iOS 27 is now rolling out to compatible iPhones, and with it brings plenty of new and improved features.

While iOS 27 can be downloaded onto the 2019 iPhone 11 and newer, devices that support Apple Intelligence will benefit from improved photo editing tools. These tools include Clean Up, Extend and Reframe, all of which are powered by AI.

If you’re fed up with taking photos and realising there are unwanted objects in shot, or you’ve found the framing is all wrong, then these tools promise to help make a difference. 

We explain where you can access the Apple Intelligence-powered photo editing tools and how to apply them to your shots here. For more on iOS 27, visit our guide on how to adjust Liquid Glass transparency and get notified when a website changes too.

Time for an upgrade? Our round-up of the best iPhones have you covered.

Advertisement

Apple Intelligence Compatible iPhones

Although iOS 27 is supported by iPhone 11 and newer models, the photo editing features are only available on devices that support Apple Intelligence. These handsets are:

The upcoming iPhone Duo, iPhone 18 Pro and iPhone 18 Pro Max will also support Apple Intelligence too.

Advertisement

All of Apple’s photo editing tools are built directly into the Photos app. Simply open the app and find the picture you want to edit. From the image, tap the icon with three horizontal sliders at the bottom of the screen. Then, tap the Tools icon.

Clean Up

Clean Up removes unwanted objects, people and even animals from a photo – leaving an accurate background fill in its place.

Advertisement

Once you’ve opened Tools on your image, tap Clean Up. From here, you can choose how powerful the Clean Up tool is: Auto, Fast or High Quality. Naturally, the High Quality option will typically generate better results than the Fast iteration.

When you’ve chosen your desired level of Clean Up, tap, brush or circle around the object that you want to remove. However, some items may be highlighted automatically for you to quickly remove them with just a tap.

If you’re using the High Quality processing, then you’ll be prompted to click on a yellow Clean Up button to start the removal process.

Advertisement

Finally, tap the yellow tick in the top right corner. 

Advertisement

Extend

Extend enables you to expand the edges of your photo. 

Find your image within the Photos app, then tap the Settings icon and select Tools. Tap Extend, and here you’ll be able to zoom out, reposition the subject and adjust the crop. When you’re happy, tap the yellow Extend icon.

Reframe

The Reframe tool is surprisingly clever, and allows you to change the point of capture even after you’ve taken the photo.

Open Reframe for your image, and you’ll be prompted to touch and drag to adjust the perspective. You can also use two fingers to pan, zoom and rotate the shot – though be warned, there may be limitations to how far you can push it.

Advertisement

Advertisement

Tap Reframe, and then you’ll be able to see how the altered photo compares to the original. If you’re happy, tap the yellow tick in the top right corner.

Apple had a busy night at the Emmys. At the 78th Primetime Emmy Awards, Apple TV scored a staggering 29 wins and, in the process, set a few records, riding atop the momentum of a ridiculous 89 nominations. But it was not only the hit TV shows and their stars hogging the limelight on the red carpet. Apple’s new CEO, John Ternus, was also working his charm at the star-studded event while getting plenty of celeb attention on Apple’s first foldable phone, the iPhone Duo.

A video of Ternus showing off the Duo to a hyped Deadline reporter went viral on social media from the Emmys red carpet, but it seems there was more A-list interest from Hollywood’s heavy-hitters, too. “We hear that stars were hitting him up for the phone privately in LA even before the awards at the Peacock Theater,” says a report from PageSix, noting that some of these famous personalities “brazenly hit him up” for the sleek foldable phone ahead of its wide release in October.

Bose’s original Ultra Open Earbuds were released more than two years ago and sparked the proliferation of a new style of open earbuds that resemble clip-on earrings. I’d been waiting for the Ultra Open Earbuds (2nd Gen) to arrive, and now they’re finally here, with improved sound, voice-calling performance and battery life, Bose says.

While the updated buds carry the same elevated $299 list price as their predecessor, the company has also unveiled its completely new Sport Open Earbuds that cost $199 and have a different design than the original Ultra Open Earbuds. Both new buds are available for preorder Sept. 19 and ship Oct. 1.

Read more: Best Clip-On Earbuds of 2026

Bose Ultra Open Earbuds (2nd Gen) highlights

According to Bose, the Ultra Open Earbuds (2nd Gen) feature new drivers, allowing them to play louder and deliver deeper bass. Like Bose’s QuietComfort Ultra Earbuds (2nd Gen), as well as its QuietComfort Ultra Headphones (2nd Gen) and QuietComfort Headphones (2nd Gen), they’re also equipped with the company’s TrueSpatial technology with head-tracking for Immersive Audio, which now includes a Cinema mode. They look very similar to the original, with a slightly upgraded version of the original’s “cuff-clip form factor” that a lot of other people found quite comfortable.

