Connect with us

SEO

How to Create a Buyer Persona for Your Business

Published

on

Looking to create a buyer persona for your business? You’re in the right place.

Many companies have experience creating buyer personas. It’s usually done after a day of brainstorming in a meeting room. After the session, documents with demographic and psychographic details (married, have two kids, own a car, etc.)—appear, and the executives are satisfied. They’re even given names—Anna Agency, Billy Blogger, etc.—to remind the marketing team that they’re marketing to actual human beings. 

But these “buyer personas” are then tucked into the recesses of Google Drive, never to be seen again. You spend time “identifying” these personas, yet they have zero effect on any marketing activities.

Why? Because these buyer personas were not created in the right way. As such, they’re not helpful and can’t influence a company’s marketing strategy.

In this post, we’ll learn how to create a buyer persona that you can actually use to impact your business. 

A buyer persona is a semi-fictional representation of your target customers. They’re semi-fictional because while they’re not actually real people, they’re based on market research and data you have about existing customers. 

Why are buyer personas important?

While every customer is different, it’s almost impossible for most companies to address all of them individually. (There are exceptions, however, which is why account-based marketing exists.)

However, buyers do generally have similar wants and needs. So, rather than cater to every individual difference, a buyer persona allows you to address those similarities in your marketing.

For example, a hobby blogger and an in-house marketer are entirely different people on the surface. But they do have a similar goal: to get more traffic to their website. So, rather than targeting them differently, we can address the main issue—how to get more traffic—and attract all of them to our business. 

Also, since the buyer personas you’re creating are born out of actual stories related to your buyers, creating a buyer persona will help you understand your customers deeply—how they think and make decisions, who they’re influenced by, and so on. 

This will help you create and align your messaging, product, customer service, etc., with what your customers actually want and need. 

Finally, a buyer persona helps you visualize your buyers. Many companies make the mistake of focusing too inwards and forgetting who their products are serving. A buyer persona serves as a reminder that you are selling to actual people. 

How to create a buyer persona

Creating a buyer persona isn’t about downloading a template and filling it in. It’s about talking to real people and understanding their perspectives. 

Here’s how to create a buyer persona:

1. Find people to interview

Creating a buyer persona means picking up the phone (or, these days, a Zoom call) and talking to your customers. 

That means the first step is to find people to interview. Who should you talk to? The easiest group of people to start with—and the ones you should start with—are your customers. 

Finding them should be relatively easy. You should have a customer relationship management (CRM) tool where you store your customer data. Look through the list and pick out those you’d like to interview. A quick way to narrow the list is to find your best buyers—those who have been with you the longest or spent the most money with you. 

If you’re just starting out and have no customers, don’t worry. You should have a general idea of who your product or service is for. Reach out to these people and see if they would be up for an interview. You can probably find them in their respective communities on Facebook, Telegram, Discord, Slack, Twitter, Reddit, etc. You can also consider attending physical events like conferences and meetups. 

At an early stage, these interviews can simultaneously act as customer development interviews and help you determine product-market fit.

Now, while you should talk to your customers, note that talking only to them isn’t enough. After all, these people have bought from you and used your products or services. They’re clearly satisfied with what they’ve gotten. So, interviewing them might only yield stories where your business got it right. 

Everyone wants to hear good things, but knowing where you came up short is also important. So, beyond your customers, there are other people you should interview. Here are some options:

A. Your users

Users are people who have started a trial with you or used a free version of your product but didn’t convert into a customer. You have users if you’re a SaaS or even a gym that offers a one-month trial. 

Again, this group of people should be relatively easy to find as they would have submitted their contact details to access your trial or free product. For example, if we wanted to interview our users, we could easily find everyone who signed up for our free Ahrefs Webmaster Tools but is not currently a customer.

Ahrefs Webmaster Tools signups in the past 7 days.

B. Your sales prospects

This group of people either reached out to your sales team (e.g., for a demo) or talked to your sales team but did not purchase your product. They may not necessarily be users. 

