That’s because a VPN can hide your browsing activity through encryption. But the truth is that to do that, your VPN provider will have exclusive access to your traffic. If the company wants to, it can collect your data and sell it for its own profit.

Of course, none of our top-pick VPN providers do that. But how about Norton? Can you trust it?

A Jurisdictional Issue

Unfortunately, Norton is a US-based company, which puts them under a jurisdiction notorious for gathering data from its citizens. The United States is a global leader in Five Eyes, Nine Eyes, and 14 Eyes, international cooperatives of countries committed to sharing intelligence. On its face, this is a red flag for us since it indicates that the company may be forced to hand over user data at some point.

To Norton’s credit, however, they do provide a transparent look at how they handle data, which gave us a bit of reassurance. Norton doesn’t log where we visit on the Internet, so even if they were forced to hand over data, there wouldn’t be much for governmental agencies to go on.

The data Norton does collect is relatively benign, and generally standard for the industry, though there were a couple of points that gave us pause. On their website they offer a detailed look at how they handle data, with subsections for each of their products, VPN included. This transparency is a nice way for the company to assuage some of our reservations about their jurisdictional shortcomings.

Now, there are two types of data VPN providers typically collect. One is personal data you provide when accessing the Norton website and creating an account, and the other is usage data, which refers to any information collected by the service when you connect to the VPN.

Although Norton collects data like your IP address and geolocation when you visit its website, it doesn’t collect those kinds of information when you use the VPN itself. Norton Secure is a “no-logs” VPN, which means it doesn’t collect any data that can identify you when using the VPN. That means your usage data is private, even from Norton.

When it comes to your personal data, however, Norton claims that subscriber information could be provided to third parties such as “government-related auditors” and “services providers” which feels open-ended and a little suspect, but the fact that the company doesn’t log user data or have agreements to sell data to third-party advertisers is enough to keep them above board in our eyes.

Server Count and Location

The number of servers and the spread of those servers across countries creates the conditions for a VPN to be successful. When we’re evaluating VPNs, we tend to favor those with the largest footprints, because it typically means that there are multiple servers in our general region which can help increase speeds as we’re surfing the web. For a good example, check out our NordVPN review, which features more than 6,300 servers in more than 111 countries – and it’s still growing.

Unfortunately, Norton Secure VPN doesn’t compare to that. It has 1,500 servers that offer locations in 29 countries. That’s only about a quarter of NordVPN’s server network, both in terms of the number of servers and locations.

Moreover, we learned that up to 1,200 of Norton’s servers are virtual servers. Unlike physical servers that provide IP addresses pointing to where the server is physically located, virtual servers only mimic the presence of physical servers. For example, with a physical server, if the data center is located in the United States, the VPN IP addresses it will provide will be U.S. IP addresses. With a virtual server, even if the server is physically located in New York, it’s possible to set it up in a way that it provides IP addresses from Canada. Virtual servers give VPN companies a cost-effective way to increase their footprint.

We’re not totally against virtual servers. Even NordVPN uses virtual servers, which is how it was able to jump from having 60 locations to 111. However, when a VPN’s almost entire network is made up of virtual servers, it makes us question the legitimacy of its network size. Does it really have the physical ability to provide access through 1,500 servers, or is that an illusion created by its virtual network? We don’t jump to conclusions, but let’s just say our speed with Norton was less than optimal.

Quick Facts:
– Norton—like many VPNs—doesn’t work and doesn’t offer server locations in China due to the country’s aggressive censorship and Internet monitoring policies.

Norton Secure VPN’s Encryption and Security

One of the major selling points that Norton highlights about their VPN is “bank-grade encryption”. The VPN features an AES-256 encryption which is what we’ve come to expect from VPNs, and the industry standard. While we’re happy to see Norton come through on encryption, there were some security vulnerabilities that gave us pause, however.

1. No Kill Switch: VPNs aren’t perfect, which means there may be times when they would disconnect abruptly in the middle of a browsing session. No one wants that, as losing your VPN connection means getting your online data exposed to your ISP. The solution? A kill switch. If you lose VPN connection, your device’s internet connection pauses until you reconnect the VPN. It’s a crucial feature, but unfortunately, only the Android and Windows apps offer a kill switch.

2. Multi-hop: On the plus side, Norton Secure now offers limited multi-hop technology. With multi-hop, your connection is routed through not one but multiple servers. If using a VPN makes it hard to track you, using multi-hop makes it even harder. Access, however, depends on which routers you’re trying to use and how far away you are from them.

3. Dynamic IP Addresses: Another point in Norton Secure’s favor is its use of dynamic IP addresses. Unlike static addresses, dynamic addresses change every time you log on, making it harder for anyone to track your online behaviors.

Note: While there is no kill switch for Windows PCs, Macs, or iPhones, Norton Secure VPN’s Android app does include the feature.

In conclusion, while Norton Secure VPN may have some privacy and security concerns due to its US jurisdiction and limited server network, it does offer a transparent look at how it handles data and implements industry-standard encryption. It may not be the top choice for users seeking a VPN for general privacy, but it can still provide a level of security for everyday browsing.