Old Fella reacted to Staff in Christmas 2018 special deals ...
We're very glad to announce a special promotion on most of our Premium plans.
You can get prices as low as 2.45 €/month with a two years plan, which is a 65% discount when compared to monthly plan price of 7 €.
Special deals involve three and six months plans, as well as one and two years plan.
If you're already our customer and you wish to stay aboard for a longer period, any additional subscription will be added on top of already existing subscriptions and you will not lose any day.
Please check the exact prices of each plan on https://airvpn.org and https://airvpn.org/plans
Kind regards & datalove
Old Fella reacted to Staff in Rebuttal of article "Don't use VPN services." ...
DISCLAIMER: this post has been written by an AirVPN co-founder (Paolo) and merges the information and the points of view elaborated by the Air founders in more than seven years. Other Air VPN staff members might add additional comments in the future.
We have been asked via Twitter to reply to the following post:
We see that the issues raised by the aforementioned article may be of general interest, so we have decided to post a detailed rebuttal here, meant to fix the remarkable amount of technical misunderstandings and errors which have led the writer to astonishingly wrong conclusions and worrying generalizations.
The rebuttal is based on AirVPN only; we can not and we do not want to write in the name of any other service, since most of the considerations you will read here may or may not (and sometimes we know that they will not) apply to other "VPN services". Anyway, it is our right to reply as if the writer were talking about us too, because he/she repeatedly claims that ALL VPN services act in the same way.
A "VPN in this sense" is NOT a proxy. Our service encrypts and tunnels all of the client system TCP and UDP traffic to and from the VPN server. Moreover, our service, when used with our free and open source software, also makes additional steps to prevent traffic leaks outside the VPN tunnel.
A proxy tunnels (and not necessarily encrypts) only TCP traffic (proxies can not support UDP), and only the traffic of those applications which are configured to connect to a proxy. UDP traffic, system traffic and traffic of applications which may be started by the system and that you failed to configure (or that you can't even configure in Windows, in some cases) are not necessarily tunneled to the proxy. Not even your system DNS queries are necessarily tunneled over the proxy.
If we were really interested in logging our clients traffic, we would not allow connections to and from Tor, proxies and other VPNs. We have always made very clear how to bypass the problem of "trust us" when you can't really afford to do that, and our answer has always been "partition of trust". Please see for example our post dated March 2012 (!) about it:
There's more. We work under a legal framework where the safe harbors for the mere conduits are very rigidly and clearly defined (specifically, by the 2000/31/EC, the E-Commerce Directive, articles 12, 13, 14 and 15).
The liability exemption for the mere conduit status would not exist if we were not mere conduits. If we inspected traffic and/or modified traffic (e.g. through content injection) and/or selected source and destination of the communications, we would not be mere conduits and we would lose the legal protection on liability exemptions.
We have also two decisions of the Court of Justice of the European Union which clearly define indiscriminate data retention as infringing the fundamental rights of the citizens of the EU:
under a legal point of view, logging and/or monitoring and/or inspecting and/or modifying the content of our customers traffic without the customers explicit and written consent would be a criminal infringement, also subject to civil prosecution by the customers themselves under a business point of view, that would be simply suicidal (more on this later)
It is enigmatic how the writer can make such claims.
We charge less than 10 USD per month for our services and we can pay a whole legal firm, 250 servers (physical, bare metal servers), the whole staff, including a tiny team of programmers. We also regularly donate money to organizations and projects whose activities are compatible with AirVPN mission.
We're not here only for the money, but if the writer wants to talk about money, so be it. He/she may rest assured that we have planned seriously a business model which remains robust if not rock solid.
It is obvious that we must keep our business model solid, because our infrastructure has become large and we have duties toward the people working with us and toward our customers. At the same time we never forget that our customers have transformed into reality the dream to build a rather big project based on and aimed to privacy protection in a time when the whole world was going to the opposite direction. By changing now direction and pointing to a business based on privacy infringements and personal data commerce would not only betray our beliefs and mission and customers, but we would become a goldfish in an ocean of sharks, we could not even think to compete.
After 7 years, we have the right and knowledge to claim that a privacy protection mission is not incompatible with the price the writer mentions and with a strictly agnostic network where no traffic inspection or monitoring is enforced.
We can also claim confidently that any business plan based on data protection and privacy infringements not declared in the terms of service would crash dramatically in the short-term in the EU: remember the legal framework we live in and feel free to do your own research on real cases and incidents in the recent past.
