A virtual private network (VPN) lets you secure your privacy by routing your internet traffic through an encrypted tunnel to a distant server. But using one means trusting a VPN company to protect your personal information, and your web traffic. Outline, from Alphabet-owned Google-adjacent company Jigsaw, lets you sidestep that trust issue by running your own VPN on a server you control. It's easier to use than some consumer services, but does have some caveats and might be better suited for use by small companies than individuals. It's currently in beta, with some eyebrow-raising restrictions, but it already combines the friendly user design of the best VPNs with the DIY mentality of the open-source community.
Roll Your Own VPN
The difference between the Outline VPN and every other VPN service out there is that Outline isn't actually a VPN service. Instead, it's a tool for quickly creating and using a VPN you own and control. With Outline, you no longer have to worry about another company managing your personal information and potentially seeing your traffic. You are the master of your domain.
To its credit, Outline has gone to great lengths to establish its security bona fides. The Outline applications are free and the code is available on GitHub for the world to peruse and hunt for potential vulnerabilities. Jigsaw, the Alphabet incubator that spawned Outline, is also working to tackle other online safety challenges.
Outline was also submitted for a third-party audit by Radically Open Security in November 2017, and the results have now been made public as a PDF. That's great, as it means that not just amateur bug hunters but also trained professionals have examined Outline.
Under the hood, Outline is powered by the Shadowsocks protocol. I haven't seen many other VPN companies use this technology, but it is also open source and picked over for potential vulnerabilities.
Notably, Outline does not collect any information about you, your online activities, or even your hosting configuration. It does gather some information as part of its software update process, and what it describes as non-identifiable information after a crash.
Hands On With Outline
The Outline experience is comprised of two pieces. The first is Outline Manager, which is for creating and managing VPN servers. On its own, this first piece won't protect your web traffic. The second is the Outline client. This app is what creates the actual VPN connection and actually secures your traffic. Both are available from the Outline website.
The Manager software is currently supported on Windows and Linux, with macOS support coming soon. The client software is available as a VPN for Android, Chrome OS, Linux, and Windows, with iPhone and macOS support in the offing. This is a bit more complicated than it sounds, as I'll explain below.
Installing the Outline Manager is the work of a few seconds. You need to bring your own server to make Outline work, however, but Outline suggests creating an account with DigitalOcean to host your VPN activities. In fact, you can sign in or sign up for DigitalOcean from within the Outline Manager app. I actually spent far more time futzing with DigitalOcean than I did with Outline, that's how easy Outline makes the process of setting up a VPN server. The Outline manager notes that the software has been tested on Amazon EC2, Google Computer Engine, Linode, Liquid Web, and Vultr.
Note that while Outline is free, servers are not. Whatever web hosting service you decide to go with will have some hosting fees involved. DigitalOcean charges just $5.00 per month for 500GB of bandwidth, and included a $10 credit when I signed up. You can choose your own hosting service with a virtual machine or virtual private server, or hook up Outline to the server you have in your garage. You have one of those, right?
I granted Outline access to my DigitalOcean account all from within the Manager app. A few seconds later, it had taken care of all the back-end work and presented me with some choices of server locations. I selected New York, and the Outline Manager spit out some keys for me to use to get devices online. These are what you need to access the VPN server you created.
You can create any number of keys to bring other people or devices online, and manage them all from within the Outline Manager. You can also revoke those keys, and even delete your VPN server if you don't trust it any more. Spinning up a new one takes just a few seconds.
New keys in hand, I fired up the Outline windows client. I entered the key when prompted and seconds later I was online via VPN. I confirmed that my apparent IP address was indeed different when the VPN was active.
I cannot overemphasize what a remarkably easy experience this was. I have set up and used dozens of VPN services, but Outline was totally different. I expected that, like most open-source DIY projects, this would be the work of an entire afternoon. Instead, it took about eight minutes from download to deployment. I actually ended up drumming my fingers, trying to figure out what to do with the rest of my day. In this respect Outline is already a winner, even in this beta iteration: it's intended to make creating and deploying a VPN trivial, and it succeeds in every respect.
Speed and Performance
As Outline is still in beta, I have not performed a full speed test evaluation. However, my preliminary results from using the Ookla speed test tool showed a significant drop in download and upload speeds, and greatly increased latency—far more than I would usually see with a commercial VPN. (Note that Ookla is owned by Ziff Davis, which also owns PCMag.)
Given that Outline lets you set up and run your own VPN, these speed test results are more likely a product of DigitalOcean's hosting scheme. Outline, remember, is just providing the software and management tools. The end user has to bring the server, which is probably having a bigger impact on speeds.