Bose

Available in black, white smoke and “limited-edition” cherry chocolate or olive green colors, they have an IPX4 rating (splash-resistant) and are rated for up to 9 hours of battery life (that’s up from 7 hours), though that number drops if you engage Immersive Audio.

Thanks to their secure fit and open design, the Ultra Open Earbuds worked well for running and biking, and the new version is also suitable for sporting activities, though Bose is billing the lighter Sport Open Earbuds as more durable and “purpose-built for active use,” with an even more secure fit.

Bose Sport Open Earbuds highlights

The Sport Open Earbuds look similar to Shokz OpenDots 2 earbuds, which also sell for $199. Bose says they “combine a secure cuff-style fit with soft silicone construction, IP54 sweat, splash and dust resistance, tactile controls and rich open audio, all while keeping listeners naturally aware of their surroundings.”

The Sport Open Earbuds don’t support Bose’s Immersive Audio feature and are rated for up to 7 hours of battery life. They’re available in three colors: black, white smoke and “limited-edition” eucalyptus green (that same color is available for Bose’s recently released QuietComfort (2nd Gen) headphones).

My quick take

I haven’t tried the new buds yet, but I’ll be receiving review samples in advance of their Oct. 1 ship date and will post full hands-on reviews of them.

A lot has changed in the clip-on earbuds market since Bose first released the Ultra Open Earbuds in February 2024, with dozens of new clip-on models available, many of them at far lower prices than $300. While I suspect the Ultra Open Earbuds (2nd Gen) will be among the best-sounding open earbuds and certainly a good premium option in the category, I also think we’ll see these buds on sale fairly frequently; $300 just seems too high to pay for a pair of clip-on earbuds. (Apple’s new AirPods 5 don’t fit as securely as either of these open buds, but they do feature active noise canceling and start at $129.)

As for the Sport Open Earbuds, I’ll see how they compare to the Shokz OpenDots 2, Anker Aero Clip 2 and Baseus’ XC1 clip-on earbuds ($100), which feature Sound by Bose. Like the Ultra Open Earbuds (2nd Gen), I also expect the Sport Open Buds to see regular discounts to compete with all the new premium sport clip-on buds hitting the market, many of which feature improved sound and voice-calling performance.

David Carnoy

Executive Editor / Reviews

Executive Editor David Carnoy has been a leading member of CNET’s Reviews team since 2000. He covers the gamut of gadgets and is a notable reviewer of mobile accessories and portable audio products, including headphones and speakers. He’s also an e-reader and e-publishing expert as well as the author of the novels Knife Music, The Big Exit and Lucidity. All the titles are available as Kindle, iBooks, Kobo e-books and audiobooks.

See full bio

Mozilla has partnered with Mistral AI to bring the French company’s models to Smart Window, the AI browsing assistant in beta in Firefox.

The two companies announced the deal on Wednesday in a joint post, alongside the feature’s launch in France.

Smart Window, introduced by Mozilla in August, is a separate AI-assisted browsing mode. It summarises complex searches with sources, helps users find pages they clicked away from, and draws on the tabs they have open.

The two companies describe the arrangement slightly differently. Mistral’s post says Smart Window “is now powered by Mistral models”, while Mozilla’s own announcement says it is adding Mistral Small 4 as one option, and that users can still pick from a range of other models.

Smart Window was already available in English in the US and Canada, and France is its first new market, with official French-language support. Mistral said the UK and Germany are expected to follow later this year.

Mozilla said it chose Mistral Small 4 partly for its multilingual performance, and Mistral said it is fine-tuning models on regional languages and dialects.

Privacy is central to the pitch. Smart Window conversations are not saved on Mozilla’s servers by default, and model partners including Mistral agree to zero data retention, according to the announcement.

Mozilla chief executive Anthony Enzor-DeMeo cast the deal as a stand against AI gatekeepers.

“AI is becoming part of how people experience the web every day. We want to make sure that doesn’t mean people are chained to one company’s self-serving pipeline,” he said. “A browser shouldn’t be a one-way funnel.”

Arthur Mensch, Mistral’s co-founder and chief executive, called it a partnership between “two open source advocates” that brings “privacy, control and choice to AI-powered web browsing.”

For Mistral, which mostly sells to businesses and governments, the deal is a route to consumers, and it comes days after the company raised €3bn at a €21bn valuation. Mistral said the partnership lets it reach beyond enterprise customers to users worldwide.

