Understanding Outline – Google’s new DIY VPN service

In March 2018, Google’s development division Jigsaw made an important announcement. After consulting with journalists around the world, the search engine giant unveiled a tool to protect data and sources, providing a secure internet connection wherever journalists happened to be.

This tool has been christened Outline, and it’s essentially Google’s concept of a do it yourself VPN (Virtual Private Network). It remains at an early stage of development, but signs are that Google’s VPN could be a valuable security tool – not just for journalists – but for anyone who is working remotely and has concerns about privacy and surveillance.

So what do we know about this potentially-useful security software, and should you get ready to implement an Outline VPN solution? This blog will explain everything you need to know.

Introducing Outline: a VPN from Google

Outline comes from Jigsaw, which used to be known as Google Ideas. Essentially, Jigsaw runs parallel to Google’s main search engine business, as a kind of massive digital laboratory churning out hardware and software. Google like to call it a “technological incubator” with a focus on cybersecurity and protecting the integrity of the internet. With these goals, it’s easy to see why VPN development has fallen under Jigsaw’s remit.

The idea behind Outline is to provide an off the shelf DIY VPN for use in almost any location. By VPN, we mean a Virtual Private Network. These security tools create “tunnels” between servers and individual users, shielding the data they send and receive, and anonymizing their IP addresses.

In reality, what Google is offering here sounds more like an encrypted proxy service (which relies on the Shadowsocks protocol) than a VPN. What this means is that you won’t be able to use Outline to secure all of your traffic – just the apps you set it up on. Of course, the term VPN has more market appeal nowadays, so we won’t delve too deeply into this…

The Google Outline VPN uses cloud platforms like DigitalOcean, which provide space for users to create dedicated VPN servers. Instead of requiring special routers or relying on downloaded VPN clients, users can set up their own service and fine-tune whatever features they need. And it’s also open source, so coders can dive into how the Google Outline VPN works.

While this sounds technical, it doesn’t have to be. In fact, the major aim of Outline’s developers is to make DIY VPNs accessible to almost all web users. Right now, it’s relatively difficult and time-consuming to set up and maintain a bespoke VPN, but Outline offers exciting possibilities.

Why have Google introduced the Outline VPN?

When they announced Outline in 2018, Google explained that its development had been prompted by serious concerns about the activities of repressive (and democratic) states. And they tied these concerns up with a general anxiety about “Fake News”.

As their Chief Business Officer Philip Schindler wrote in March, “It’s becoming increasingly difficult to distinguish what’s true (and not true) online” and Google felt partly responsible.

In response, the search engine giant launched its Google News Initiative, which aims to improve the quality of journalism and give journalistic organizations the technology they need to thrive.

But where does Outline fit into all of this? That’s not so clear, but a clue lies in the slogan “making it safer to break the news”. When 71 journalists were murdered worldwide in 2017, and the number appears to be rising, privacy can save lives. So there’s definitely a noble intent behind what Google are doing.

Key features of the Google Outline VPN

We don’t know how the Outline VPN will develop as coders get hold of it and Jigsaw make further refinements, but we do know that the DIY VPN has several important features.

• Generally, Outline uses the DigitalOcean cloud infrastructure to provide space for VPN servers, which should provide reliable speeds and a high level of privacy protection. However, users can also set up their DIY VPN on services like Rackspace, Amazon EC2 or the Google Cloud Engine.
• The VPN uses a protocol known as Shadowsocks. This doesn’t resemble standard VPN protocols like OpenVPN. It’s actually harder to track, and should be much a more reliable way to get around geo-blocking measure, while providing a higher level of personal privacy than traditional VPNs.
• Outline also uses 256-bit AEAD (Authenticated Encryption with Associated Data) to provide very solid online protection.
• The VPN works via a specially created App, which is available for Android, Windows, and ChromeOS, with an iOS and MacOS version planned for the near future.
• Setting up the VPN isn’t free, as users will need to pay for droplet space on a hosting service like DigitalOcean.
• When the server is created, the security software it uses is updated every hour to provide ongoing threat protection.
• The Outline App can be used to add as many users as required, making it easy to create journalistic networks for specific publications.
• Google have released Outline in open source format, and will keep anonymized crash logs, with no logs of your actual web traffic.

Is Outline the best DIY VPN option?

The signs are that the Google Outline VPN offers a powerful, easy to use way to set up a private VPN, and that it will definitely be useful for researchers or journalists working in politically repressive environments.

These benefits don’t necessarily extend to ordinary web users in Germany or the United States, but the Google Outline VPN has certainly impressed Chinese security experts. Early tests found that the Shadowsocks-based protocol could leap over the Great Firewall of China reliably – a huge bonus in a country where most VPNs are completely blocked.

The downside was that testers experienced lower speeds when using Google Outline VPN, and Netflix access wasn’t possible, casting doubt on the ability of Shadowsocks to circumvent streaming blocks. So if you are living in a repressive country, and you want to build a VPN that you can control which has the firepower to defeat almost any digital walls, Outline seems to do the trick. But don’t expect it to be great for entertainment.

Another benefit of using a do it yourself VPN in the developing world is cost. Reliable VPNs like ExpressVPN or NordVPN come with a price tag which can be too much for people in poorer countries. If you choose the DigitalOcean option, Outline costs around $5 per month, with 500GB of data. Potentially, deals like that can reduce the cost of high-level security for media organizations, enhancing the digital rights of everyone.

For people in other parts of the world, the major appeal of using this DIY VPN is less about state surveillance than corporate surveillance. Traditional VPNs have one major flaw: while they protect against most snoopers, users have to place their trust in the VPN owners. If they aren’t trustworthy, the whole purpose of the VPN is lost.

With a “homebrew” VPN, you can eliminate those doubts entirely (with some qualifications as we’ll see below). That’s not a small issue when many VPNs have been unmasked as selling user data, and governments may well seek to demand user data in the future.

How does Outline VPN score on security?

In terms of security, Outline is pretty impressive. Shadowsocks is thought to be quite secure and the whole package is much easier to configure than a hardware-based VPN. As we noted above, Google have worked hard to persuade users that they can be trusted while using Outline, which is reassuring.

In fact, Jigsaw have carried out a “penetration test report” (essentially a security audit) of the Outline platform and released the findings publicly. This kind of openness is a positive sign that Jigsaw are taking security very seriously, and working with the online privacy community on this project.

However, Google aren’t the only company involved with the Outline DIY VPN. Hosts like DigitalOcean play a key role in how the Outline VPN works as well. When you sign up for a VPN, you need to provide the host with payment and identity details, which could represent a security vulnerability. That’s definitely something to bear in mind if you intend to use Outline as a secure VPN. If you have any doubts about the integrity of hosting services, using a Tor-fused VPN may be a more secure option.

Overall, though, despite a few possible issues, the Outline VPN represents an exciting new addition to the VPN world, with the potential to assist users across the world. If it works as planned, it could well become the gold standard for do it yourself anonymization services. Just stop calling it a VPN!