Likewise, your sales team should have the details of these people. Work with your sales team to identify who they are and reach out to them. 

2. Reach out to them for interviews

Once you’ve identified a list of people you’d like to talk to, send them an email and ask them if they’d like to hop on a call with you.

Be honest and transparent. Tell them directly that you’re trying to learn more about your customers and that you’d like to hear about their experience. 

Make sure to state the time commitment upfront so you don’t scare them away. 20-30 minutes should suffice for the interview. 

Also, assure them that it is not a sales call. Especially if you’re interviewing your users or sales prospects, they might be wary that you will use the opportunity to segue into a sales pitch. 

Finally, you can offer an incentive to show appreciation for your customer’s time. It’ll also help encourage take-ups. 

Adrienne Barnes of Best Buyer Persona says that she has found that discounts on your product (especially when talking to your customers) have yielded great success. Alternatively, charitable donations to your customer’s charity of choice (under their name) are also a great incentive idea to try. 

3. Interview them

With the interviews scheduled, it’s time to do the actual interview. 

Before the interview begins, ask if you can record it. This is important because we’re not going to lean on our unreliable memories to try and parse out insights. And while note-taking during the interview is essential, excessive note-taking disrupts the session. 

When your interviewee has signified an “ok,” you can start.

Adele Revella of Buyer Persona Institute suggests that you begin with this question, “Take me back to the day when you first decided to evaluate [the category of solution your product fits into] and tell me what happened.”

This should set the tone and allow your interviewee to relate their experience. 

You can also ask questions based on Adele Revella’s famous Five Rings of Buying Insight:

  1. Priority Initiatives — What’s causing buyers to invest in products like yours? What about buyers who are satisfied with the status quo?
  2. Success Factors — What results does your buyer expect to achieve from buying your (or a similar) product?
  3. Perceived Barriers — What concerns do your buyers have regarding your product? What’s stopping them from buying?
  4. Buyer’s Journey — How do buyers evaluate their options?
  5. Decision Criteria — Which aspects of your competitors do buyers consider the most important? 

From there, follow these tips to ensure a smooth interview:

  • Give interviewees time to respond. Your interviewees are not robots with prepared answers to every question. Silence is golden—give them space and time to think through their thoughts and respond. 
  • Listen. Don’t insert your own opinions or defend yourself or your products. Your goal is to find answers, not sell or be judged by a court of opinion. Make sure to listen to what your customers are saying. 
  • Ask “why” and ask follow-up questions based on what they’ve said (and use the words they’re using). Your interviewees may not answer your questions directly or fully. Or maybe they might need prodding to provide more information. Don’t be afraid to ask follow-up questions and get them to clarify what they’re saying. You want to be on the same page. Even better: use the words they’ve been using so you can build rapport with them and get them to open up more. 
  • Don’t be afraid to guide your interviewees. It is likely that they will not answer chronologically. They might skip ahead and add a flashback to their story. You should feel comfortable slowing down the pace and guiding them back to the part of the conversation you’re interested in. 

4. Organize your data

When the interviews are over, you’d want to get them transcribed. Use a service like Rev.com to turn them into text. 

Next, it’s time to mark up your interview transcripts. You can then read through the transcripts and identify patterns (such as commonly repeated words and phrases) among what your customers are saying.

When you see two or more of the same pattern, create a category for them. The easiest way to create these “categories” is via the marketing funnel.

The Marketing Funnel.The Marketing Funnel.

For example, say we interviewed a few of our customers at Ahrefs. Reading through the transcripts, we noticed that one commonly repeated phrase was “we wanted to figure out how to rank in Google for more keywords related to our business.” Since we sell an SEO toolset, we could easily file that under the category of “Interest.”

You can do all of this in Google Sheets. 

Using Google Sheets to record important data from persona research.Using Google Sheets to record important data from persona research.

An alternative method of marking up the transcript is to follow the Five Rings of Buying Insights.