For Mozilla, it is part of a careful push into AI. Firefox users objected to earlier AI plans, and in February the company added a single setting that blocks all of the browser’s generative AI features. Smart Window stays optional, and users can control which tabs and history it can see.

Brevo confirmed that attackers stole a Cloudflare API key and used it to inject malicious ClickFix scripts into its websites and JavaScript files embedded on customer sites to distribute malware.

The customer relationship management and digital marketing company says the attackers used the API key to create a malicious Cloudflare Worker that modified content at the CDN edge for approximately five and a half hours on September 14.

The attack affected pages on brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com, and sibforms.com. The Cloudflare worker also modified the Brevo forms script, Brevo Conversations widget, and the Brevo SDK loader scripts that customers embed on their websites.

In a post-mortem published today, Brevo explained that attackers obtained a long-lived Cloudflare API key with full account permissions that had been hardcoded in application source code, which allowed them to create Cloudflare Workers, routes, and DNS records across Brevo’s zones without triggering an alert.

“Because the Worker rewrote responses at the edge and removed security headers such as Content-Security-Policy, our origin servers and files remained unmodified and standard integrity checks did not detect the change,” explained Brevo.

The company says the key may have been compromised as early as late August, but there’s no evidence of prior malicious activity.

Upon detecting the compromise, Brevo removed the Worker and its routes, defining the exposure window as between 16:07 and 20:30 UTC.

In the hours that followed, the company revoked the compromised key and credentials created with it, removed the hardcoded credential from its source code, deleted attacker-controlled hostnames, and purged its edge caches.

Brevo says app.brevo.com, its API, email delivery infrastructure, and customer account data were not affected.

Used in ClickFix attacks

The incident was first reported by security firm Sansec, which reported that it may have impacted up to 100,000 websites that use the affected Brevo components.

Sansec says the incident began on September 14, 2026, between 16:05 and 20:13 UTC, but has now confirmed that all malicious subdomains stopped resolving on September 15, and Brevo files are now clean.

Visitors to these websites were shown a fake Cloudflare verification page, followed by ClickFix instructions urging them to run a command on Windows.

On WordPress websites embedding an affected Brevo widget, the script also checked whether the visitor was logged in as an administrator and attempted to upload a malicious plugin from https://cdn10.sendibt1[.]com/p/wm.zip.

While SanSec was not able to retrieve the archive, BleepingComputer found it uploaded to VirusTotal and can confirm it pretends to be a WordPress plugin named “Web Media Optimizer” but acts as a persistent backdoor and JavaScript loader.

Other domains BleepingComputer saw distributing the malicious WordPress plugin and scripts include https://yelahaye[.]surf and https://boiseno[.]club.

Once installed, it hides itself from the WordPress plugin list, copies itself into the must-use plugins directory for persistence, and periodically contacts the attacker-controlled ‘https://glegchner.com/ads.php’ server.

That URL is currently returning a Base64-encoded URL pointing to JavaScript that the plugin then injects into visitors’ pages. The current Base64-encoded URL decodes to https://corralos[.]beer/a412dkoq.js, which the site injects to fetch a ClickFix lure to display.

The plugin also stores a backup copy of the last valid JavaScript URL so it can continue loading malicious code if the remote server becomes unavailable.

Finally, the plugin contains a hardcoded authentication key that allows attackers to generate a valid login session for a WordPress administrator account without knowing the account password. 

On September 10, Brevo disclosed a different SSO-related incident where attackers hijacked customer accounts and launched phishing attacks targeting customers of companies using Brevo.

One high-profile victim was cryptocurrency wallet vendor Trezor, which reported on September 11 that phishing attacks reached 347,000 user email addresses and successfully compromised at least 2,500.

Brevo did not respond to BleepingComputer’s questions as to whether the SSO incident and the Cloudflare compromise were connected.

WordPress administrators who visited an affected site while logged in on September 14 should check for unusual plugins installed or activated that day and remove them. If found, they should also rotate administrator passwords.

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat

KRAFTON India has rolled out the BGMI 4.6 update with several new experiences for players. The latest season brings the new Midnight Hunters theme mode, the return of Ocean Odyssey, and the India-first character Kiaraa. It also adds a One Punch Man collaboration, festive content, creator-focused features, and new WOW experiences. Here’s a look at the major additions coming to BGMI 4.6 and their release dates.