Last but not least, please do your own math and compute the costs to store and "hand a customer traffic data over": they imply costs of losing the mere conduit status, added to the costs of civil lawsuits from that and potentially other tens of thousands customers. Then compare them to the "costs" (in reality benefits) of no monitoring at all added to the peace of mind to strictly act in a legal/lawful way.
Given all of the above, you can easily discern that the quoted assumption is false for AirVPN. The logical, unavoidable conclusion is that AirVPN best interest, even under a purely cynical, business point of view, is to NOT log (in the most extensive sense of the term) customers traffic and not commerce with their data.
This is partially, only partially, true. HideMyAss was really risking to go out of serious privacy protection business soon after the incident occurred: check the massive uproar caused by the event. The AVG acquisition, with the disruptive marketing power of AVG, has probably covered the issue, but the old HideMyAss management hurried to sell the whole Privax company. Who knows, maybe just in time, maybe before the value could be hit too seriously by the incident. We can't know for sure, and the writer can't as well. Anyway, if the writer wants to claim that marketing is powerful, we agree (what a discovery!).
The logical jump from HMA incident to the assumption that every service does what HMA did is long. Do not forget that what HMA did would pose a huge amount of legal problems to us, as explained.
HideMyAss targeted the same persons who are happily using the new Facebook VPN. We respect the intelligence of our customers and we don't have the arrogance to think that we can change people mind and competence all over the world in a few years (or ever), and we don't even think that we can oppose the marketing power. More importantly, that's a problem pertaining to HideMyAss. It is not only unfair, but even defamatory to surreptitiously imply that the behavior (good or bad) of certain services is the same behavior of any other service, in the same field or not.
We have been providing AirVPN services since 2011, when we offered the service as a beta version totally free. Now we challenge the writer of the article to provide any single proof that any single user identity has been compromised by us through a betrayal of our terms of service and our mission and/or through traffic logging or inspection and/or by any infringement of the EU legal framework on privacy and personal data protection.
False. We provide our users with any tool to never make their "real" IP address appear to our servers. We have also integrated AirVPN over HTTP proxy, AirVPN over SOCKS proxy, and AirVPN over Tor usage in our free and open source software. We don't even block connections from competitor VPN servers. Finally, we accept not only Bitcoin, but Monero and ZCash as well, which are designed to provide a robust anonymity layer on the transactions.
If you really don't trust us, you can easily make your IP address never visible to our servers.
This is particularly important even if you trust us, but you can't afford (for the sensitivity of the data you need to transmit, for example) to assume that our servers are not monitored by hostile entities, an event that can happen with ANY service, not only VPN services. The fact that we have made every human effort to provide effective and easily usable protections against such occurrences is a proof of our interest in the protection of our customers privacy.
This is ambiguous, because we would need the writer to define security scope and context exactly. Is he/she referring to integrity and security of data between your node and our servers? Or security of your system? Surely, our service is not meant as a security tool to protect against virus and spyware, and this is clearly stated at the very beginning of our Terms of Service. AirVPN can't do anything if your system is compromised.
However, the above does not imply in any way that our service is a glorified proxy. See the reasons we mentioned above and verify how a loose security mention does not change anything. Additionally, while OpenVPN is the core of our service, it is complemented by an important series of features aimed to protect privacy and data in all of those cases which OpenVPN alone has not been designed for.
Even if you don't run our free and open source software, we and our community have made any effort to provide guides and insights on how to get the most from our service to integrate it in a comprehensive environment aimed to protect your data and identity. We are very grateful to our community for the invaluable contributions throughout the years.
If we were a "malicious VPN provider", does the writer really think that we would have allowed our forums to become a golden source of information for privacy, identity and data protection? Do you really think that we would have been provided monetary support to TorProject, OpenBSD, European Digital Rights, Tor infrastructure, etc. etc.?
A part of this has been widely rebutted in our previous reply. Here it will be sufficient to add that even if you don't use end-to-end encryption, even if you don't use Tor on top of an AirVPN connection, a MITM who sniffs the packets in any point between the VPN server and the final destination (including the final destination itself of course) will see those packets coming from the VPN server exit-IP address, NOT from your real IP address and NOT from the entry-IP address of the VPN server you connect to. This is a paramount point which is incompetently (intentionally?) ignored by the writer. It is so important that in some extreme cases it makes the difference between imprisonment and freedom, or even between life and death.
