Filtering and Privacy in Indonesia Are Two Different Problems

Two separate things get discussed in Indonesia as if they were one. The first is content policy: which categories of material providers are required to filter. The second is network security: who can read your traffic while you are on someone else's Wi-Fi. They have different causes and different answers, and mixing them produces bad advice in both directions.

This article is about the second one, because it is the one people can actually do something about.

The Filtering Layer, Briefly

Indonesia operates a category-level filtering programme, publicly documented under the name Internet Positif and implemented by internet providers. It works by category — the classifications the ministry publishes — rather than by individual judgement at the point of use, and it is a matter of policy, not of network security. Nothing in this article changes what is permitted, and no honest product description should suggest that it does.

What a Shared Network Sees

Now the part that is about you. On a hotel network in Yogyakarta, a campus library connection, or the Wi-Fi in a mall food court, your device shares a local segment with strangers. Traffic that is not encrypted end to end is readable by them and by whoever runs the equipment.

HTTPS has fixed most of the worst of this — the contents of a login, a message or a bank session are protected. What HTTPS leaves in the open is the shape of your activity. Every site your device looks up is visible by name. So is how much you sent, how much came back, and when. From a week of that, someone can reconstruct which bank you use, which employer's systems you sign into, which health service you contacted and roughly when you are at your desk. That reconstruction is often more sensitive than any single page you loaded.

What Encryption Covers

A VPN wraps all of it in one encrypted tunnel between your device and a server you pick. The hotel router, the campus access point, the person two tables away: they see one encrypted connection to one address, and nothing else. The site names, the timing and the volumes stop being available to them.

The limits, stated plainly:

• It protects traffic in transit only. A phone with malware on it, a convincing phishing page, or an app designed to collect data will all keep doing exactly what they were doing.
• It does not make you anonymous. Your ISP stops seeing your traffic; the VPN operator's practices take its place. The trust moves. That is why a no-logs policy matters and why it should be verifiable.
• It does not change what is permitted. A VPN is a privacy tool, not a legal one.

Doft VPN

Doft VPN gives you every server location free, with no paywalled regions. It uses current, well-understood cryptography and holds a connection steadily on congested mobile networks, which is what most people actually notice day to day. It keeps no logs of your activity, and connects in one tap on Android and iOS. Premium adds higher speeds and raises the data allowance; the privacy features stay free, because a security tool that only protects the people who pay is not much of a security tool.

Use it for what it is good for: taking the network you are borrowing out of the conversation.