Note, also, that I don't recommend choosing a VPN on speed alone. Value and commitment to privacy are far more important than the fastest VPN. In any case, Outline is still in beta, so take these results with a grain of salt.
Major Advantages
I've often heard people refer to antivirus software as "malware, but good." Consider that it can move files, modify itself, and even delete files without input from the user. If you didn't intend to install antivirus, it would be malware. The same is true with VPNs from a trust perspective. You install a VPN to protect your web traffic from snoops on your local network, to provide a measure of privacy on the wild wild web, and to keep your activities secret from your ISP. But in doing so, you give the VPN company as much insight as your ISP, so they had better be a good steward of your data.
Outline solves that by putting you in charge. You don't have to trust a VPN company with your data because you're the one that owns (or rents) the server(s) and manages them, too. Using a commercial VPN safely in some countries is difficult if not actually impossible. Outline sidesteps that problem, too, since you control every aspect of the VPN.
Most VPN companies require that you only connect up to five devices at a time, but with Outline you're only limited by the amount of bandwidth your server allows. Outline lets you easily create secure keys to get other devices and people online, with no limitations. You have to distribute those keys (in the form of URLs) yourself, preferably through a secure system like Signal or ProtonMail. This makes it ideal for a small organization, like the newsrooms Outline targets with the copy on its website.
In addition to being shockingly easy to set up and deploy, Outline also handles some of the trickiest parts of VPN management. It automatically finds and applies software updates, and makes it easy to destroy and create new VPN servers with just a few clicks.
Major Limitations
Outline is easily the simplest, and friendliest digital DIY software project I've ever seen. It makes installing WordPress look like rocket science by comparison. But for all of that polish, there's a lot that Outline doesn't yet do.
For one thing, running your own VPN means that you have to, well, run your own VPN. Outline will handle software updates, but you're on your own for server management and so on. Part of what VPN companies provide is a roster of ready-to-go servers in different parts of the world. Presumably, those servers have met some level of security compliance, too. I can't say the same thing about the VPN I spun up with Outline because, quite frankly, I have no idea what I am doing when it comes to server configuration.
It also means that you only have access to the servers you can rent or run yourself. For example, with a DigitalOcean account, I was only able to create VPN servers in eight locations: Amsterdam, Bangalore, Frankfort, London, New York, San Francisco, and Singapore. Most consumer VPNs offer hundreds (if not thousands) of servers in dozens of countries.
Another major issue: there isn't yet much support for the Outline client or Manager software. Outline Manager, which is used to create and manage your VPN servers, is currently available only for Windows and Linux, with the Linux installation looking like it requires quite a bit more effort than the Windows application I used.
The Outline VPN client is currently only available for Android, Windows, and Chrome OS. That means that if you want to connect a Mac or iPhone to your Outline VPN server, you'll have to do some manual configuration.
I am also surprised and a bit disturbed about some of the limitations of the Outline client listed in its FAQ. It says, "On Windows, Outline doesn't work as a full system VPN yet," meaning that not all of your traffic may be encrypted. It goes on to helpfully provide information on how to ensure that your traffic is encrypted, but that might be beyond the average person (who, admittedly, will probably not be using this service). Notably, the Outline Windows client alerted me that this was an issue when I started it up for the first time.
Hide in Plain Sight
A good friend of mine pointed out that on a large, commercial VPN service you are just one of many users on any given server. Someone watching that VPN server might be able to figure out that you're in there, somewhere, but they'll still have to sort through all the other users. The same isn't true for my small Outline VPN server. In effect, I traded my IP address for the IP address of the DigitalOcean server.
To be clear: All VPNs aren't really in the business of providing total anonymity. For that, you need a tool like Tor. But although Outline makes the case for many small VPNs being harder to shut down than a few large companies, I wonder how easy it will be for a determined adversary to identify your VPN's IP address with you. Also, I would love to see Outline add more tools—setting up a Tor node or accessing the Tor network via VPN, for example—in future versions.
VPN for the Masses
Outline sets out to democratize VPN technology and succeeds admirably. It's incredibly easy to use, and makes managing and deploying VPN access a snap. Its major drawbacks have more to do with it being beta software than any underlying issues. We also saw eyebrow-raising initial speed test results, although that is likely more to do with my hosting service. We'll do more testing on this and other facets of Outline, are forthcoming, pending its release from beta.
All that said, managing your own VPN server really only makes sense for those truly dedicated to a kind of security self-reliance, or distributing VPN access to several other people.
Outline is definitely targeted at the latter, but the former can benefit as well. If you're looking for an interesting weekend project, look elsewhere because Outline lets you set up a VPN before your coffee finishes percolating.