Imagine the case of a whistleblower giving out relevant information via VoIP or other applications relying on UDP to a self proclaimed journalist who then betrays the confidentiality of the source, or even to a serious journalist who is unaware of the fact that his/her computer is compromised, or that his/her line is wiretapped. The whistleblower can't use a proxy reliably. The journalist, or the wiretapping entity, can trace the source IP address and the identity of the whistleblower can be disclosed (just to make a trivial example which does not require any wiretapping or compromised system, think of Skype exploit, for which any party could discover the IP address of the other party). In most of these cases, end-to-end encryption would have been irrelevant for the whistleblower.
Whenever the source can't trust the destination integrity, whether the recipient is in good faith or not, our service makes a vital difference.
True. We have never said or written the contrary. In addition to changing IP address, which is anyway important in spite of the writer claims, further steps are strictly necessary to prevent profiling, from "separation of identities" to script blocking, from browser fingerprint changes to system settings obfuscation. Our community has widely covered this issue and provided precious suggestions.
Here the writer makes a totally irrational shift: first he/she wants to make you think that our service is just a "glorified proxy", then he/she wants to insinuate that our service is useless because it is not some sort of supernatural system capable to protect users from their own behavior and from every possible tracking system which exploits the user system, not the service.
The first case is true, and it is very important.
However, it is totally false that you can safely rely on a proxy for the second case purpose. Many applications, including torrent software, can:
bind to the physical network interface, or do some dangerous UPnP use UDP (not supported by a proxy) send DNS queries out of the proxy include the assigned "real" IP address inside their layer of communications, example: https://blog.torproject.org/bittorrent-over-tor-isnt-good-idea In the aforementioned cases, correct usage of our service will fulfill the purpose to never disclose your real IP address and/or the UDP traffic and/or the DNS queries. A proxy will not and you can be potentially tracked back, either by copyright trolls or any hostile entity.
Additionally, our service has many more use cases:
tunneling UDP traffic (not available with a proxy or Tor) circumventing censorship based on IP addresses block circumventing censorship based on DNS poisoning preventing injection of forged packets (not necessarily available with a proxy even in TCP, and surely not when you need UDP flow integrity) using Tor anyway when Tor usage is blocked or triggers interest of ISP or any hostile entity about you protecting your identity when the final recipient of your communications is compromised (not available with end-to-end encryption alone, and not available with Tor when you need UDP, imagine if you need to stream a video in real time which requires source identity protection) making your services (web sites, torrent clients, FTP servers for example) reachable from the Internet when your ISP does not allow port forwarding (not available with a proxy), without exposing your IP address having a static exit-IP address bypassing various types of traffic shaping tunneling simultaneously the traffic of all the devices in your local network, even with remote port forwarding, and even those which can't run OpenVPN provided that you have a device acting as a gateway to the VPN (typical examples a pfSense box or a DD-WRT / AsusWRT / Merlin / Tomato etc. router or any computer configured to work as a router) and maybe you can see more use cases which we have missed here.
The fact that the writer omitted all of the above says a lot about his/her competence and/or good faith.
This is hilarious, and not only because the whole point of the writer's post ends up into advertising LowEndBox.
We will not insult our readers' intelligence with an explanation of why that is a terrible idea when you seek more privacy and some anonymity layer in your interactions with the Internet.
Draw your own conclusions.
Kind regards and datalove
Old Fella reacted to Staff in Eddie 2.16.3 released ...
We're very glad to inform you that a new Eddie Air client version has been released: 2.16.3. As usual, Eddie is released as free and open source software under GPLv3.
Eddie 2.16.3 includes important bug fixes. Please see the changelog:
Eddie includes a full, seamless and integrated IPv6 support, as well as new features which will let you use our latest service additions including IPv6 and tls-crypt: https://airvpn.org/topic/28153-ipv6-support-and-new-smart-features/
Users who have only IPv4 connectivity will be able to access IPv6 services, At the same time users who have only IPv6 (and not IPv4) connectivity, will be able to use our service as well.
tls-crypt implementation provides a new, interesting way to efficiently bypass blocks and throttling against OpenVPN.
This version has been released for GNU/Linux, OS X (Mavericks or higher is required), macOS and Windows (Vista or higher is required).
