Tunnelbear. pdf#

And the only reason we know about this at all is that unlike many providers who have security audits, TunnelBear's report is available to read online (it's a PDF linked from this blog post (opens in new tab)).

Issues like this are no surprise when a service puts itself under this level of scrutiny (a Cure53 audit is seriously thorough), and they’re all now fixed. These didn't compromise users, though, and were more about ways TunnelBear systems could be attacked.įor instance, Cure53 spotted a way that an attacker could prevent someone logging into TunnelBear if they knew the victim's account email address. The audit results weren't perfect, and the report detailed five vulnerabilities: two low, two medium and one high risk.

Tunnelbear. windows#

The most recent audit (the fourth) included the mobile and Windows apps, browser extensions, the service infrastructure, backend and frontend systems, and the public website. The company now has independent specialists Cure53 run an annual public security audit covering many different areas of the service. While that looks great, there's normally no way to tell whether you should trust what a VPN provider is telling you – but TunnelBear is a little different. Not quite zero logging, then, but it's far less than we've seen elsewhere, and there's nothing here that could link you to any online action.

That includes the OS version of your device, TunnelBear app version, whether you've been active this month, and the bandwidth you've used. The service does record 'operational data', updating this when you connect. The logging policy is clearly described, with TunnelBear explaining that it does not collect 'IP addresses visiting our website', 'IP addresses upon service connection', 'DNS Queries while connected', or 'any information about the applications, services or websites our users use while connected to our Service.' As a result, the company says, it can't link any of its users to an action carried out by a specific IP address. We do mean thorough, too – the details go right down to the names, purposes and expiry dates of the cookies used by. TunnelBear's privacy policy (opens in new tab) is one of the most thorough we've seen from any VPN provider, with in-depth information on everything the service collects, and everything it doesn't. TunnelBear has hired independent specialists to run security audits on its site and services (Image credit: TunnelBear) Privacy and logging With no PayPal, either, it’s now strictly card-only. TunnelBear used to support Bitcoin payments for its annual plan, but no more. Not quite as friendly as the cuddly cartoon bears suggest, then. The small print says: 'While all amounts paid are non-refundable, certain refund requests for subscriptions may be considered by TunnelBear on a case-by-case basis.' Presumably, you might get a refund if you've had really bad service, but it's entirely up to the company to decide. If you do sign up for TunnelBear, keep in mind that there's no money-back guarantee. Private Internet Access asks $2.03 a month on the first term of its three-year plan, and opting for Ivacy's five-year plan cuts the cost to a supercheap $1.19. These are competitive prices which beat most providers, although there are a few with cheaper deals. The price drops to an effective $4.85 a month on the annual plan, or $3.33 if you sign up for three years. Its monthly plan (opens in new tab) gives you unlimited data for a reasonable $9.99 a month, though. But it's a simple way to check out the interface and make sure you can connect.

Tunnelbear. free#

TunnelBear's free account (opens in new tab) provides a horribly limited 500MB of traffic a month, barely enough to run even a single basic speed test. Just wait until you see what that does for its performance. TunnelBear has introduced one major improvement since our last review, though: the apps finally support the ultra-speedy WireGuard protocol, as well as OpenVPN and IKEv2.