Midnight Hunters Brings a Vampire Twist to BGMI

BGMI 4.6 introduces Midnight Hunters as its main themed gameplay experience. The mode will remain available on Erangel from September 16 to November 16. Four locations, including Rozhok, Mylta, Quarry, and Gatka, become Vampire Takeover points. Stalber and Sosnovka Military Base now house the Nightkeeper’s Hunter Guild. The indoor arena hides secrets and offers new combat challenges. Squads can take on Guild Missions to complete special objectives and earn better rewards. Players can also explore the Hunter Shooting Range, Clock Tower, and Scream Crates. Bloodwalkers, Nightbats, the Vampire Elder, and the Nightkeeper add new threats.

The mode also changes what happens after a player gets eliminated. Bloodline Awakening allows eliminated players to return as Vampires. The game can have up to 20 active Vampires at once. These Vampires can use Claw Strike, Absorb, Blood Sense, and Blood Amberfication. Midnight Hunters also introduces several themed items. The Silvermoon Chain helps with combat, movement, and defense. Twilight Bat Wings support flight and enemy detection. Scarlet Tonic speeds up recovery, while Blood Pact connects teammates through persistent links.

Ocean Odyssey Returns, While Kiaraa Brings an India-First Experience

Ocean Odyssey is returning to Erangel on September 30 after continued requests from the BGMI community. The experience brings back the Ocean Palace, Trident, and Kraken. Players can once again explore the underwater world and enjoy its unique gameplay. While Midnight Hunters focuses on vampires, Ocean Odyssey takes players back beneath Erangel’s waters.

BGMI 4.6 also introduces Kiaraa, a new original character developed by KRAFTON India’s in-house art team for Indian players. Kiaraa follows Anamika, BGMI’s first original character IP created in India. She arrives in the game on October 8 with a new Diwali-themed Indian Bazaar on Erangel. Players can activate four peacock-shaped lamps to awaken Kiaraa and enter her Boss Battle. The season also includes Kiaraa Arena challenges, the Kiaraa Exchange Center, and daily login rewards. The Kiaraa Nakshatra Collection includes:

• Divine Peacock Glider
• Divine Radiance SCAR-L
• Divine Chariot Buggy
• Arrow Rain Emote
• Divine Edge Machete

One Punch Man, Techno Gamerz, and More Arrive in BGMI 4.6

The new BGMI season is also bringing several collaborations to the game. One Punch Man arrives on September 21 through a Spin and Mini Royale Pass. Players can collect character skins, themed sets, and other collaboration items. The Lincoln Motor Cruize runs from September 16 to November 9. It adds the Lincoln Model L and Lincoln Navigator Black Label, with multiple color options. Meanwhile, the B.DUCK collaboration introduces battles on floating platforms. Players can turn into B.DUCK and compete in turn-based collision matches. The goal is to knock opponents into the water as the play area shrinks.

Creator content also gets a major addition with the Techno Gamerz collaboration. It goes live on October 20 with a Techno Gamerz Voice experience, Sunken Templar collection, and themed weapons. BGMI will also mark Diwali with its first India-specific Prize Path. It runs from October 22 to November 15 across 20 levels. Rewards include the Royal Enfield Continental GT 650, Royal Enfield Bullet 350, Revel 01 Set, and Diwali Gold Set. The season also includes Navratri and Diwali-themed experiences.

WOW gets a Halloween update for Steal Brainrot, along with Ghost Ship Event Mode and the Brainrot Wand. Its Mobile Editor also receives new tools for creation, gameplay, performance, and customization. WOW has crossed 50,000 created maps, with more than 35,000 live maps. Over 23 million players have tried WOW, and nearly one million play it daily. Platinum Soulmeister, Sanguine Sonata, and Umbral Scorpius will arrive on September 25, October 25, and November 1, respectively.

Amazon still sells an 8-inch tablet you can toss in a backpack or a carry-on and not treat like jewelry. Fire HD 8 in its 12th-generation line, priced at $84.99 (was $130), updated again in 2024, keeps the same 7.94 by 5.40 by 0.37-inch polycarbonate body and 11.88-ounce weight that made earlier versions easy to forget until you needed a screen. Black, Emerald, and Hibiscus covers have a light texture that hides smudges. USB-C sits on the edge next to a 3.5mm headphone jack that most newer tablets have already abandoned, plus a microSD slot that accepts cards up to 1TB, while dual speakers fire from the bottom in landscape.