5. Create your buyer persona(s) by segmenting your data

Finally, you’d want to segment your data into different audiences. 

Here are some ways you can segment your audience, courtesy of Adrienne Barnes:

  1. The “jobs to be done” your customers bought your product for
  2. Pain points
  3. Usage
  4. Company size
  5. Industry

Sometimes there are clearly two different people you can see popping out of your data. Sometimes, there’s clearly just one “job-to-be-done,” so you only have one persona. How you segment and how many segments you should create depends entirely on your business and customers. There’s no perfect way to go about it. 

Once you’ve identified your segments, transfer them into a document(s) with all the relevant qualitative data. 

How to use your buyer persona in your marketing

The goal of creating your buyer persona is to use them in your marketing. Not store them somewhere and forget about them. 

So, here’s how to use buyer personas:

1. Positioning

Positioning consultant April Dunford writes that “positioning is the act of deliberately defining how you are the best at something that a defined market cares a lot about.”

You can use the information you’ve gathered to fix or adjust your positioning with what your customers care about.

2. Creating content for the different stages of the buyer’s journey

To create content for the buyer’s journey, you need to know who the buyer is. And you need to know how they progress through each stage until they purchase your product. 

You now have both pieces of information. 

For example, let’s say we’ve created a buyer persona at Ahrefs. We’ll call him Billy Blogger. And here’s Billy Blogger’s journey:

An example buyer's journey.An example buyer's journey.

In the Awareness stage, Billy is struggling with getting more traffic to his site. So, if we’re creating content for this stage, we’re looking for topics related to:

  • Website traffic
  • Blog traffic

Here’s how we can find topics related to this stage to target:

  1. Go to Ahrefs’ Keywords Explorer
  2. Enter the above terms
  3. Go to the Matching terms report

Since the “Awareness stage” keywords are mostly informational, we’ll switch the toggle to Questions.

Finding keywords in Ahrefs' Keywords Explorer.Finding keywords in Ahrefs' Keywords Explorer.

As you can see, there are over 1,600 potential topics we can target. However, since not all of them will be relevant to us, we’ll eyeball the list and pick out relevant ones. 

We can repeat this step to look for topics for the other stages of the buyer’s journey.

Recommended reading: What Is the Buyer’s Journey? How to Create Content for Every Stage

3. Alignment with sales and product teams

With the information from your buyer interviews, you can help your sales team anticipate buying barriers, create relevant marketing and sales materials, and prepare tools and arguments for moving customers towards purchase.

Likewise, it can also help your product teams create products that customers want and remove friction from how they use your product. 

Here are some frequently asked questions about buyer personas. 

1. How many buyer interviews should I do?

To kickstart your process, aim to conduct at least ten interviews. But bear in mind that buyer interviews are not a “campaign.” Ideally, you should be doing this every month—meeting buyers, interviewing them, getting real-life stories and quotes, and updating your buyer persona document (where necessary). 

2. What questions should I ask in the interview?

There’s no fixed set of questions to ask. Most of it should come spontaneously and naturally since there should be follow-up questions based on what your interviewee says. 

Other than that, you should also be constructing questions based on what you want to know. And this depends heavily on your business, product, customers, and the existing information you have.

However, if you really need a set of questions to ask (or at least use as inspiration), I like this list from Mike Fishbein.

3. Should I include demographics and psychographics in my buyer persona?

In the introduction, I poo-pooed the idea of adding these details to your buyer persona. But they’re not all that bad. 

You can add them if they’re actually useful to your marketing. Although there are plenty of times, especially in B2B and software, where this information is not useful.

Think about it: If you’re selling a martech software, does it matter whether ‘Charlie CMO’ is married? If his partner is the CEO or CFO, it does, but that’s an exceptional circumstance. Usually, it won’t impact your marketing.

However, it is useful if you own a wedding photography business. A married person doesn’t need wedding photography services, so demographic information such as marital status would be helpful to such a business. 

4. Can I do surveys instead of calling my customers?

I know. Picking up the phone or hopping onto Zoom calls can be intimidating. But there’s no substitute for actually talking to someone. 

Plus, surveys have to be designed by someone. And that someone can only design a survey based on their existing knowledge. That means a survey can be subjected to the designer’s unintended bias and therefore fail to discover new or unexpected insights. 

Sidenote.

Interview questions can be subject to the interviewer’s unintended bias too. So make sure that you create open-ended questions and leave them to your interviewee to answer in any way they like. Do not insert your opinion or try to guide them to the answer you want to hear. 

You don’t want to conduct multiple surveys and end up only perpetuating your confirmation bias. 

Instead, use surveys to validate the insights you acquired via your interviews. See if the comments given by your interviewees are one-off or representative of a larger audience set.

5. How many buyer personas should I create?

Adele Revella writes:

The fundamental question isn’t how many buyer personas are required, but rather how many ways do you need to market your solution so that you can persuade buyers that your approach is ideally suited to their needs?

We can achieve this goal only if the way we define our buyer personas makes it easy to know when a different version of our story will result in more business for the company.

Adele RevellaAdele Revella

This is the reason why we’re less concerned with demographics but more with the “job-to-be-done.” When you segment by demographics, it’s tempting to create every variation after the sun—after all, there isn’t just Charlie CMO; there’s also Claire CMO, Chantelle CMO, CMO Chen, and so on. 

However, since they are CMOs, they will have similar “jobs-to-be-done.” And if you find that to be true from your interviews, you can create one buyer persona to target them all. But if you find that some expectations are different, then that’s when you can consider creating another buyer persona. 

If you think that creating another buyer persona can help you market your product better—like what Adele Revella says—then consider investing some resources to conduct additional buyer interviews to “prove” that this persona exists. Surveys can work, too—use them to see if your current findings apply across all segments. 

6. Should you interview the “final decision maker” (e.g., CMO, CFO, CEO)?

In many companies, especially large ones, —the final decision maker is a higher-up. And traditionally, many sales teams are taught to target the final decision maker to sell their products.

In that case, should you take cues from the sales team? Probably not. That is because while the “final decision maker” gives the ok to buy, they may not be involved much in the evaluation process. 

If so, interviewing them (if they’re even available in the first place) will not yield much insight. You’re better off interviewing people who are involved. 

Final thoughts

This post would not have been possible without the work of Adele Revella and Adrienne Barnes. If you’d like to explore more of their work, I recommend:

  1. Reading Adele Revella’s book, Buyer Personas
  2. Listening to this podcast episode, where Adrienne Barnes explains how to create buyer personas

Any questions or comments about creating buyer personas? Let me know on Twitter.

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address

SEO

Google Updating Cryptocurrency Advertising Policy For 2024

Published

on

By

Google Updating Cryptocurrency Advertising Policy For 2024

Google published an announcement of upcoming changes to their cryptocurrency advertising policies and advises advertisers to make themselves aware of the changes and prepare to be in compliance with the new requirements.

The upcoming updates are to Google’s Cryptocurrencies and related products policy for the advertisement of Cryptocurrency Coin Trusts. The changes are set to take effect on January 29th, 2024.

Cryptocurrency Coin Trusts are financial products that enable investors to trade shares in trusts holding substantial amounts of digital currency. These trusts provide investors with equity in cryptocurrencies without having direct ownership. They are also an option for creating a more diversified portfolio.

The policy updates by Google that are coming in 2024 aim to describe the scope and requirements for the advertisement of Cryptocurrency Coin Trusts. Advertisers targeting the United States will be able to promote these products and services as long as they abide by specific policies outlined in the updated requirements and that they also obtain certification from Google.

The updated policy changes are not limited to the United States. They will apply globally to all accounts advertising Cryptocurrency Coin Trusts.

Google’s announcement also reminded advertisers of their obligation for compliance to local laws in the areas where the ads are targeted.

