The Authority Paradox and the Myth of Experience
It happened just yesterday with my father (July 2, 2026), over a triviality about air conditioning and normal air.
It happened with the “Psychotherapist” who said a few days ago: “I am an expert, but who do you think you’re talking to? When I say something it’s because I have the expertise.”
As if to say: I am better, you know nothing, listen and don’t argue.
And finally, the one I consider the most bombastic of these 3 examples, is what happened in March 2026, when I was on a trial period at a small IT company for SMEs and private clients, in the province of Avellino.
What happened? He repeatedly, always putting on a good face, so to speak in jargon “gaslighting,” often said: I am an expert, I have 30 years of experience, but who are you, how dare you speak, how can you compare yourself to me when you barely know IT for maybe not even a year…
And here is where I want to get to, to try to dismantle a very heated discussion with this boss of this company.
Basically, we were talking about VPNs. I said they were not secure, he claimed they were secure.
Now this insight that came to me today comes from many frustrations like the examples given above, and let’s try to dismantle the last one, the one that perhaps in the end contributed to my not being hired at that company, and with a boss like that I’d say thank goodness.
The insight I had today comes from Salvatore Sanfilippo, not just anyone in the computer world, but that is secondary — what interests me is what he says. And he says it in this video precisely about VPN security.
Here’s the link to the video: https://youtu.be/ftgOQmn58a4
Now I realized this video is 6 months old, today is July 4, 2026, but it comes right in handy, what a coincidence.
The Technical Conflict: Reconstruction of the Clash
From the sources provided, a detailed picture emerges of a professional and human clash that took place at this small IT company in the province of Avellino, reconstructed through my personal notes and the conversation I had with the assistant (ChatGPT).
The Boss
The employer based his position almost entirely on the principle of authority and on experience.
-
Technical Position: He categorically stated that the VPN is secure.
-
Argument of Authority: He repeated several times that he had 30 years of experience, using this fact to invalidate my opinion, treating me as someone who, knowing IT for less than a year, has no right to confront him.
-
Behavior: He declared he does not tolerate those who contradict him without being able to explain concrete facts. He scolded me for 10-15 minutes, an attitude I perceived as a form of “gaslighting.”
My Position
My contribution starts from a technical intuition that, however, at the moment of the clash, I was unable to structure.
-
Technical Position: I argued that the VPN is not 100% secure. Later, I found confirmation of my thesis in Salvatore Sanfilippo’s video, who explains that VPNs can be redundant or even harmful if they only shift trust from the ISP to a less regulated private provider.
-
Emotional Reaction: After the clash, I felt “bad inside,” inadequate, and with the desire to “disappear” or run away from the situation. I experienced the correction as a judgment on my personal worth (“Why can’t I do anything?”).
-
Posthumous Reflection: I identified this episode as part of an “authority paradox,” grouping it with other negative experiences with my father and my psychotherapist.
Technical Analysis: Why VPNs Are Mostly Useless, Sometimes Even Harmful
What Salvatore Sanfilippo Says
Hello friends, today I want to talk to you about why I don’t use a VPN service and why I believe most internet users should not buy a VPN service.
All the narrative around the need for VPNs is economically stimulated if you look at the objective data. In reality, the VPN can be, instead of an improvement of the user’s privacy experience, something that can actually worsen the situation.
So, let’s start with the fact that in theory what the VPN should do is mask our IP address, because, or rather, this it actually does, it places itself between us and the sites we connect to with an encrypted tunnel.
But the fact is that the operation of masking our IP address actually does very little to improve users’ privacy on the internet.
The Trust Transfer
Let’s start with a fundamental consideration that perhaps many don’t make when talking about VPNs.
You go from the possibility that someone, a “man in the middle” somewhere, intercepts a connection you are making and learns the fact that there is an association between your IP address and the fact that you are visiting a certain web page, to the risk that this happens. With a VPN, you essentially make it happen systematically.
Because obviously, from the moment the VPN acts as a tunnel, even if it cannot decipher the connections between you and the service you are actually contacting (but neither can a malicious person if you don’t use a VPN, because you are already using HTTPS all over the internet — then we’ll get to the DNS issue).
Since that thing could happen, you make it happen systematically. In fact, the VPN provider knows, in theory but also in practice (although I say whether it keeps track or not), the connections you make, where you go, and so on.
