Disconnect is an excellent open source privacy-oriented browser extension, and has now expanded upon this technology to offer an inclusive privacy package that combines its anti-tracking and anti-malvertizing know-how with its anonymous search capabilities and a VPN network, all for an extremely reasonable $5 per month. As we shall see, concerns about the VPN’s reliability are the only thing really holding back what is otherwise a very comprehensive, fully featured, and fast privacy package, so if Disconnect can fix this problem, then it will come heartily recommended.
Pricing and features
The Premium service costs a very reasonable $5 per month, or $50 per year. There is no free trial or money back guarantee, but Disconnect does offer a basic free service.
Disconnect aims to offer a ‘complete privacy solution.’ At the heart of this lies a VPN, but users also benefit from Disconnect’s proven tracking prevention and malware blocking technology, and search engine obfuscation tools.
Paying users of the VPN ‘Protection’ service can chose to connect to VPN servers in the ‘USA’ (Delaware), ‘Europe’ (Ireland), ‘Asia’ (Japan) and Germany, and can connect up to three devices at the same time. We will note that none of the countries in which servers are located are very P2P friendly, so although we can see no prohibition against torrenting in the ToS, and Disconnect says it does not monitor what users get up to on the internet, this is probably not the best service for P2Pers.
Free users do not get the VPN features, but can use the Disconnect Desktop and mobile apps to visualize tracking by their favourite websites, and to perform searches anonymously.
Most search engines, including Google (in fact particularly Google), store information about you, including:
- Your IP address
- Date and time of query
- Query search terms
- Cookie ID – this cookie is deposited in your browser’s cookie folder, and uniquely identifies your computer. With it, a search engine provider can trace a search request back to your computer
This information is usually transmitted to the requested web page, and to the owners of any third party advertising banners displayed on that page. As you surf around the internet, advertisers build up a (potentially embarrassing or highly inaccurate) profile of you, which is then used to target adverts tailored to your theoretical needs.
In addition to this, governments and courts around the world regularly request search data from Google and other major search engines, which is usually duly handed over.
Using technology first seen in its browser add-on, Disconnect will route all searches made using the app through its own servers, so your ‘real’ IP address is hidden from the search engine.
As you can see, searching using Disconnect comes with a number of handy extra features:
- Choice of search engines – Google is the default, but you also easily search using Bing, Yahoo!, DuckDuckGo or Blekko
- Easy regional selection
- Advanced search tools – you can specify how recently an article was posted online, and search ‘verbatim’ (matching exact search terms)
- No ads
Both the desktop and mobile apps will visualize how a website tracks you.
Disconnect Premium extras
In addition to a VPN service, Disconnect Premium customers will automatically get the Disconnect anti-tracking browser extension that made Disconnect famous, and the Disconnect Privacy Icons extension installed in their browsers.
Disconnect (for Firefox and Chrome) is our favorite anti-tracking and anti-cookie extension thanks to its up-to-date database of tracking cookies, page load optimization, secure WiFi encryption and analytics tools, which allows Disconnect to block third party tracking cookies, and gives you control of over all a website’s elements. It also prevents social networks such as Google, Facebook and Twitter from following you so they can collect data as you surf elsewhere on the internet.
The Disconnect Search extension performs essentially the same job as Anonymous Search discussed above, except that it allows you to search from with your browser.
It should be noted that while both of these are great browser extensions (and Disconnect always makes our lists of recommended browser extensions), they are also available for free from the Firefox Add-ons page and the Chrome web store.
Disconnect Premium also blocks known or suspected malware sites, which are a growing menace to internet security. According to the Online Trust Alliance (OTA), malvertising increased by over 200 percent in 2013 to over 209,000 incidents, generating over 12.4 billion malicious ad impressions – most from simply visiting infected webpages with no need to click a link or otherwise interact with the website required (known as drive-by downloading).
The problem has become so bad, in fact, that Sen. John MCain last year held a congressional hearing on the issue, in with he pushed for greater legislation against malicious advertising companies. We have not fully tested how effective Disconnect’s malware screening actually is, but kudos to it for being the only privacy company we are aware of to openly recognise the problem and offer a solution to it.
The website and customer support
The Disconnect website is a very smart looking affair, and does a reasonable job of explaining what its services and products do. It is, however, clearly aimed at the casual user, which left us a little frustrated when looking for more detailed information.
Although a fairly detailed FAQ is available, it deals only with the Disconnect browser extension, so if you have any problems with the Disconnect Privacy service then you must contact the support team via email. When we tried this, our initial enquiry was never answered, although subsequent questions were answered in within a few hours. These answers were satisfactory, although we did find ourselves having to push for details
Privacy and Security
Disconnect is a US based company, so those worried about NSA surveillance should probably avoid. It is however very open about its corporate structure, investors, and business model, which does inspire confidence. It is also very proud of being a ‘benefit corporation (colloquially, B corporation)… a new corporate form designed for for-profit entities that want to consider society and the environment in addition to profit in their decision making process.’ This sounds great, although we have no idea how it works out in practice.