Google’s approach for violations of the new policy will be to first give a warning before imposing an account suspension.

Advertisers that fail to comply with the updated policy will receive a warning at least seven days before a potential account suspension. This time period provides advertisers with an opportunity to fix non-compliance issues and to get back into compliance with the revised guidelines.

Advertisers are encouraged to refer to Google’s documentation on “About restricted financial products certification.”

The deadline for the change in policy is January 29th, 2024. Cryptocurrency Coin Trusts advertisers will need to pay close attention to the updated policies in order to ensure compliance.

Read Google’s announcement:

Updates to Cryptocurrencies and related products policy (December 2023)

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading

SEO

SEO Trends You Can’t Ignore In 2024

Published

on

SEO Trends You Can’t Ignore In 2024

Most SEO trends fade quickly. But some of them stick and deserve your attention.

Let’s explore what those are and how to take advantage of them.

If you give ChatGPT a title and ask it to write a blog post, it will—in seconds.

This is super impressive, but there are a couple of issues:

  • Everyone else using ChatGPT is creating the same content. It’s the same for users of other GPT-powered AI writing tools, too—which is basically all of them.
  • The content is extremely dull. Sure, you can ask ChatGPT to “make it more entertaining,” but it usually overcompensates and hands back a cringe version of the same boring content.

In the words of Gael Breton:

How to take advantage of this SEO trend

Don’t use AI to write entire articles. They’ll be boring as heck. Instead, use it as a creative sparring partner to help you write better content and automate monotonous tasks.

For example, you can ask ChatGPT To write an outline from a working title and a list of keywords (which you can pull from Ahrefs)—and it does a pretty decent job.

Prompt:

Create an outline for a post entitled “[working title]” based on these keywords: [list]

Result:

ChatGPT's outline for a blog post. Pretty good!ChatGPT's outline for a blog post. Pretty good!

When you’ve written your draft, you can ask to polish it in seconds by asking ChatGPT to proofread it.

ChatGPT proofreading my content and making it betterChatGPT proofreading my content and making it better

Then you can automate the boring stuff, like creating more enticing title tags…

ChatGPT writing enticing title tagsChatGPT writing enticing title tags

… and writing a meta description:

ChatGPT writing a meta descriptionChatGPT writing a meta description

If you notice a few months down the line that your content ranks well but hasn’t won the featured snippet, ChatGPT can help with that, too.

For example, Ahrefs tells us we rank in position 3 for “affiliate marketing” but don’t own the snippet.

Ahrefs showing featured snippets that we don't own, despite ranking in the top 3Ahrefs showing featured snippets that we don't own, despite ranking in the top 3

If we check Google, the snippet is a definition. Asking ChatGPT to simplify our definition may solve this problem.

ChatGPT rewriting a definition and making it betterChatGPT rewriting a definition and making it better

In short, there are a near-infinite number of ways to use ChatGPT (and other AI writing tools) to create better content. And all of them buck the trend of asking it to write boring, boilerplate articles from scratch.

Programmatic SEO refers to the creation of keyword-targeted pages in an automatic (or near automatic) way.

Nomadlist’s location pages are a perfect example:

Example of a page from NomadListExample of a page from NomadList

Each page focuses on a specific city and shares the same core information—internet speeds, cost, temperature, etc. All of this information is pulled programmatically from a database and the site gets an estimated 46k monthly search visits in total.

Estimated monthly search traffic to NomadListEstimated monthly search traffic to NomadList

Programmatic SEO is nothing new. It’s been around forever. It’s just the hot thing right now because AI tools like ChatGPT make it easier and more accessible than ever before.

The problem? As John Mueller pointed out on Twitter X, much of it is spam:

How to take advantage of this SEO trend

Don’t use programmatic SEO to publish insane amounts of spam that’ll probably get hit in the next Google update. Use it to scale valuable content that will stand the test of time.

