Opera browser's free built-in VPN vulnerable to major security flaw

Opera has added a free one-click VPN to help keep your data and online habits safe from prying eyes, but it's not foolproof.
Opera doesn't get as much attention as the big four browsers but it often leads the way when it comes to new features, partly because like Mozilla's

Firefox it's not beholden to the interests of a tech giant. Both Firefox and Opera recently added built-in ad-blockers, which will obviously step on a few toes, but now Opera has gone the extra step of building a free and unlimited Virtual Private Network service directly into its latest developer preview.

Once you enable it in Opera's settings, you'll find a VPN button built directly into the browser's search bar – right next to the address of the website you're visiting. Simply press this button to divert your web traffic via Opera's secure VPN servers. You can choose between VPN servers in the US, Canada and Germany – with the closest server typically giving you the fastest web browsing speeds.

Think of the VPN like a cone of silence, encrypting your web traffic all the way from your browser to Opera's VPN servers. It's a sensible precaution when you're using a public Wi-Fi hotspot, as it prevents other people who are using the network from snooping on your activities, as well as the network operator and the internet service provider. It also makes it harder for the websites you visit to know who you are and where you're located – but don't take your anonymity for granted.

Unlike a standalone VPN, Opera's service only protects your browser traffic. It doesn't protect all the other data going to and from your computer, such as for your email client or cloud backup service. Even so it's still a major statement in the fight against demands from governments around the world to make it easier to defeat encryption.

A range of tech giants are stepping up efforts to encrypt customer data in ways that even they can't bypass, from WhatsApp's introduction of end-to-end encryption to Apple's refusal to crack open an iPhone belonging to one of the San Bernardino shooters.

In Australia talk of VPNs and encryption revolves less around active government snooping and more around mandatory data retention, website filtering and geo-blocking. Building a one-click VPN into a web browser makes it ludicrously easy to bypass them all, whether you're sneaking into US video services, visiting Kickass Torrents or simply looking to hide your browsing habits from The Man.

Unlike some VPN services, Opera's VPN won't get Australians into US Netflix – which is a smart move as it would swamp the VPN servers. Unfortunately Opera's efforts also fall short of a full VPN when it comes to hiding your identity. Opera's VPN seems to stand up well when tested for DNS leaks, but unfortunately it's still vulnerable to the well-known WebRTC VPN security flaw which betrays your true location.
Visit ipleak.net with Opera's VPN enabled and it will list a foreign IP address instead of your own, but scroll down to WebRTC detection and you'll see your true IP address staring back at you. Other WebRTC test sites confirm the flaw.

Installing the Opera WebRTC Leak Prevent plugin fails to resolve the issue unless you dip into the plugin's advanced settings to change its defaults to prevent WebRTC from using non-proxied UDP and disable the non-proxied UDP by force – not the kind of thing your average user is likely to pick up on but something Opera should enable by default if it really wants the VPN to be secure.

A fully-fledged VPN service shouldn't fall for this WebRTC trick, although keep in mind this is only a developer preview and the flaw might be addressed before it reaches the mainstream Opera release. For now Opera's one-click VPN is certainly useful for bypassing online roadblocks, but don't put your life in its hands.