2.16.3 version is compatible with several Linux distributions. For important notes about environments, please read here:
Just like previous versions, Eddie implements direct Tor support for OpenVPN over Tor connections. Eddie makes OpenVPN over Tor easily available to Linux, OS X and macOS users: no needs for Virtual Machines, middle boxes or other special configurations. Windows users will find a more friendly approach as well. This mode is specifically designed for Tor and therefore solves multiple issues, especially in Linux and OS X/macOS, including the "infinite routing loop" problem (see for example http://tor.stackexchange.com/questions/1232/me-tor-vpn-how/1235#1235 )
As far as we know, Eddie is the first and currently the only OpenVPN wrapper that natively allows OpenVPN over Tor connections for multiple Operating Systems. https://airvpn.org/tor Since version 2.14, Eddie sends a NEWNYM signal to Tor to ensure the use of a new circuit in every connection.
We recommend that you upgrade Eddie as soon as possible.
Eddie 2.16.3 for GNU/Linux can be downloaded here: https://airvpn.org/linux
Eddie 2.16.3 for Windows can be downloaded here: https://airvpn.org/windows
Eddie 2.16.3 for OS X Mavericks, Yosemite, El Capitan and macOS Sierra and High Sierra can be downloaded here: https://airvpn.org/macosx
PLEASE NOTE: Eddie 2.16.3 package includes an OpenVPN version re-compiled by us from OpenVPN 2.4.6 source code against OpenSSL 1.1.0h for security reasons and to fix this bug: https://community.openvpn.net/openvpn/ticket/328
Eddie overview is available here: https://airvpn.org/software
Eddie includes a Network Lock feature: https://airvpn.org/faq/software_lock
Eddie is free and open source software released under GPLv3. GitHub repository: https://github.com/AirVPN/airvpn-client
Kind regards & datalove
Old Fella reacted to Staff in Eddie Android edition ...
We're very glad to inform you that a new version of Eddie for Android has been released. The application ID is now org.airvpn.eddie and the released version is 1.0 beta (UPDATE 21-Sep-18: Release Candidate 5 is now available, please see https://airvpn.org/topic/26549-eddie-android-edition/page-7?do=findComment&comment=77774 ). This release replaces the previous one completely and we recommend that you switch to it.
As usual Eddie is free and open source software released under GPLv3. You can participate to the beta testing by joining the beta community in the Google Play Store here https://play.google.com/apps/testing/org.airvpn.eddie
Alternatively, if you don't want to access (or you have no access to) the Google Play Store, the apk ill be available soon in our web site.
We aim to speed up the release cycle from now on and we confirm that Eddie will be more and more integrated with AirVPN with the progressive implementation of several functions and options that you can find in Eddie for other platforms.
In addition to ARM64 support, various bug fixes, improvements and changes have been applied, including changes aimed to make Eddie more consistent with Android design best practices. For a detailed list, please see below the attached changelog. The project has been assigned to a new developer (you can see a credit mention in the changelog) under the supervision and verification, as usual, of Eddie lead programmer Clodo.
Please feel free to write in this thread about this new release, what you like and what you hate, and of course any detected bug.
Kind regards and datalove
Old Fella reacted to corrado in Alternative AirVPN client with provider-independent double-hop support (GNU/Linux) ...
I added an additional feature that allows applications to bypass an existing OpenVPN tunnel. This can be useful if you want to use services that block OpenVPN servers such as Netflix without compromising your other internet traffic. You can easily add applications that you don't want to use the OpenVPN tunnel to Qomui and start them from there. If you are interested how this works have a look at https://serverfault.com/questions/669430/how-to-bypass-openvpn-per-application/761780#761780. Essentially, running an application outside the OpenVPN tunnel works by putting it in a network control group. This allows classifying and identifying network packets from processes in this cgroup in order to route them differently.
Have a look at the screenshots to get an idea
Old Fella reacted to corrado in Alternative AirVPN client with provider-independent double-hop support (GNU/Linux) ...
I have written an alternative client for AirVPN that I would like to share with you. Just as Eddie, it supports other providers, too, as long as OpenVPN config files are provided. For AirVPN and Mullvad it offers a convenient update function that just requires you to enter your credentials in order to download the latest server configurations. Furthermore, it allows you to choose among the plethora of protocols offered by AirVPN (including OpenVPN over SSL/SSH) except the experimental ones (I might add support for those in the future, once they become available for all servers).