An IPS LCD with a resolution of 1280 by 800 provides eight inches of screen real estate and a reasonable 189 pixels per inch. It’s ideal for indoor viewing of movies, comics, and Kindle pages from a tray table. Still, the moderate resolution helps the battery survive a little longer. Amazon claims up to 13 hours of mixed use, but lab testing indicate it’s more like 10 hours of video or 9.5 hours of streaming; either way, that’s a full travel day and then some. The included charger is a wimpy 5W USB-C brick that takes approximately 5 hours to fully charge. Fortunately, a 15W charger, which you probably already own, reduces that time to roughly 2.5 hours.

Sale

Amazon Fire HD 8 tablet (newest model), 8” HD Display, 4GB memory, 64GB, responsive and vibrant…

• Fire HD 8 offers an 8″ HD display for seamless streaming and gaming, coupled with a 5MP rear facing camera for photos—with a thin, light, durable…
• Fast and responsive with long battery life – With up to 4 GB RAM (2X more than 2022 release), 64GB of storage, and up to 1 TB of expandable storage…
• Save time, get creative – Enjoy three smart tools to help you send polished emails, quickly summarize webpages, and create unique wallpapers.

The processor, MediaTek’s MT8169A hexa-core microprocessor with a top speed of 2.0GHz, remains unchanged from last year, but the quantity of RAM has altered. The base 32GB devices now have 3GB of RAM, up from 2GB, while the 64GB variant has 4GB. As long as you’re not attempting to do too much, like as playing a hefty 3D game or running many apps at the same time, the gadget runs fairly smoothly. After the OS has taken its chunk, you’ll have around 25GB of storage on the 32GB device and 54GB on the 64GB model. Which is why the extra $30 for the 64GB model appears to be a very decent deal if you intend to save a lot of movies on it.

The software layer is still Fire OS 8, which is built on Android 11. Amazon promises to provide at least four years of upgrades after launch, which is reassuring. As expected, Prime Video, Kindle, and Audible all function normally, and the hands-free Alexa remains as useful as ever. The appstore is, as usual, Amazon’s, and if you want to access the Google Play store, you must sideload it (instruction above). The cameras may as well be honest: a 5 megapixel rear shooter that can only produce 1080p video and a 2 megapixel front camera that is just good enough for a quick video call. Parental controls and a child profile are offered as usual, however.

Both a proxy and a VPN can change the public IP address a website sees when your traffic is routed through them. The bigger difference is that a VPN adds its own encrypted tunnel for traffic sent through the VPN, while a proxy is primarily an intermediary for selected traffic and does not by itself provide the same tunnel protection.

Proxy vs VPN at a Glance

The easiest way to compare a proxy and a virtual private network (VPN) is to separate three questions: where your traffic goes, what encrypts it, and which traffic is covered. The table shows the typical differences without assuming that every proxy or VPN uses the same configuration.

Proxy vs VPN comparison

There is no universal winner in every row. A VPN provides a tunnel-encryption layer that a conventional proxy does not, while a proxy can be the more direct tool when only one application or workflow needs different routing.

What a Proxy Actually Does

A proxy server sits between a client and another server. Instead of connecting directly to a website or service, your application sends selected traffic to the proxy, and the proxy makes the onward connection.

A simple path looks like this:

Application → proxy → destination

The destination normally receives the connection from the proxy rather than directly from the client. This is why a forward proxy can change the public source IP visible to a website for traffic that actually passes through it.

That does not mean traffic passing through a proxy is necessarily unencrypted. HTTP defines the CONNECT method for establishing a tunnel through a proxy. RFC 9110 explains that a CONNECT tunnel can carry a virtual connection that is then secured with Transport Layer Security (TLS).

For example, when a browser opens an HTTPS website through an HTTP proxy, it can establish a CONNECT tunnel through the proxy and then negotiate TLS with the website. The proxy supplies the route, while HTTPS supplies application-level encryption for that browser-to-website connection.

A proxy can also perform jobs that have little to do with personal privacy, including filtering requests, caching eligible responses, enforcing network policy, or routing one application differently from another.

What a VPN Actually Does

A VPN creates a protected network path between a VPN client and a VPN endpoint. Traffic selected for that route is encapsulated and protected according to the VPN protocol before it crosses the network between those endpoints.

A simplified path is:

Device or selected traffic → encrypted VPN tunnel → VPN endpoint → destination

Internet Protocol Security (IPsec) is one family of technologies used to build VPNs. RFC 4301 defines the IPsec security architecture, which supports security services at the IP layer through protocols, algorithms, keys, and policies selected for a particular deployment.

The important boundary is the VPN endpoint. The VPN tunnel protects the path between the client and that endpoint. After traffic leaves the VPN endpoint toward its final destination, protection for that part of the connection depends on other protocols. HTTPS, for example, can continue protecting a browser-to-website session independently of the VPN.