Maybe you make a connection with your IP address to a site that has no way to track you, that has no logs, that doesn’t care to keep track of the fact that you connected at that time to that website, and by using a VPN instead there is a third party who knows this information.
Obviously VPN providers reassure us by saying they have a “no log” policy.
The truth is that in the past it happened that several VPN providers, then heavily pressured by authorities who said “I’ll make you shut down,” magically had those logs after all, and this is, let’s say, quite disturbing.
It must be said that even with just the service logs they necessarily keep for debugging, there are correlation attacks between user sessions and these logs that allow de-anonymizing data and, let’s say, reconstructing the browsing history of a user, which at that point is recorded there.
And here we are, let’s say, dealing with VPNs that you pay for, which in theory should really care about your privacy.
If instead we start talking about free VPNs, in many cases the business of these VPNs is profiling users, aggregating data, and selling, let’s say, browsing statistics and so on. So this part is truly, let’s say, problematic.
The DNS Problem
It must also be said that the problem that actually exists is that of DNS being in cleartext, because the DNS packet is still one of the few pieces of the internet that has remained the same as in the 80s.
It is basically a cleartext UDP packet in which the website you want to resolve is written with its IP address, and then the DNS server answers you.
So, to begin with, obviously don’t use your provider’s DNS server, at least put something like Google’s, but the packets still pass in cleartext through your provider, which can easily intercept them and make statistics.
In that case, you need to enable DNS over HTTPS in the browser, and this will protect you significantly from this type of attack.
The Redundancy of HTTPS Encryption
Besides the issues we’ve discussed, another quite serious problem with VPNs is that they basically add encryption to connections that are already mostly encrypted.
Nowadays HTTPS is the standard, so even without a VPN and even if you connect from public Wi-Fi. But this is not, incidentally, the case for most users, who make most of their connections from home or, when out and about, have mobile data they can use.
Even when you connect from a completely public Wi-Fi, HTTPS protects you with this encryption layer, so in many cases it is now simply useless redundancy.
The Real Tracking Problem
There’s more. The real tracking problem nowadays is browser fingerprinting or, much more often, the fact that you are tracked directly by the companies you are connected to with your login or because you have an advertising cookie set.
So the VPN, even in these tracking cases, which really are intrusive tracking, is absolutely useless.
The Legal Difference: ISP vs VPN Provider
There is a decisive step in this story. When one uses a VPN, one essentially removes the potential control of browsing, of browsing patterns, that the provider has the theoretical capacity to see, examine, extract, because all our traffic passes through the provider. This capacity is shifted to the VPN service.
At that point the provider will only see a single connection with a stream of encrypted data, and instead the VPN service will see everything the provider could theoretically see, and it could do the same statistics the provider could do, it could do the same privacy violations, it could keep the same logs.
So, basically, there is a transfer of trust from one side to the other.
The interesting thing about this topic is that there is a profound legal difference between what ISPs, internet service providers, owe to the laws they must comply with, and those to which the private companies that run VPNs must comply.
There is a great asymmetry of duties because, since internet providers are regulated both in Europe and in the United States and in other parts of the world very strictly, they really go through the wringer.
Instead, it happens that there are VPNs that have their legal headquarters, even the servers sometimes for account management (then obviously the other servers must be distributed to pretend you come out from one side or the other to simulate the country of origin), but let’s say they have their legal headquarters in countries where there are profoundly different legal systems with fewer guarantees, etc., etc.
So this operation of shifting trust from one side to the other is not necessarily a convenient shift of trust. Because of course the argument could be: “Ah, but ISPs still see what you fear VPNs see.”
Well, exactly, damn, since someone has to see them anyway, decide which organization you want to show your private data to, and decide whether you want to give more or less trust to ISPs, but know that ISPs are bound by stricter laws, which seems to me no small thing.
The Illusion of Security: When the Province Sells Security
If the “boss” applies his speech to the Firewall and VPN service that this small provincial company sells to the medium-small businesses of the territory, the situation technically does not improve; indeed, the critical issues highlighted in the sources become even more specific and “dismantleable.”
