8 ms·

> If you are using your device on a public network, VPNs can help you protect your data. I have a ProtonVPN subscription myself, just for those instances where

> If you are using your device on a public network, VPNs can help you protect your data. I have a ProtonVPN subscription myself, just for those instances where I am sitting in an airport waiting for my plane Seems like a contradictory message. He just got through telling us how most of the web is now end-to-end encrypted with HTTPS. So why does he need a VPN at the airport? Is he checking his email? I can't imagine that he's using an email service that doesn't use HTTPS. Is he logging into his bank account? I doubt any bank nowadays still uses plain old unencrypted HTTP. Is he watching cat videos on YouTube? Well, even that's encrypted. Remember, his argument is that VPNs don't provide privacy--so that's not the reason. And this is the section where he's talking about public networks, not about other rationales for VPNs like geolocking or ISP blocking. It weakens the argument of his essay to say that he needs a VPN at the airport or cafe.

deleted 8y ago
[deleted]
lifthrasiir 8y ago
He made this point explicit: > Networks like these make it easy for attackers to get a copy of your network data, and if you send something unencrypted, the results can be quite harmful. The web should be ideally end-to-end encrypted with HTTPS. But in case this assumption breaks down, VPN gives an additional headroom for security. Not much (as explained in the article, and thus should not be advertised so), but still useful.
- thinkloop 8y ago
  The VPN only protects the first hop, it would not be a good backup for https.
  - lifthrasiir 8y ago
    Yes, but if the target site does not use https there is no alternative.
  - quickthrower2 8y ago
    It protects the first hop for request data. But response data could be interfered with too.
- iuguy 8y ago
  > The web should be ideally end-to-end encrypted with HTTPS. No. People designing public access networks should use encryption and AP client isolation.
  - baddox 8y ago
    They should, of course. And for when they don’t, a VPN can protect you. That’s what the article is saying.
    - iuguy 8y ago
      I'm responding to OP's comment, not the article.
- dahfizz 8y ago
  The internet is so much bigger than just websites. HTTPS is great but VPNs provide encryption at a much lower level, where it should be. Even when using https you are exposing a lot of unencrypted data because https is an application layer encryption. It's not enough.
sigmar 8y ago
>most of the web is now end-to-end encrypted with HTTPS. So why does he need a VPN at the airport? What percentage of (typically rushed) people at an airport will notice that a website is loading over http instead of https? SSLsplit is pretty useful.
- tedunangst 8y ago
  Does your bank, or whatever, not use hsts?
  - jeltz 8y ago
    Last time I checked, about 2 years ago, none of the Swedish banks used HSTS. And a couple of them used HTTP on their main page and and HTTPS on their internet bank which was put on some weird domain. Chrome's changes has since then forced them to move everything to HTTPS but I would be very surprised if they all use HSTS now.
  - stordoff 8y ago
    My bank doesn't _and_ there's a redirect to a different domain (rbs.co.uk homepage does to personal.rbs.co.uk, rbs.co.uk/englandandwales or the login link goes to rbsdigital.com). Serve a redirect on the non-HTTPS rbs.co.uk to some other plausible domain with a valid HTTPS certificate, and I probably wouldn't notice.
- viraptor 8y ago
  SSL everywhere is also a good workaround for this: https://www.eff.org/https-everywhere https://www.eff.org/https-everywhere
iuguy 8y ago
> So why does he need a VPN at the airport? Because the airport made a shitty choice in designing it's wifi, and people who connect to such networks are making shitty choices. HTTPS is nothing more than a content protocol wrapped in a transport encryption layer used for a subset of your overall traffic. When you connect to an open wifi network your device is literally screaming 1s and 0s into the air like a maniac. A subset of these 1s and 0s are the things you're actively telling the computer to do. Most of this stuff is things like ARP, Name resolution services and other stuff that isn't encrypted for perfectly understandable reasons. Instead, when connecting to an open airport wifi network, a personal decision is made that the connectivity is more important than encryption. Airport wifi connections could and should be encrypted with AP client isolation, but they aren't.
- m0dest 8y ago
  How exactly is the airport supposed to offer a WiFi network that is encrypted and open without breaking usability and compatibility? This hasn't been possible until WPA3, which has barely started rolling out.
  - CKN23-ARIN 8y ago
    Many ways to do this. Make the password widely-known. Announce it over the intercom. Post it on the walls. Offer both encrypted and non-encrypted SSIDs. The non-encrypted SSID could even just be a captive portal with instructions to connect to the encrypted SSID. If you're feeling wild, use WPA2 Enterprise, and accept any credentials.
    - 0xf00d 8y ago
