Anyone use a VPN?

[Nick]

Re staying "secure" online, for the average internet user who has no technical knowledge it's a minefield made worse by spurious claims by such companies like VPN's. Is there any device or one off solution that hides ones identity and location that is 100% bombproof against probings by say government institutions? I'm thinking in terms of a hypothetical activist say.

No, there is no one-stop-shop or magic black box that will do this. If you want to be anonymous, don't use the internet....

Well, there's Tor, but it's important to remember that Tor was developed by the U.S. Naval Research Lab so a lot of folk don't trust it.

Basically, if a government wants to get to you, they will, so forget about that.

For 99 99% of use cases, general best practice and common sense will do. Security is not just a technology, it's an end-to-end process which must be rigorously followed

If you're an activist and want secure messaging, then there's really only Signal.

Telegram, WhatsApp etc all leak metadata. Even though WhatsApp uses the Signal Messaging Protocol, it leaks huge amounts of information that Facebook harvest and use (please do read the T&C's before clicking on "Agree"!). All the others are similar.

So, about the best you can do is use a search engine like DuckDuckGo (built mainly on Bing but anonymous) or Brave Search (own indexes), a browser built on Chromium but NOT Chrome, e.g. Epic or Brave, a recursive DNS resolver using DoH/DoT e.g. "unbound", never use public WiFi unless you're using a private VPN, a secure email provider like ProtonMail, only Signal for messaging and unique complex passwords with MFA (where available) for every site. There's loads more too.

There again, by doing all the above you are sticking your head above (or below, depending on your point of view) the parapet and potentially inviting closer scrutiny by those who may be wondering what you've got to hide

Even then, if a government or suitably determined, resourced and knowledgeable third party wants to get to you, then they will by using zero day attacks, social engineering and a bunch of other vectors.

Happy days!