For example, Wise’s currency conversion pages currently get an estimated 31.7M monthly search visits:

Estimated monthly search traffic to Wise's currently conversion pages (insane!)Estimated monthly search traffic to Wise's currently conversion pages (insane!)

This is because the content is actually useful. Each page features an interactive tool showing the live exchange rate for any amount…

The interactive currently conversion tool on Wise's pagesThe interactive currently conversion tool on Wise's pages

… the exchange rate over time…

The exchange rate over time graph on Wise's pagesThe exchange rate over time graph on Wise's pages

… a handy email notification option when the exchange rates exceed a certain amount…

The email notification option on Wise's pagesThe email notification option on Wise's pages

… handy conversion charts for popular amounts…

The handy conversion charts on Wise's pagesThe handy conversion charts on Wise's pages

… and a comparison of the cheapest ways to send money abroad in your chosen currency:

The useful comparison table on Wise's pagesThe useful comparison table on Wise's pages

It doesn’t matter that all of these pages use the same template. The data is exactly what you want to see when you search [currency 1] to [currency 2].

That’s probably why Wise ranks in the top 10 for over 66,000 of these keywords:

Wise's keyword rankings for currency conversion pagesWise's keyword rankings for currency conversion pages

Looking to take advantage of programmatic content in 2024 like Wise? Check out the guide below.

People love ChatGPT because it answers questions fast and succinctly, so it’s no surprise that generative AI is already making its way into search.

For example, if you ask Bing for a definition or how to do something basic, AI will generate an answer on the fly right there in the search results.

Bing's search results for "definition of mental health"Bing's search results for "definition of mental health"
Bing's search results for "how to add drop down list in google sheets"Bing's search results for "how to add drop down list in google sheets"

In other words, thanks to AI, users no longer have to click on a search result for answers to simple questions. It’s like featured snippets on steroids.

This might not be a huge deal right now, but when Google’s version of this (Search Generative Experience) comes out of beta, many websites will see clicks fall off a cliff.

How to take advantage of this SEO trend

Don’t invest too much in topics that generative AI can easily answer. You’ll only lose clicks like crazy to AI in the long run. Instead, start prioritizing topics that AI will struggle to answer.

How do you know which topics it will struggle to answer? Try asking ChatGPT. If it gives a good and concise answer, it’s clearly an easy question.

For example, there are hundreds of searches for how to calculate a percentage in Google Sheets every month in the US:

Estimated monthly search volume for "google sheets percentage formula" via Ahrefs' Keywords ExplorerEstimated monthly search volume for "google sheets percentage formula" via Ahrefs' Keywords Explorer

If you ask ChatGPT for the solution, it gives you a perfect answer in about fifty words.

ChatGPT's answer to the Google Sheets percentage calculation formulaChatGPT's answer to the Google Sheets percentage calculation formula

This is the perfect example of a topic where generative AI will remove the need to click on a search result for many.

That’s probably not going to be the case for a topic like this:

Example of a topic that AI shouldn't impact too muchExample of a topic that AI shouldn't impact too much

Sure. Generative AI might be able to tell you how to create a template—but it can’t make one for you. And even if it can in the future, it will never be a personal finance expert with experience. You’ll always have to click on a search result for a template created by that person.

These are the kinds of topics to prioritize in 2024 and beyond.

Sidenote.

None of this means you should stop targeting “simple” topics altogether. You’ll always be able to get some traffic from them. My point is not to be obsessed with ranking for keywords whose days are numbered. Prioritize topics with long-term value instead.

Bonus: 3 SEO trends to ignore in 2024

Not all SEO trends move the needle. Here are just a few of those trends and why you should ignore them.

People are using voice search more than ever

In 2014, Google revealed that 41% of Americans use voice search daily. According to research by UpCity, that number was up to 50% as of 2022. I haven’t seen any data for 2023 yet, but I’d imagine it’s above 50%.

