I’ve always been told to beware of “free” VPNs for reasons like this
Privacy
Icon base by Lorc under CC BY 3.0 with modifications to add a gradient
If the free VPN provides an OpenVPN / Wireguard configuration, then you're mostly safe from this particular attack. Most sites use TLS, so the VPN provider won't be able to see shit.
In this particular case, it's a browser extension, which is actually able to access the contents of visited webpages.
Yup, as the old adage says: "if the service is free, you are the product."
This appears to be a bad article. See: https://piefed.social/post/1573197
Basic digressive victimization tactic. Nothing wrong with Urban VPN, but everything wrong with kod.ai.
Just once I want that kind of headline to read "sold at a loss"
I'm mostly surprised that there are companies interested in "conversations" between ~~bullshit generators~~ LLMs and mentally unwell people that "converse" with them.
If a security researcher is installing on their browser a free vpn browser extension, I assume they are a moron and can't do their job.
Seriously, not only your first question should be "how are these people paying for 6 millions people using their VPN?", but your second one should be " why they don't provide a client of a wireguard/ipsec/openvpn configuration file? So they don't have access to my webpages?"
When an article relies on a clearly bs premise (like a security researcher using a free vpn), you should assume the article is fake. Which it is, in this case: https://piefed.social/post/1573197#comment_9269001