A VPN therefore does not replace HTTPS. The two protections operate across different boundaries.

How Traffic Flows Through Each

The routing difference becomes easier to understand when both paths are placed side by side.

With a proxy

An application sends traffic to the proxy because that application, operating system, or network has been configured to use it. Other applications can continue connecting normally if they are not covered by the same proxy configuration.

For example, a browser can use a proxy while another desktop application continues over the normal network route. The actual behavior depends on the application and system settings.

With a VPN

A VPN often affects routing at a broader network level. Traffic selected by the VPN routing policy enters the tunnel before reaching the VPN endpoint.

That still does not mean every VPN configuration carries every packet. Microsoft distinguishes split-tunnel and force-tunnel VPN routing. With split tunneling, specified routes use the VPN while other traffic uses the physical interface. Force tunneling instead makes the VPN the default path, subject to more-specific routing rules.

Which One Changes Your IP?

Both can change the public IP address that a destination sees.

If a browser connects through a forward proxy, the website normally receives its connection from the proxy endpoint rather than directly from the browser’s original network. If internet traffic goes through a VPN, destinations normally receive their connection from the VPN endpoint instead.

The important qualification is which traffic uses that route. If one application bypasses a proxy, its connection does not gain the proxy’s exit IP. Likewise, traffic excluded from a split-tunnel VPN continues over its non-VPN route.

Changing the visible source IP also does not erase other identifiers. Signing in to an account, keeping the same cookies, or exposing recognizable browser and application signals can still let a destination associate activity with you.

Which One Encrypts Your Traffic?

A VPN is specifically designed to create a protected tunnel between the VPN client and endpoint for traffic routed through that connection. A proxy is primarily a forwarding mechanism, so proxy use alone should not be treated as equivalent to VPN tunnel encryption.

Proxy routing and HTTPS encryption are different

Suppose you visit an HTTPS website through an HTTP proxy. The proxy can establish the route, while TLS protects the browser-to-website connection through that route. RFC 9110 explicitly describes CONNECT tunnels as virtual connections that can then be secured using TLS.

The accurate distinction is therefore not simply “proxies do not encrypt.” A conventional proxy does not inherently add the same client-to-VPN-endpoint encryption layer that a VPN tunnel provides.

VPN encryption has an endpoint too

VPN encryption also has a boundary. It protects traffic across the VPN tunnel between the client and VPN endpoint. Beyond that endpoint, the final application connection relies on its own protocols.

If a website uses HTTPS, that HTTPS connection can continue from the browser to the website while the traffic also travels inside a VPN tunnel for part of its route. The two protection layers can exist at the same time.

Because VPN and HTTPS protect different parts of a connection, using one does not make the other redundant.

What Can Your ISP, Wi-Fi Network and Websites See?

Different observers sit at different points in the route, so “who can see my traffic?” has no single answer.

Your local Wi-Fi network

For traffic routed through a properly functioning VPN tunnel, the local network sees communication with the VPN endpoint and connection metadata such as timing and data volume, while the application traffic inside the tunnel is encrypted.

A VPN can therefore be one layer of staying safe on public Wi-Fi, alongside verifying the network, keeping devices updated, using HTTPS, and protecting accounts. A VPN does not prevent phishing, remove malware already on a device, or prove that a hotspot is legitimate.

Your internet service provider

For tunneled VPN traffic, the internet service provider (ISP) can see the connection to the VPN endpoint but cannot inspect the application contents inside the encrypted tunnel in the same way it could inspect unencrypted direct traffic. Metadata and name-resolution behavior still depend on the configuration.

With a conventional proxy, ISP visibility depends more heavily on where the proxy sits, how the application connects to it, and whether the underlying application connection is protected by a protocol such as HTTPS.

The website you visit

A website can see the proxy or VPN exit address for traffic delivered through that intermediary. It can also see information you intentionally provide, including account details, and can use cookies or other browser signals to recognize sessions.

This is why changing an IP address and becoming anonymous are not the same thing.

DNS queries

The Domain Name System (DNS) converts names such as example.com into network addresses. DNS routing can differ from ordinary application traffic, especially when a VPN uses split routing.

RFC 8598 documents split-DNS behavior for IKEv2 VPNs, where selected domains can use DNS servers reachable through the VPN while other queries continue through the client’s normal DNS service. It also describes configurations that send DNS through the IPsec connection.

A blanket statement such as “a VPN always sends every DNS query through the tunnel” is therefore too broad.

Coverage: One App vs More of the Device

Proxies are often useful when only one application or traffic type needs a different route. VPNs are commonly used when broader network traffic should travel through a protected tunnel.