Why you should ignore this SEO trend

75% of voice search results come from a page ranking in the top 3, and 40.7% come from a featured snippet. If you’re already optimizing for those things, there’s not much more you can do.

People are using visual search for shopping more than ever

In 2022, Insider Intelligence reported that 22% of US adults have shopped with visual search (Google Lens, Bing Visual Search, etc.). That number is up from just 15% in 2021.

Why you should ignore this SEO trend

Much like voice search, there’s no real way to optimize for visual search. Sure, it helps to have good quality product images, optimized filenames and alt text, and product schema markup on your pages—but you should be doing this stuff anyway as it’s been a best practice since forever.

People are using Bing more than ever before

Bing’s Yusuf Mehdi announced in March 2023 that the search engine had surpassed 100M daily active users for the first time ever. This came just one month after the launch of AI-powered Bing.

Why you should ignore this SEO trend

Bing might be more popular than ever, but its market share still only stands at around ~3% according to estimates by Statcounter. Google’s market share stands at roughly 92%, so that’s the one you should be optimizing for.

Plus, it’s often the case that if you rank in Google, you also rank in Bing—so it really doesn’t deserve any focus.

Final thoughts

Keeping your finger on the pulse and taking advantage of trends makes sense, but don’t let them distract you from the boring stuff that’s always worked: find what people are searching for > create content about it > build backlinks > repeat.

Got questions? Ping me on Twitter X.



Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading

SEO

Mozilla VPN Security Risks Discovered

Published

on

By

Mozilla VPN Security Risks Discovered

Mozilla published the results of a recent third-party security audit of its VPN services as part of it’s commitment to user privacy and security. The survey revealed security issues which were presented to Mozilla to be addressed with fixes to ensure user privacy and security.

Many search marketers use VPNs during the course of their business especially when using a Wi-Fi connection in order to protect sensitive data, so the  trustworthiness of a VNP is essential.

Mozilla VPN

A Virtual Private Network (VPN), is a service that hides (encrypts) a user’s Internet traffic so that no third party (like an ISP) can snoop and see what sites a user is visiting.

VPNs also add a layer of security from malicious activities such as session hijacking which can give an attacker full access to the websites a user is visiting.

There is a high expectation from users that the VPN will protect their privacy when they are browsing on the Internet.

Mozilla thus employs the services of a third party to conduct a security audit to make sure their VPN is thoroughly locked down.

Security Risks Discovered

The audit revealed vulnerabilities of medium or higher severity, ranging from Denial of Service (DoS). risks to keychain access leaks (related to encryption) and the lack of access controls.

Cure53, the third party security firm, discovered and addressed several risks. Among the issues were potential VPN leaks to the vulnerability of a rogue extension that disabled the VPN.

The scope of the audit encompassed the following products:

  • Mozilla VPN Qt6 App for macOS
  • Mozilla VPN Qt6 App for Linux
  • Mozilla VPN Qt6 App for Windows
  • Mozilla VPN Qt6 App for iOS
  • Mozilla VPN Qt6 App for Androi

These are the risks identified by the security audit:

  • FVP-03-003: DoS via serialized intent
  • FVP-03-008: Keychain access level leaks WG private key to iCloud
  • VP-03-010: VPN leak via captive portal detection
  • FVP-03-011: Lack of local TCP server access controls
  • FVP-03-012: Rogue extension can disable VPN using mozillavpnnp (High)

The rogue extension issue was rated as high severity. Each risk was subsequently addressed by Mozilla.

Mozilla presented the results of the security audit as part of their commitment to transparency and to maintain the trust and security of their users. Conducting a third party security audit is a best practice for a VPN provider that helps assure that the VPN is trustworthy and reliable.

Read Mozilla’s announcement:
Mozilla VPN Security Audit 2023

Featured Image by Shutterstock/Meilun

Source link

Keep an eye on what we are doing
Be the first to get latest updates and exclusive content straight to your email inbox.
We promise not to spam you. You can unsubscribe at any time.
Invalid email address
Continue Reading

Trending