You are right, but only for the perfect 'VPN'. There are also many insecure VPNs out there, which don't cover all your bases (for ex: VPNs that don't tunnel DNS

You are right, but only for the perfect 'VPN'. There are also many insecure VPNs out there, which don't cover all your bases (for ex: VPNs that don't tunnel DNS requests through the VPN is a common mistake) So while there are VPNs with great security, you have to make sure your VPN is not vulnerable to common MITM attacks. So choose your VPN which has been well vetted. I'm a fan of OpenVPN due to it being able to pass as HTTPS traffic, but a popular recommendation is algo which is IKEv2 based IPSec VPN. https://github.com/trailofbits/algo https://github.com/trailofbits/algo