Microsoft’s Windows VPN documentation makes this distinction explicit: a split-tunnel configuration sends specified routes over the VPN and leaves other traffic on the physical interface, while force tunneling makes the VPN the default route unless a more-specific route says otherwise.

Windows also supports application-triggered and application-specific VPN configuration, which is another reason “proxy equals one app, VPN equals every app” is too simplistic. The useful distinction is that proxies are commonly used for selective application or protocol forwarding, while VPN technology provides network-level tunneling whose actual scope is controlled by routing policy.

The mechanics of split tunneling matter whenever you need to know which traffic is actually protected by the VPN route.

Proxy vs VPN for Common Situations

Using public Wi-Fi

A VPN can add an encrypted tunnel between your device and VPN endpoint across an untrusted local network. HTTPS still matters because it independently protects individual website connections beyond the VPN endpoint.

A proxy can change the route and destination-facing IP for configured traffic, but proxying alone should not be treated as a replacement for VPN tunnel protection when that tunnel is the security requirement.

Routing one browser or application

A proxy can be more direct when only one browser, application, or protocol needs a different network path. There may be no useful reason to change the routing of unrelated device traffic when the task is narrowly scoped.

Remote access to an organization

A VPN is designed for cases where an authenticated client needs protected network access to remote resources. Enterprise deployments can use force-tunnel, split-tunnel, or more granular application-specific policies depending on the environment.

Testing a website from another network path

A proxy can be practical for authorized quality assurance, location testing, or application-level routing when VPN tunnel protection for the rest of the device is unnecessary.

Trying to become anonymous

Neither tool is sufficient by itself. Both introduce an intermediary into the network path, while accounts, cookies, browser characteristics, application identifiers, and the intermediary operator can still matter.

A comparison of proxy, VPN, and Tor needs to separate routing, encryption, relay structure, trust, and anonymity rather than treating all three as interchangeable IP-masking tools.

Understanding what a VPN actually protects also helps separate connection privacy from device security and anonymity.

If a VPN is the appropriate technology, deciding between a free vs paid VPN is a separate question involving provider trust, usage limits, server access, device allowances, and features.

Bottom Line

Both a proxy and a VPN can change the public IP address seen by a destination for traffic routed through them. A VPN additionally provides a protected tunnel between the client and VPN endpoint for covered traffic, while a proxy is primarily a forwarding intermediary and can still carry separately encrypted traffic such as HTTPS.

Neither technology guarantees anonymity, and neither should be described without checking which traffic actually uses it. The right choice depends on whether you need selective routing, tunnel encryption, broader network coverage, or a specific combination of those functions.

Spotify spent most of its existence convincing listeners that music did not really require a screen. After building the largest paid audio-streaming service in the world, the company now appears rather interested in your eyeballs as well.

All 58 of Taylor Swift’s official music videos are now available to Spotify Premium subscribers in markets where its music-video beta is offered, stretching from “Tim McGraw” through 2026’s “Opalite.” Videos can be watched on Spotify’s TV, desktop, iOS and Android apps, giving one of the largest fanbases in popular music another reason to stay inside Spotify rather than opening YouTube. 

The implementation is more important than simply dumping videos into another menu. Start playing a supported song, tap “Switch to video,” and the video begins at the same point; switch back to audio and the song continues without restarting. It is hardly revolutionary; YouTube Music introduced essentially the same concept seven years ago, but convenience has always been Spotify’s sharpest weapon.

Related Reading:

Spotify Did Not Invent Music Videos on a Streaming Service

Before anyone starts carving Daniel Ek’s face into Mount Rushmore, Spotify is rather late to this particular party.

Apple Music already offers music videos, curated video playlists, live performances and the 24-hour Apple Music TV channel. TIDAL says its video section includes more than 650,000 music videos and other visual programming including concerts, documentaries and original shows. 

Then there is YouTube Music, which added seamless switching between songs and corresponding music videos back in 2019. At the time, Google said it had already time-matched more than five million official videos with their audio tracks. 

Spotify’s advantage is therefore not invention. It is scale, personalization and the opportunity to make video feel like an extension of what hundreds of millions of people are already doing inside the app.

Why Taylor Swift Matters

Spotify began testing music videos in 2024 and expanded the beta to Premium subscribers in the U.S. and Canada in late 2025. It has since added Videos for You, a personalized playlist refreshed daily with music videos, live performances and covers tailored to the listener. 