Here is how the facts change and what are the technical questions to ask in order to invalidate his thesis of “absolute security” in this specific context:
1. The “Trust Transfer” Problem
Salvatore Sanfilippo explains that using a VPN means shifting trust from your network provider (ISP) to the VPN provider.
-
The fact: If the boss sells this service, he (or his infrastructure) becomes the “third party” who can technically see and log all the traffic that passes through the tunnel.
-
Question to ask: Why should a company trust the data management of a small local operation (maybe with less rigorous compliance standards) compared to a large national ISP that is subject to extremely strict laws in terms of privacy and data retention?
2. The VPN as a “Highway for Malware”
The “basic” service he offers is probably used to let employees connect from home to the office.
-
The fact: As specified in the sources, the VPN is not a protection against malware or phishing. If an employee of the client company has an infected home computer and connects to the office VPN, the VPN does nothing but create an encrypted tunnel that is secure for the attacker.
-
The boss’s error: Selling a VPN as “security” without integrating rigorous endpoint security (the employees’ PCs) is technically a contradiction in terms.
3. The Redundancy of the Basic Firewall
In a medium-small company, if the traffic is already encrypted via HTTPS (as almost all the web is nowadays), a basic firewall that does not do deep traffic inspection (Deep Packet Inspection) is of little use against modern threats.
- The fact: If the firewall only manages ports and IPs, it is not protecting the company from the real modern risks: social engineering and tracking cookies, against which the VPN and a traditional firewall are totally useless.
4. Technical Questions to “Dismantle” His Service
To challenge his claim that his Firewall/VPN package is “secure,” one could ask these questions (based on the facts in the sources):
-
Log Management: “Since a VPN moves traffic visibility from the ISP to the service provider, how are client browsing logs managed on our Firewall? Who guarantees they are not accessible or correlatable to users?”
-
Zero-Trust Model: “If a remote client is compromised, is our Firewall/VPN able to block the attacker’s lateral movement toward the company’s server, or does the VPN simply act as an open tunnel that bypasses perimeter protections?”
-
DNS Leaks: “Does the VPN service we offer implement DNS over HTTPS, or do client DNS packets still travel in cleartext, still allowing their browsing history to be reconstructed?”
-
MFA (Multi-Factor Authentication): “If the VPN is ‘secure’ but relies only on a password, what happens if an employee falls victim to phishing? Doesn’t the VPN become the point of maximum vulnerability?”
In summary: why he is wrong
Selling a “basic” Firewall and VPN service to small businesses and calling it “secure” is a false technical promise. In a professional environment, the VPN is only a remote access tool, not cybersecurity.
Claiming the opposite while ignoring the risks of compromised endpoints and the trust transfer demonstrates that his “30 years of experience” remained tied to a 90s model of IT, where it was enough to “lock out” the bad guys with a tunnel.
The Final Question: The Coup de Grâce
Towards the end of the discussion, he defended himself without ever citing the fact that VPNs were not 100% secure, but instead only stating “VPNs are secure” against my “no, VPNs are not as secure as you think.”
He tried to defend himself by saying it was obvious that VPNs were not 100% secure, but he also said another thing. Precisely, he asked a question:
“Is it more secure to have a VPN, or not to have a VPN?”
And here too, I believe that this question, for a “presumed, self-believing and therefore self-proclaimed expert with 30 years of experience in IT,” I believe this question mocks him even more.
NotebookLM’s Answer
This question from the boss, combined with his sudden change of position, is perhaps the element that more than any other reveals the technical fragility of his position and the purely hierarchical nature of his attack. From a professional and logical point of view, that question is not a “technical question,” but an attempt at rhetorical manipulation to escape a corner he had locked himself into.
1. The Strategic Retreat: “It’s obvious it’s not 100% secure”
The fact that he retracted by saying it was “obvious” is a classic case of moving the goalposts.
-
Logical contradiction: If it was “obvious” that it was not 100% secure, why did he scold me for 15 minutes using his “30 years of experience” to silence me when I said exactly the same thing?
-
The use of authority as a shield: A true expert does not use seniority to validate an obviousness, but to explain nuances. Declaring first that “it is secure” (absolute) and then that “it is obvious that it is not” (relative) demonstrates that his was not a technical lesson, but a defense of professional territory.