On a more brass-and-tacks level, the original Disconnect browser extension won much praise for the fact that it was (and still is) open source. This is important in a security product, as is it is the only way (imperfect though it is) to check that a program is doing (and only doing!) what it says it is.
All of Disconnect’s browser extensions are open source, but its iOS, Android (based on ICS-OpenVPN), and Desktop apps are not yet. This should change, however, as website says the code for these will be ‘available soon’, and when this happens it will speak very well for the integrity of the company.
Unfortunately, the only way we could see to purchase the Premium service was using a credit/debit card, so Disconnect will know exactly who you are, although its use of shared IP addresses should make it difficult to connect users with specific internet activity.
Disconnect does not keep any usage logs (traffic or users’ IP addresses), but does keep some minimal connection logs – ‘The only information we log is related to billing and account management. For example, we log connection time, bytes used, and disconnect time.’ This is quite common practice among VPN providers, and is not a cause for major concern, but is clearly not as privacy-friendly as a promise to keep no logs at all. For a discussion on this subject, see here.
On the technical front, security on iOS devices is handled using IKEv2 (IPSec) encryption, and OpenVPN for Windows, Mac OSX and Android. The 256-bit AES cipher used for both OpenVPN and IKE2 is very strong (the same encryption is used by the US government to secure sensitive information), but the 2048-bit RSA key encryption and SHA1 data authentication for OpenVPN could be better. Nevertheless, for most purposes this should be more than sufficient.
The process (Disconnect Premium)
You can sign-up for the premium service either through the app (desktop or mobile), or through the website. As already noted, the only way to pay seems to be using a credit or debit card, but is otherwise easy enough.
To use an account on a new devices, a code is provided, which you can enter when you hit ‘Upgrade’ to a premium account on that device.
The desktop (Windows) client
The VPN features on the desktop client are fairly basic.
You can select your location
You can choose between OpenVPN UPD or TCP, and turn on Privacy Icons
There is no fancy stuff like a VPN kill switch, and no obvious DNS leak protection (although this may be built-in, as we did not detect any DNS leaks).
The Android app
The Disconnect mobile app was removed from the Google Play Store last year, apparently on the grounds that it blocks malvertizing websites against Google policy. Despite reports that it had returned to the Play Store, it does not appear to be available and has to be downloaded directly from the Disconnect website.
The mobile app is very similar to the desktop version…
… it maps and blocks tracking by websites…
.. performs anonymous search and acts as a browser…
… and has very similar options.
Overall it’s is a neat app that works well. Although it includes a stand-alone browser, the VPN works for a device’s entire internet connection, so can be used with your regular browser instead.
The Disconnect desktop client is available for Windows (7+) and Mac OSX (10.7+), and the mobile app is available for Android (4.0+) and iOS (7.0+). The iOS version uses the IKE2 VPN protocol instead of OpenVPN.
Performance and Reliability
We tested speed performance using the HTML 5-based TestMy.net tests, using its UK test server. Our internet is a 20Mb/s down / 1Mb/s up UK broadband connection. All tests are ‘best of three’, although we will note any particularly anomalous results.
Connected to ‘Europe’ (Ireland) VPN server
Connected to Germany server
These are very good results (less than a 10 percent performance hit when connected to our nearest server). We did, however, encounter reliability issues, with the connection failing three times during the test period.
- Great performance
- Protection against ‘malvertizing’ and tracking
- 3 simultaneous connections
- Strong encryption (but not perfect)
- No usage logs (but some connection logs)
- Anonymous search (with bells and whistles)
- Tracking visualization (a bit of a gimmick, but it does help make users aware of the tracking problem)
- Neat mobile apps
- Shared IPs
- (* if the apps do become open source, that will be great)
We weren’t so sure about
- Limited choice of VPN server locations
- Server locations not ideal for P2P
- Technical support is slow
- Some connection logs
- Based in the US
- Multiple disconnections
Overall, we are quite impressed with Disconnect – in addition to offering a fast and very low cost (5 bucks a month is very hard to argue with) VPN connection, it is the only service to combine this with anti-tracking and anti-malvertizing technologies to create a very robust and inclusive security package. We also think the mobile app is pretty funky.
The limited number of server locations may be an issue (depending on how close to you they are), and may cause problems for P2P downloaders, but given the great speed results we obtained, we do not think this will be a problem for most users. Somewhat worrying, though, is the number of disconnections we experienced, which leads us to be concerned about the service’s reliability. This is, however, a purely technical problem, and therefore one that Disconnect can hopefully fix as it moves forward.
The only real other concern is that Disconnect is a US company, and none of the countries in which its servers are located are particularly privacy-friendly. If the NSA worries you, therefore, Disconnect is not the ideal choice.