Qomui (Qt OpenVPN management UI) as I have named it, is written in Python and PyQt and should run on any GNU/Linux distribution. It allows you to easily create double-hop connections. In other words, you can route your requests via two OpenVPN servers. This feature works provider-independent. For example, you could choose a Mullvad server for the first hop, and AirVPN for the second (I have successfully tested this with AirVPN, Mullvad and ProtonVPN). Thereby, it avoids a major downside of similar offers by some providers, namely the fact that if one provider controls all "hops" he or she could potentially still see, log or inspect all your traffic. In the latter case, you would gain little in terms of privacy. With the ability to "mix" providers, Qomui does not suffer from the same problem and hence offers some tangible benefits. Obviously, you would still have to sacrifice some speed/bandwith, though.
Depending on your DE (looking at you, Gnome!), Qomui will also display a systray icon that shows the country of the server you are currently connected to. Additional features include protection against DNS leaks and a firewall that optionally blocks all outgoing network connections except for the OpenVPN server you have chosen. Since it is never recommended to run graphical applications as root, which is a major flaw of most OpenVPN clients, all commands that require root privileges are handled by a background service that can be controlled via systemd. The following screenshot gives you an idea of what Qomui looks like (on Arch/Arc Dark Theme).
If you are interested, you can download Qomui from github: https://github.com/corrad1nho/qomui
Of course, I'd be happy for any kind of feedback. If you find bugs or Qomui does not run properly or not at all on your machine, please let me know. I'm happy to help!
At last, a big thank you to AirVPN and its amazing community. The fact that you rely more on explaining technical details than empty promises, has helped me to learn a lot. It is also one of the main reason why I chose AirVPN. Commendably, Eddie is also released as open-source software. Only Mullvad does that, too, to my knowledge. Why doesn't every provider do that? You are selling a service, not software! Why would I trust in proprietary software? Funnily, I have never really used Eddie, though, since I was accustomed to manually adding config files to NetworkManager as my first provider did not offer a GNU/Linux client. My interest in features such as OpenVPN over SSL made me look into more convenient solutions, though. Ultimately I decided to write my own program as I wanted to learn some Python and this provided a perfect practical challenge. I have actually used Qomui daily on multiple machines during the past few months and constantly tried to improve it. So I'd thought it'd be about to time to share it (it's an alpha release, though).
Have a nice weekend!
Old Fella reacted to Staff in Status of Eddie on Linux distributions ...
Last update: 16 May 2018 - Related to version: Eddie 2.14.4
Any Linux distribution has at least:a different graphics server (X11, Wayland) a different desktop environment (GNOME, KDE, LXTE etc.) a package manager with a specific format (deb, rpm, tar.xf etc.) a different packaging signature for trust and security a different method to obtain administrative privileges, required by advanced features of Eddie (also because OpenVPN requires them) a different set of packages used by our client, that sometimes have different names (for example 'stunnel4' under Debian, 'stunnel' for Fedora) maybe a different DNS management. We are working at our best to support every kind of configuration managed by our source code directly, when possible.
Tested without known issues
Debian (tested 7/8/9) Ubuntu (18.04 GNOME tested) Ubuntu Mate (18.04 tested) Devuan (tested Ascii) Mint Arch (XFCE tested) Fedora (28 tested)
With minimal issues
openSUSE (Tumbleweed KDE tested)
openSUSE (Tumbleweed GNOME tested)
Works, with no tray icon. Elementary
Works, but tray icon, web and folder links don't work.
Sometimes Tray icon works, but it is not shown because the desktop environment hides it.
For example, latest GNOME may require a separate shell extension (generally TopIcons). Currently Eddie 2.x under Linux requires root privileges (like GParted or Synaptic Manager).
Elevation is generally obtained with a polkit policy file (pkexec) if installed, otherwise fallback methods are used when available (gksu, kdesu, beesu etc.).
When the UI runs as root, there are four -optional- actions that are performed as normal user: tray icon, notifications, open web links and open file folders.
If it is not possible to act as a normal user, such actions are not performed at all.
A totally separated UI (as a normal user) vs. root-actions (as root user, service or separate process) is currently under development.
Minimal lintian warnings on .deb edition General info details on .deb edition (for example, reporting Proprietary as License, not true.) General info details on .rpm edition (for example, reporting Proprietary as License, not true.) Create official package for AUR and other distributions. Create packages also for CLI-only edition. Create packages based on direct source compilation. Procedures to include Eddie in official/standard repository
Old Fella got a reaction from auser17 in Eddie plays dead - Mint Sylvia ...
