Usenet Security & Privacy

Usenet's privacy advantage isn't a bolt-on feature. It comes from the architecture itself. When you use Usenet, your connection is a direct line between your computer and your provider's server. Nobody else is in the loop.

Compare that to torrents, where your IP address is broadcast to every other user downloading the same file. Or to the web, where every site you visit sees your IP, your browser fingerprint, and often much more. Usenet doesn't work that way. You connect to one server, over an encrypted tunnel, and that's the only connection involved in your download.

No other users ever see your IP. No tracker logs your participation in a swarm. No website drops cookies on your browser. It's a fundamentally simpler model, and that simplicity is what makes it private.

SSL (Secure Sockets Layer (technically TLS these days, but everyone still calls it SSL) encrypts the entire connection between your newsreader and your provider's server. With SSL enabled, your ISP can see that you're connected to a server, but they cannot see what you're downloading, which newsgroups you're in, or anything about the content.

It's the same encryption technology that protects your banking sessions and HTTPS websites. When you connect to NewsDemon on port 563 with SSL enabled, your traffic is wrapped in 256-bit encryption. Even if someone intercepted the data stream, they'd see nothing but noise.

Which Port to Use

Port 563 is the standard for SSL Usenet. If your ISP blocks 563 (some do), port 443 works as an alternative — it's the same port used for HTTPS web traffic, so it's almost never blocked. Port 119 is the traditional unencrypted Usenet port. Don't use it unless you have a specific reason. There's no upside to an unencrypted connection.

NewsDemon was among the first Usenet providers to deploy post-quantum key exchange across all NNTP servers. As of April 2026, every connection to news.newsdemon.com, uswest.newsdemon.com, and eu.newsdemon.com supports the X25519MLKEM768 hybrid scheme.

What X25519MLKEM768 Is

It pairs two algorithms together: X25519, the elliptic-curve key exchange that has been securing internet traffic for years, and ML-KEM 768 (formerly CRYSTALS-Kyber), a lattice-based algorithm selected by NIST in 2024 as the standard for post-quantum key encapsulation. Even if one algorithm were somehow broken, the other still protects your connection.

The "Harvest Now, Decrypt Later" Threat

An adversary captures your encrypted traffic today and stores it. Storage is cheap. Years from now, when quantum computers can break today's encryption, they decrypt everything they collected. This is not theoretical — intelligence agencies and security researchers have been warning about it for years, and some governments are believed to be actively stockpiling encrypted data right now.

Post-quantum key exchange neutralizes this threat. Traffic captured today cannot be decrypted by tomorrow's quantum computers, no matter how powerful they get.

Privacy Beyond Today's Laws

Nobody knows what the legal landscape will look like in five or ten years. Privacy protections that exist today could be weakened, rewritten, or repealed entirely. The strongest defense against legal uncertainty is making sure the data cannot be read in the first place.

What You Need to Do

Probably nothing. If your Usenet client uses OpenSSL 3.5.0 or newer, the post-quantum handshake happens automatically. No configuration changes, no new settings. If your system is on an older OpenSSL version, your connection still works fine — it falls back to standard X25519. There is zero disruption either way.

Verifying the Post-Quantum Handshake

You can confirm post-quantum encryption is active on your connection with this OpenSSL command:

openssl s_client -connect news.newsdemon.com:563 -groups X25519MLKEM768

If the connection succeeds and the output shows X25519MLKEM768 in the key exchange line, you're using post-quantum encryption.

For the full technical details, see our announcement post.

SSL encrypts your Usenet traffic. A VPN encrypts everything. It wraps your entire internet connection in a tunnel before it leaves your device. With a VPN active, your ISP can't even see that you're connecting to a Usenet server. They just see VPN traffic.

Do You Need a VPN if You Already Have SSL?

For most people, SSL alone is enough. Your ISP can see you're connecting to a Usenet server address, but they can't see any of the content, groups, or articles. If that level of privacy is fine with you, you're covered.

A VPN adds value in a few scenarios: if your ISP throttles traffic to known Usenet servers, if you're on a network you don't trust (hotel, airport, public WiFi), or if you simply prefer the belt-and-suspenders approach of hiding even the destination of your connection.

Encryption protects your data in transit. A logging policy determines what happens at the destination. If your provider keeps detailed records of which articles you downloaded and when, encryption becomes less meaningful — that data exists on their servers.

What "No-Logging" Should Mean

A no-logging provider doesn't record which newsgroups you accessed, which articles you downloaded, or the content of your sessions. They may keep basic connection records (when you logged in, how much bandwidth you used) for operational reasons, but nothing that ties your account to specific content.

NewsDemon's Policy

NewsDemon does not monitor, track, or record user activity on its network. Our privacy policy only requires an email address at signup. We maintain a public warrant canary to indicate whether we've received any compelled legal disclosures.

Being independently owned matters here too. Our privacy practices are governed by K&L Technologies, Inc. — a company whose only business is Usenet. No parent corporation with different products, different jurisdictions, or different data appetites.

This is the single biggest practical difference between the two systems, and it's worth spelling out clearly.

Usenet

You ↔ Provider's Server. That's the whole connection. Encrypted with SSL. Your IP is known only to your provider. Nobody else in the world can see what you're doing.

Torrents

You ↔ Dozens/hundreds of other users simultaneously. Your IP address is shared with every peer in the swarm. Anyone, including copyright monitoring firms, can join a swarm, log every IP they see, and send notices to the corresponding ISPs. This is not theoretical; it's how the vast majority of copyright infringement notices are generated.

A VPN mitigates the torrent privacy problem, but adds cost ($5–10/month) and complexity. With Usenet, privacy is built into the model. There's no swarm, no peers, and no IP exposure. For a fuller comparison, see our Usenet vs. Torrents page.

Not all providers handle security the same way. A few things worth checking before you sign up:

SSL on All Plans

Some providers restrict SSL to premium tiers. It should be standard on every plan. If a provider charges extra for encryption, that's a red flag.

Connection Count

More SSL connections means faster encrypted downloads. 50 is a good number — enough to saturate most internet connections. NewsDemon offers 50 on every plan.

Privacy Policy Clarity

Read the privacy policy. Look for clear language about what is and isn't logged. Be wary of vague statements. Check whether the provider has a warrant canary.

Provider Ownership

A provider's privacy practices are ultimately governed by whoever owns the company. If a provider is a subsidiary of a larger corporation, that corporation's legal obligations and data practices apply. Independent ownership means the provider's privacy policy is its own.

Included VPN

Not a requirement, but a nice bonus. If the provider bundles a VPN, you get an extra privacy layer without paying for a separate service.