Taylor Swift gives Spotify a rather more visible demonstration than another obscure beta button. Her videos have long functioned as extensions of her albums and eras, and Spotify now has the complete official catalog available without forcing fans to leave the service. Or drop $9,000 on concert tickets.

The potential engagement is enormous. Spotify reported 300 million Premium subscribers and 777 million monthly active users for Q2 2026, and said at its May Investor Day that more than two-thirds of Premium subscribers had already watched music videos on Spotify. 

That last number is probably the one YouTube should circle.

Spotify Is Becoming a Lot More Than a Music App

The Swift rollout makes considerably more sense when viewed alongside what Spotify has been doing elsewhere.

After years of dangling Spotify HiFi in front of audiophiles like a carrot attached to a fishing pole, the company finally rolled out Lossless playback at up to 24-bit/44.1kHz FLAC for Premium users in 2025. Spotify has also expanded audiobooks to more than 700,000 titles across 22 markets, turning books into a substantial part of the platform rather than an interesting tab most people forget exists. 

The company is also becoming more interactive. Talk to Spotify, currently rolling out in beta to eligible Premium users, lets listeners speak or type conversational requests about music, podcasts, audiobooks and their own listening history. Spotify increasingly wants you asking it what to play rather than deciding that Google or ChatGPT should answer first. 

Then there is Reserved by Spotify, launched with Live Nation and powered by Ticketmaster. Spotify identifies some of an artist’s most engaged Premium listeners using signals such as streams, saves and shares, and can hold two concert tickets for them to purchase before the general sale. Spotify is no longer satisfied with knowing that you listen to an artist; it would also like to participate in getting you through the venue door. 

Video is following the same strategy. Spotify has already experimented with 48-hour music-video exclusives, allowing fans to watch certain new videos on Spotify before they appear elsewhere. Add personalized videos, video podcasts, lyrics, concert discovery, ticket access and artist pages, and the direction becomes rather difficult to miss. 

Spotify wants the song, the video, the podcast interview, the audiobook, the concert ticket and as much of the relationship between fan and artist as it can reasonably fit inside one green application.

Why Should Listeners Care?

Convenience is the obvious answer. If you are already listening to Taylor Swift, Noah Kahan or another artist on Spotify, moving from the song to the video requires one button instead of leaving the app, finding the correct video on YouTube and starting again.

That becomes more interesting on a television. Spotify can move from being something playing invisibly through a streamer or smart speaker to an actual visual entertainment app, while still letting listeners return to background audio the moment they decide they have had enough choreography.

Spotify’s recommendations are another advantage. The company already knows what listeners play, save, skip, revisit and share, which gives it an enormous behavioral dataset for recommending video without requiring users to build another viewing history from scratch.

Should YouTube Actually Be Worried?

It should pay attention. Panic would be premature.

YouTube still owns an enormous music-video ecosystem Spotify cannot reproduce overnight, including official releases, live performances, fan uploads, interviews, archival footage, covers, reaction videos and almost every other piece of music-related video ever pointed at a camera.

Spotify does not need to replace all of that. It only needs to remove enough reasons for its existing users to leave.

That is where Taylor Swift matters. If somebody already pays Spotify, follows her there, receives recommendations there and can now watch all 58 official videos without opening another service, YouTube loses one small piece of engagement. Repeat that across enough major artists and Spotify starts reclaiming a meaningful amount of attention.

There is also some delicious irony in Spotify borrowing a concept YouTube Music introduced in 2019 and presenting it to an audience of 300 million paying subscribers. Timing has never prevented Spotify from eventually turning somebody else’s table stakes into a very large business.

The Bottom Line

Spotify’s real play here is retention. Taylor Swift is an almost absurdly effective test case because her fans already treat the visual side of her catalog as part of the music itself. If Spotify can make watching the official video as frictionless as hearing the song, one of the most obvious reasons to jump over to another app disappears.

The expanding catalog will inevitably include considerably less essential viewing. Macklemore remains available for anyone who feels their evening is incomplete without a political lecture followed by “Hind’s Hall.” His recent MetLife performance drew objections from the Israeli-American Council, Pink and Robert Kraft — owner of the New England Patriots and Gillette Stadium and founder of the Foundation to Combat Antisemitism, who said Macklemore’s recent actions and what Kraft described as a broader history of antisemitic rhetoric and imagery were deeply offensive to the Jewish community. Macklemore was subsequently dropped from Ed Sheeran’s tour after venues objected to his participation.

That is the bargain Spotify is making as it becomes a larger visual platform: more choice also means more material you may desperately wish had remained unavailable in either format. Fortunately, the skip button remains one of the finest inventions in streaming.

Related Reading: