ExpressVPN is one of ZDNET’s favorite Virtual Private Networks (VPNs). The popular VPN’s transformation of its Lightway codebase from C to Rust promises to make the service faster and more secure.
For now, the updated Lightway 2.0 is only available via ExpressVPN’s Aircove router with the February 4 AircoveOS v5 update. The Aircove, which we rate as the best VPN router, costs $189. With this device, you can protect your tech from unwanted snoopers without installing a VPN on each gadget.
Also: The best VPN services (and how to choose the right one for you)
So, how much faster is the updated ExpressVPN? In my tests, I connected to the internet via my updated router over my 2 Gigabit per second (Gbps) AT&T Internet using a 2.5 Gbps Ethernet-connected Linux Mint desktop with a Wi-Fi 6 connection over my Samsung Galaxy 25 Plus smartphone.
Without the VPN engaged, I saw 1.6 Gbps speeds, which is about par. With the VPN switched on and using Lightway 2.0, I saw speeds in the 290 to 330 Megabit per second (Mbps) range to Toronto and London, England. Farther afield, I saw speeds around 250 to 280Mbps to Hong Kong and Seoul. That’s about 20% faster than I had seen with earlier Lightway versions. I was impressed.
Also: The best VPNs for streaming your favorite shows and sports
This version of the VPN should also be more secure. As Pete Membrey, ExpressVPN’s chief research officer, said in a statement: “At ExpressVPN, we innovate to solve the challenges of tomorrow. Upgrading Lightway from its previous C code to Rust was a strategic and straightforward decision to enhance performance and security while ensuring longevity.”
Rust, for those of you who don’t know it, is a high-performance language. It’s best known for ensuring memory safety without using a garbage collector. The language’s unique ownership system and borrow checker prevent common issues like null pointer dereferences, buffer overflows, and data races at compile time.
Rust also provides built-in support for safe concurrent programming, allowing multiple threads to work on shared data without introducing memory-related issues. Simultaneously, Rust’s zero-cost abstractions enable developers to write high-level code that compiles efficient low-level instructions. These capabilities mean Rust rivals the speed of C and C++ and is now being used in Linux to write device drivers.
Also: Rust in Linux now: Progress, pitfalls, and why devs and maintainers need each other
In English, all those features mean Rust is much safer to write code in than other high-performance languages, such as C. Or, as Greg Kroah-Hartman, the stable Linux kernel maintainer, recently said: “The majority of bugs (quantity, not quality/severity) we have are due to the stupid little corner cases in C that are totally gone in Rust. I’m not saying that Rust has no such issues. I’m saying that a huge majority of the stupid things we do in C just don’t happen in the same code implemented in Rust (i.e., memory leaks, error path cleanups, return value checking, etc).”
The updated Lightway VPN protocol also uses ML-KEM, the newly finalized NIST standard for post-quantum encryption. This feature, wrote Membray in a blog post, “ensures your connection is secured by encryption designed not just for today’s threats but for the quantum-powered challenges of the future.”
To ensure the integrity of the recoded Lightway protocol, ExpressVPN commissioned two independent security audits from cybersecurity firms Cure53 and Praetorian. Both audits yielded positive results, with only minor vulnerabilities identified and promptly addressed by ExpressVPN. In short, ExpressVPN is technically about as safe a VPN as they come.
Also: A new Android feature is scanning your photos for ‘sensitive content’ – how to stop it
Of course, when it comes to VPNs, it’s just not the technology you need to worry about. You must also be concerned with the company and its country of origin’s policies and laws.
In ExpressVPN’s case, the company puts privacy first. According to its privacy policy: “We do not collect logs of your online activity while you are connected to our Services, including no logging of browsing history, traffic destination, data content, or DNS queries. We also never store connection logs, meaning no logs of your IP address, your outgoing VPN IP address, connection timestamp, or session duration.” Legally, ExpressVPN resides in the British Virgin Islands, an online privacy haven.
The ExpressVPN Service costs $13 per month, $100 for the first 15 months (then $117 per year), or $140 for the first 28 months (then $150 per year). However, if you’re using ExpressVPN clients instead of a router, you won’t see the speeds I saw. That’s because, for now, Lightway 2.0 isn’t available for those clients yet. The rollout schedule has Lightway 2.0 showing up on Android at March’s end, Chrome OS, Linux, and macOS in the second quarter and Windows in the third quarter.
Also: The best VPN services for iPhone and iPad (yes, you need to use one)
So, if you value your privacy and security, you should check out the newly updated ExpressVPN service. It’s a winner.
This major upgrade to Lightway demonstrates ExpressVPN’s commitment to innovation in the VPN industry. By leveraging the power of Rust, ExpressVPN is setting a new standard for speed, security, and adaptability in VPN protocols.