Almost every time I go to shut down or restart Linux Mint 18.3 the Eddie Window is unresponsive; I can display it but I am unable to click anything on it. Initially I just shut the system down regardless but if I don't want to sign out I have to shut down all *vpn processes manually, usually with htop cos its quicker.
Just what might the issue be? It isn't new, I've had this happen for a long time, just not as often.
Old Fella reacted to Mad_Max in Using AirVPN with qBittorrent ...
You can add one more option to make sure that qBittoorent always uses AirVpn no matter what.
Go to Tools --> Options --> Advanced --> Network interface (Requires Restart)... change this to your vpn interface, in my case i use a cable and its "Ethernet 2"
One more thing, in Eddie, make sure u have Network lock always on.
you can test if your torrent client is leaking information from ipleak.net they have a torrent file that can test ur client.
Old Fella reacted to Staff in Five simultaneous connections per account ...
We're glad to inform you that, from now on, every account can establish up to five simultaneous connections to AirVPN servers. As usual, no restrictions will be applied on IP addresses.
No price increase has been planned for this new feature.
We're confident that allowing 5 connections per account at the very same price will meet and even exceed the expectations of our customers.
Please do not hesitate to contact us for any further information.
Kind regards & datalove
Old Fella reacted to Staff in PureVPN logging ...
we don't monitor and/or inspect (with or without logging) the traffic of any OpenVPN client. The information that you report shows that PureVPN did.
If you can't afford to trust our words please apply partition of trust. The fact that we don't block OpenVPN connections over Tor node or any socks or http proxy should say something about our honesty.
Furthermore, the fact the you don't have any official statement after seven years of AirVPN activity and hundreds of thousands rotating customers about any compromised customers identity (and you have such information about HideMyAss, PureVPN and other services) should be also taken into serious consideration.
Old Fella reacted to giganerd in BBC iPlayer knows my location despite VPN ...
A poor word, to be honest. It's a feature designed to be able to view geo-restricted content without switching servers.
Say, you want to view BBC iPlayer and you are connected to Kitalpha in Switzerland. Now, viewing BBC would suggest you are viewing this site from Switzerland, but only UK residents are allowed to view it (geo-restricted to UK). To not make you reconnect to a UK server, your request will be rerouted through GB2, a rerouting server of AirVPN used only for this purpose.
You <---> Kitalpha, CH <---> GB2 <---> BBC
In the end, the request appears to have come from a UK IP, even if you connect to Mesarthim in Germany the next time, and Phoenicis in Romania the next day.
Old Fella got a reaction from BullockBob in BBC iPlayer knows my location despite VPN ...
wow, thats what i call a detailed answer. About as useful as a choccy fire grate unless you are as clever as the respondent thinks he is or then you have to go find out what micro routing is and die of boredom.
So the answer is you have no concern.
Old Fella reacted to Staff in Likes and dislikes (IPv6) ...
the correct option is "-netlock" as clearly specified in the instructions.
Also type "airvpn -cli -help" or "man airvpn" to print the manual.
It is clearly specified in the guides, in the welcome e-mail that's sent when you subscribe to the service, in the dedicated forum and in the instructions for various Operating Systems.
There is no security breach.
We're glad too even if we are somehow puzzled to read your initial concerns. Perhaps they were just caused by a lack of information. You MUST read our instructions and you will be just fine.
Old Fella reacted to zhang888 in Does AirVPN support compression? ...
Compression is supported, but not recommended for all devices.
Note that most data that passes inside the tunnel is not compressible in any case, so the theoretical
gain you can benefit from using compression is very limited by what you are going to test.
Unless you are doing iperf tests with compressible data, such as /dev/zero, this is not going to benefit
you much, as most of the real-life traffic is not compressible from the beginning, such as encrypted
underlying protocols (when you use HTTPS websites) and so on.
This is based on the axiom that encrypted data is random. And random data can't be compressed.
A safer default would be turning it off, or at the best as 'adaptive'.
From the OpenVPN wiki:
With adaptive compression, OpenVPN will periodically sample the compression process to measure its efficiency. If the data being sent over the tunnel is
already compressed, the compression efficiency will be very low, triggering openvpn to disable compression for a period of time until the next re-sample test.
This was a more practical feature in the earlier days of the internet, when most traffic was counted and billed and data was mostly plain-text.
More about it here: