|Type||Virtual private network service|
ExpressVPN is a VPN service offered by the British Virgin Islands-registered company Express VPN International Ltd. The software is marketed as a privacy and security tool that encrypts users’ web traffic and masks their IP addresses.
ExpressVPN has released apps for Windows, macOS, iOS, Android, Linux, and routers. The apps use a 4096-bit CA, AES-256-CBC encryption, and TLSv1.2 to secure user traffic. Available VPN protocols include Lightway, OpenVPN (with TCP/UDP), SSTP, L2TP/IPSec, and PPTP. In May 2020, ExpressVPN released a new protocol called Lightway with an aim to make its connections faster, stable, and more reliable. Lightway was developed by ExpressVPN.
As of March 2019, ExpressVPN runs over 3,000 remote servers in 160 locations and 94 countries, with the largest numbers of servers located in Brazil, Canada, United States, France, Germany, Italy, Netherlands, Spain, Sweden, Switzerland, United Kingdom, Australia, Hong Kong, India, Japan, Singapore, South Korea and Taiwan. In April 2019, ExpressVPN announced that all their VPN servers run only on volatile memory (RAM), not on hard drives. This was the first example in the VPN industry for such a server security setup, and is referred to as TrustedServer.
In July 2017, ExpressVPN announced in an open letter that Apple had removed all VPN apps from its App Store in China, a revelation that was later picked up by The New York Times and other outlets. In response to questions from U.S. Senators, Apple stated it had removed 674 VPN apps from the App Store in China in 2017 at the request of the Chinese government.
Assassination of Andrei Karlov
In December 2017, ExpressVPN came into the spotlight in relation to the investigation of the assassination of Russian ambassador to Turkey, Andrei Karlov. Turkish investigators seized an ExpressVPN server which they say was used to delete relevant information from the assassin’s Gmail and Facebook accounts. Turkish authorities were unable to find any logs to aid their investigation, which the company said verified its claim that it did not store user activity or connection logs, adding; "while it’s unfortunate that security tools like VPNs can be abused for illicit purposes, they are critical for our safety and the preservation of our right to privacy online. ExpressVPN is fundamentally opposed to any efforts to install 'backdoors' or attempts by governments to otherwise undermine such technologies."
On 14 January 2016, ExpressVPN was criticized by former Google information security engineer Marc Bevand for using weak encryption. Bevand had discovered that only a 1024-bit RSA key was used to encrypt the service's connections after using it to test the strength of the Great Firewall of China. Bevand described ExpressVPN as "one of the top three commercial VPN providers in China" and asserted that the Chinese government would be able to factor the RSA keys to potentially spy on users. On January 25, ExpressVPN announced that it would soon roll out an upgraded CA certificate. On February 15, Bevand wrote in an update that ExpressVPN had reported to him that they had now switched to 4096-bit RSA keys.
In a review done by PCMag UK editor Max Eddy in May 2017, the service scored 4 out of 5 with the bottom-line being that although the service wasn't the fastest, it "certainly protects your data from thieves and spies." In October 2017, TechRadar gave the service 4½ out of 5 stars, calling it "a premium service with well-crafted clients, an ample choice of locations and reliable performance." PC World rated the service 3½ out of 5 in their September 2017 review, commending it for its easy-to-use software while criticizing "the secrecy behind who runs the company." The service received 4.5 out of 5 stars from VPNSelector in their July 2019 review putting it to the first place among VPN providers.
In December 2017, ExpressVPN announced a “Privacy Research Lab” project, including open source leak testing tools released on GitHub. The tools enable users to determine if their VPN provider is leaking network traffic, DNS, or true IP addresses while connected to the VPN, such as when switching from a wireless to a wired internet connection. Comparitech tested the tools with 11 popular VPN services and found leaks across every VPN provider, with the exception of ExpressVPN. However, they clarified, "To be fair, ExpressVPN built the test tools and applied them to its own VPN app prior to publication of this article, so it has already patched leaks that it initially detected."
- "ExpressVPN Terms of Service". 2018. Archived from the original on 2018-01-03.
- "How to Hide My IP Address | ExpressVPN". www.expressvpn.com. Retrieved 2018-04-17.
- "The best VPN service 2020". TechRadar. Retrieved 2020-09-30.
- "The best VPN service of 2020". CNET. Retrieved 2020-09-30.
- "ExpressVPN Review - Impressive Speeds, But One Small Drawback". Restore Privacy. 2018-03-08. Retrieved 2018-05-17.
- "Which VPN Services Keep You Anonymous in 2018? - TorrentFreak". TorrentFreak. 2018-03-04. Retrieved 2018-05-30.
- "Which VPN protocol is best?". www.expressvpn.com. Retrieved 2020-09-30.
- "ExpressVPN Lightway wants to make internet connectivity faster". TechRadar. Retrieved 2020-09-30.
- "VPN Server Locations: Choose the Best Worldwide | ExpressVPN". www.expressvpn.com. Retrieved 2019-03-07.
- "ExpressVPN inches closer to a 100% secure server with TrustedServer initiative". TechRadar. Retrieved 2020-09-30.
- "Apple removes VPN Apps from China App Store". Home of internet privacy. 2017-07-29. Retrieved 2018-04-17.
- Lee, Dave (2017-08-02). "Apple defends complying with China". BBC News. Retrieved 2018-04-17.
- Mozur, Paul (2017-07-29). "Apple Removes Apps From China Store That Help Internet Users Evade Censorship". The New York Times. ISSN 0362-4331. Retrieved 2018-04-17.
- Hogan, Cynthia C. (November 21, 2017). "Letter from Cynthia C. Hogan, Vice President at Apple, to Senators Ted Cruz and Patrick Leahy" (PDF). U.S. Senator Patrick Leahy of Vermont. Retrieved April 17, 2018.
- "Social media posts, e-mails of Turkish policeman who killed Russian ambassador deleted via virtual computer". Hürriyet Daily News. Retrieved 2018-04-17.
- "New evidence links exiled Turkish cleric to Russian envoy's assassin". Arab News. 2017-12-19. Retrieved 2018-04-17.
- "ExpressVPN statement on Andrey Karlov investigation". Home of internet privacy. 2017-12-19. Retrieved 2018-04-17.
- Ernesto (2015-02-28). "Which VPN Services Take Your Anonymity Seriously? 2015 Edition". TorrentFreak. Archived from the original on 2015-03-02. Retrieved 2018-01-04.
- Ernesto (2016-02-20). "Which VPN Services Take Your Anonymity Seriously?". TorrentFreak. Archived from the original on 2015-03-02. Retrieved 2018-01-04.
- Ernesto (2017-03-04). "Which VPN Services Keep You Anonymous in 2017?". TorrentFreak. Archived from the original on 2017-03-04.
- Bevand, Marc (2016-01-14). "My Experience With the Great Firewall of China". mrb's blog. Archived from the original on 2016-07-01. Retrieved 2018-01-04.
- ExpressVPN (2016-01-25). "ExpressVPN's response to the 1024-bit CA key blog post". Blog. Archived from the original on 2018-01-04.
- Eddy, Max (2017-05-12). "ExpressVPN". PC Magazine. Archived from the original on 2017-05-14.
- Williams, Mike (2017-10-23). "ExpressVPN review". TechRadar. Archived from the original on 2018-01-04.
- Paul, Ian (2017-09-20). "ExpressVPN review: A good service with no public leadership". PC World. Archived from the original on 2018-01-04.
- "ExpressVPN Review: Is This VPN Really Good At Everything?". PinPointVPN. 2018-05-25.
- "ExpressVPN Review". VPNSelector.com. 2019-07-04.
- "ExpressVPN Review – All You Need To Know". www.anonymistic.com. Retrieved 2017-11-26.
- "ExpressVPN Privacy Research Lab". www.expressvpn.com. Retrieved 2018-05-30.
- "New Open Source Tools Test for VPN Leaks | Software | LinuxInsider". www.linuxinsider.com. Retrieved 2018-05-30.
- "Most VPNs can leak personal data despite claims to the contrary". Comparitech. Retrieved 2018-05-30.