NordVPN Review: Is It Worth It?

NordVPN: Security and Encryption

NordVPN has many strong security features, below you can see some of those features.

1. Double VPN

Double VPN is an advanced VPN security feature that routes your traffic through two VPN servers instead of one, encrypting your data twice.

With Double VPN, your online activity hides behind two servers instead of one, which is known as VPN server chaining.

All your data is protected with an extra layer of encryption. This makes it twice as hard for criminals to decipher.

The connections are mixed between UDP and TCP protocols, which increases the security level of your online activities.

As your actual IP address was changed by the first VPN server, the second server doesn’t have any information about you.

Nobody, not even your ISP can see your final destination on the web. They can only know that you are using a VPN service.

2. DNS Leak Test

The Domain Name System (DNS) is the reason why browsing the internet is so quick and simple. Its job is to resolve domain names such as “rushradar.com” into actual IP addresses. In other words, it translates the long, complex numeric names of web servers into human language, and the other way around.

This is how it works: Whenever you want to visit our website, you type “rushradar.com” into your browser. Your computer or smartphone sends a query to a DNS server: it contacts the server and asks for the unique IP address of our site. Only after the DNS server provides the IP address, your device can finally connect to the website you want.

When you connect to a VPN, all your online traffic is supposed to be routed through the VPN network. That includes the DNS queries we mentioned before. They should go through the encrypted tunnel straight to your VPN provider’s DNS servers.

But that’s not always the case. A DNS leak is a security flaw that allows your queries to travel to the default DNS servers, which belong to your internet service provider (ISP).

If any of your online traffic goes out through the regular, unencrypted route, third parties may intercept it. That includes your ISP or DNS provider, who would be able to see the websites you visit, the services you use, and more.

On top of that, you won’t even know about it, unless you take a special DNS test for leaks, like the one provided by NordVPN. You could call it a VPN security test because if a service won’t fully reroute all your traffic, it’s not as secure as it should be. That’s why it’s imperative to choose a VPN with DNS leak protection.

When you connect to NordVPN, your device only uses DNS servers operated by NordVPN. All your DNS queries travel over the encrypted tunnel and are resolved on the same VPN server you are connected to.

This way, you never have to worry about your confidential information leaking and third-parties spying on it.

3. Onion Over VPN

The Onion Router (Tor) is a specialized browser that sends your data through a chain of servers to hide your identity.

So instead of taking a direct route, your internet data enters the Onion network via a random relay anywhere around the globe. Then it makes at least one additional hop and, finally, goes through a random exit node to its final destination on the web.

When your internet traffic enters the Onion network, it goes through layers of encryption at every point of connection, making it difficult to identify where the traffic comes from. The entry node sees your real IP address, but not the final destination on the web. The exit node sees the final destination, but not your IP address.

However, when you use NordVPN, even the entry node cannot see your IP address. So even if someone is observing vast portions of the Onion network, they won’t be able to discern your real identity.

In the Onion network, you send your traffic through a network of volunteer-operated servers.

Without NordVPN, your internet service provider will know you use the Onion network to access the internet. This can be especially risky for political and human rights activists, journalists, and bloggers, who work and live in censorship-heavy countries.

Onion servers are volunteer-operated – anyone can set up and run one. That means authorities or bad actors could deploy thousands of compromised servers to track you online. Furthermore, no single node sees the full picture, yet someone watching multiple servers – especially entry and exit nodes – can discover your real IP address.

NordVPN encrypts your traffic and hides your real IP before connecting to the Onion network. NordVPN adheres to a strict no-logs policy, so everything you do online remains hidden from all parties, including from the NordVPN team.

NordVPN supports a number of security protocols to provide a VPN service. The security levels and purposes of these protocols are different, but so are each customer’s needs. Below you can take a closer look at the strengths and weaknesses of each protocol offered by NordVPN.

1. OpenVPN

OpenVPN is a mature and robust piece of open-source software that enables the provider to provide a reliable and secure VPN service. It is a versatile protocol that can be used on both TCP and UDP ports. OpenVPN supports a great number of strong encryption algorithms and ciphers: to ensure the protection of your data, NordVPN uses AES-256-GCM with a 4096-bit DH key. OpenVPN is recommended for the most security-conscious users.

2. IKEv2/IPsec

IKEv2/IPsec significantly increases the security and privacy of users by employing strong cryptographic algorithms and keys. NordVPN uses NGE (Next Generation Encryption) in IKEv2/IPsec. The ciphers used to generate Phase1 keys are AES-256-GCM for encryption, coupled with SHA2-384 to ensure integrity, and combined with PFS (Perfect Forward Secrecy) using 3072-bit Diffie-Hellman keys. IPsec then secures the tunnel between the client and server, using the strong AES-256. The protocol provides the user with peace-of-mind security, stability, and speed.

3. WireGuard (Recommended by NordVPN and used by default in most apps)

WireGuard is the newest and fastest tunneling protocol the entire VPN industry is talking about. It uses state-of-the-art cryptography that outshines the current leaders, OpenVPN and IPSec/IKEv2. However, it’s still considered experimental, so VPN providers need to look for new solutions (like NordLynx by NordVPN) to overcome WireGuard’s vulnerabilities.

Modern, extremely fast, and insanely lean in its architecture, WireGuard is backed by thorough academic research. WireGuard consists of only 4,000 lines of code, making it easy to deploy, audit, and find bugs. To put it into perspective, OpenVPN runs on 400,000 lines of code, meaning that WireGuard makes up only 1% of OpenVPN’s massive architecture. NordLynx is currently used by default in NordVPN apps.

Threat Protection

• Malware Blocking: Threat Protection prevents users from accidentally visiting malicious websites, and scans downloaded files for Malware, deleting dangerous ones before they can do any damage.
• Threat Protection runs deep scans on all executable files that are up to 20MB in size. It does not scan files that might contain personal information, such as PDFs or .DOCXs. Some files in flash drives can be scanned for Windows users, if they’re downloaded fromthe internet, for example.
• Trackers: Threat Protection blocks third-party trackers, which collect private information.
• Ads: Threat Protection blocks intrusive ads, such as pop-ups, which can not only be annoying, but dangerous too, as some can contain malware.
• Always protected: Once set up, Threat Protection is always on, regardless of whether the user has a VPN connection on.

NordVPN: Extra Features

• Kill Switch
• Connect 6 devices simultaneously
• CyberSec (ad/website blocker)
• DoubleVPN (Double encryption)
• SmartPlay (Securely access content that would otherwise be unavailable)
• Obfuscated Servers (“Hide” the fact that a person is using a VPN,
  which can otherwise be identified)
• P2P Servers (Optimized for fast and secure file sharing)
• SmartDNS
• Split Tunneling for Android and Windows devices
• Dark Web Monitor
• Threat Protection
• Meshnet