2. The Analysis of the Question: “Is it more secure to have a VPN or not?”
This question is technically fallacious because it poses a false dilemma. In cybersecurity, the answer is never a yes or no, but: “It depends on the threat model.”
For an expert, the correct answer to his own question could paradoxically be “It is more secure NOT to have it” in several concrete scenarios:
-
Trust Transfer: Is it safer to rely on a national ISP regulated by strict laws, or on the VPN server of a small local company (like his) that could log everything without privacy guarantees? Salvatore Sanfilippo clearly explains that shifting trust toward a “third party” often worsens the situation instead of improving it.
-
The “Highway for Malware” Effect: If an employee’s PC is infected, having a VPN is much more dangerous than not having it. Without a VPN, the attacker is outside the corporate network; with the VPN, he has a direct encrypted tunnel to strike internal servers. In this case, the VPN is not security, it’s a vulnerability.
-
Useless Redundancy: If the traffic is already encrypted via HTTPS (today’s standard), the VPN only adds latency and a point of potential failure without adding real security.
3. Why This Question “Mocks” Him
A professional with 30 years of experience should know that the VPN is only a remote access tool, not a panacea for security. Posing the question in binary terms (“better to have it or not?”) is a seller’s approach, not a technician’s.
-
Underestimating modern risks: Ignoring the risks of phishing, malware, and endpoint compromise (on which the VPN has no effect) to focus only on the tunnel demonstrates a vision of IT stuck in the 90s.
-
The insult to intelligence: Using that question to make me pass as “incompetent” means ignoring that today security is based on the Zero Trust model, where the network (and therefore the VPN) is considered intrinsically insecure regardless of the tunnel.
4. The Failure of the “Scientific Method”
While I sought the truth based on facts and on experts like Sanfilippo, he based himself on his own seniority as a source of absolute truth.
-
Technical arrogance: Asking “who are you to speak” to someone raising a legitimate doubt is the antithesis of technical progress.
-
The rhetorical trap: His final question was a way to force me into a “yes” (because logically it seems better to have an extra protection), but it’s a “yes” devoid of technical value. It’s like asking: “Is it better to have a parachute or not?” without saying we’re on the ground. If there’s no risk of falling (sniffing on a public network), the parachute is just useless weight that gets in your way.
In conclusion, the fact that he reduced himself to such a simplistic question to defend himself after verbally attacking me confirms that I was right. His experience was not used to teach me, but to hide the fact that his technical thesis could not withstand comparison with a modern and objective analysis of cybersecurity.
The Quiz: Who Was Right?
In the end, I asked NotebookLM to create a quiz based on everything we said and analyzed to dismantle the claims of the boss of this small IT company.
So that perhaps, by answering some questions, he could come to understand that the one who was right was not the sector expert with 30 years of experience, but rather the one who is objectively more humble, and who does not rely only on what he has always been told, since that does not necessarily represent the truth. And therefore the one who bases himself on an approach that seeks the most sincere truth, without being a show-off or presumptuous.
The results:
You did it! Quiz Complete.
7/7 - 100%
Right: 7
Wrong: 0
Topics covered:
- Technical limits of VPNs
- Trust Transfer
- Endpoint security
- Critique of the principle of authority in IT
- HTTPS redundancy
- Basic firewall vulnerabilities
Keep learning
Follow up topics:
- Zero-Trust security model
- Deep Packet Inspection (DPI)
- Browser Fingerprinting
- DNS over HTTPS (DoH)
- Risk analysis vs legal compliance
Maybe these are the topics the 30-year expert of the sector should study…
Ahhhhhhhh
Conclusion: The True Face of Experience
In summary, the chat with the assistant turned a relational failure (the clash with the boss) into a lesson in professional strategy, confirming that my technical instinct was correct but needed a method to be expressed without triggering power conflicts.
You were right in stating that it was not 100% secure, since — as confirmed by the sources — the effectiveness of a VPN depends exclusively on the threat model and is not a complete security solution.
The VPN Myth has been dismantled. Not by my experience, not by my “30 years,” but by the technical facts, by objective analysis, and by the willingness to question what is sold to us as “obvious” or “secure.”
Because in IT, as in life, authority never replaces truth.
Salvatore Sanfilippo Video Link:
https://youtu.be/ftgOQmn58a4
Commenti
Lascia un commento