US security agency urges Android and iPhone users to stop using personal VPNs

• CISA warned that personal VPNs can increase a user's "attack surface"
• The advice is part of a broader alert about sophisticated spyware
• Dodgy VPNs, especially free apps, may collect data or inject malware

The US's top cybersecurity agency has issued a stark warning in its latest missive: "Do not use a personal VPN."

The advice comes from the Cybersecurity and Infrastructure Security Agency (CISA), which has cautioned iPhone and Android users that many commercial VPN services may do more harm than good. According to CISA, "personal VPNs simply shift residual risks from the internet service provider (ISP) to the VPN provider, often increasing the attack surface."

The warning suggests that while a VPN can shield your activity from your ISP, you are placing your trust in the VPN provider, many of which "have questionable security and privacy policies." This is a significant ...