      Doesn't the widely-known password render the encryption useless to anyone that has captured the 4-way handshake at the beginning of your WIFI-session? With the PSK and your session keys an attacker can decrypt your traffic if I remember it correctly.
    - icebraining 8y ago
      "WPA and WPA2 don't provide forward secrecy, meaning that once an adverse person discovers the pre-shared key, they can potentially decrypt all packets encrypted using that PSK transmitted in the future and even past, which could be passively and silently collected by the attacker. This also means an attacker can silently capture and decrypt others' packets if a WPA-protected access point is provided free of charge at a public place, because its password is usually shared to anyone in that place. In other words, WPA only protects from attackers who don't have access to the password." https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Lack_of_forward_secrecy https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Lack_of...
ignoramous 8y ago
I think the whole point is you'd want both IPSec and TLS, and just TLS might not be enough. A good VPN impl provides better protection when you're connecting over public networks you don't trust, for protocols that don't use TLS.
alasdair_ 8y ago
>Seems like a contradictory message. He just got through telling us how most of the web is now end-to-end encrypted with HTTPS. So why does he need a VPN at the airport? Is he checking his email? I can't imagine that he's using an email service that doesn't use HTTPS. Because the Internet is more than the stuff that lives on port 443? What does the author do about UDP packets? It’s interesting that you mention email. SMTP can use TLS of course but I know of plenty of POP3 email providers that still send unencrypted and even if it were, it’s not using HTTPS. What about DNS requests too? Those are still often sent in cleartext. Even with actual HTTPS with a browser, the domain itself is visible. In short - the Internet is not just the web.
- viraptor 8y ago
  That would imply the author cares enough about privacy / security to use VPN to hide for example POP3, but not enough to immediately drop an email provider which uses unencrypted POP3 service. And that's a strange argument.
  - michaelmrose 8y ago
    Probably because a person can more trivially be taught vpn = privacy than understanding ANY of the details and be legitimately better off especially if they are doing other stupid things like using unencrypted pop3 or use the same password at random http site as they use on their bank.
headmelted 8y ago
I can't help but shake my head at this whole argument. For literally years I've been telling people that a VPN run by a third party does not enhance privacy or security, but because the consensus is "VPN = secure" it's a losing battle, and I sound like a tinfoil-hat-wearing loon. Most VPN services are not designed to provide privacy or security, and if you have a subscription to one, that's probably not the reason you bought it either. They're designed to provide the minimal amount of traffic hiding required to allow you to pirate TV/movies/video games without getting in trouble or hitting blocked URLs. And it works, or you wouldn't still have the subscription. Now, as both the buyer and the seller need a non-shady cover story, they describe hiding your suspect downloads as "security and privacy" - it's not utterly inaccurate, but it implies far more than what's happening. The problem with the narrative is that it makes laypeople think they are "more secure" when using a VPN, when in reality, the opposite is true. As an example, when I perform a Google search, my traffic is encrypted over SSL, so my ISP can't see that. My ISP can see the domain name of the result I click, and a VPN would mask that from them. But now a new third party (the VPN provider) can see that instead. This makes sense if you're downloading pirated media (as the VPN service doesn't care), but the buyer is in effect trading: 1) An ISP, which is in most western countries heavily regulated, with legal commitments to auditing and your privacy (just not from law enforcement). for: 2) Some computer somewhere that is run by an utterly unregulated company or individual that may or may not know how to configure OpenVPN correctly and that you don't know anything about, other than they run a shady business based on allowing you to download pirate files on the internet. Also they're not at all regulated or audited, and may not even be in a jurisdiction that requires them to protect your data at all. Given this trade-off, trusting a VPN to do a better job of protected your privacy than an ISP seems like madness to me, given that they could easily sell whatever information they have on you on and there's nothing you can do about it (and you'd likely never find out). It may not even be a crime depending on where they're located. There's arguments for VPN in preference to unsecured Wi-Fi, but in reality, how often is that an issue? How many scenarios are there where you can't use mobile data instead? (And even where/when you can't, you still have all the downsides above which may or may not be better).
- pbhjpbhj 8y ago
  I don't think your analysis is complete. Most VPN's raison d'être is providing privacy. If it's publicly known that they don't then that kills their business. An ISP is tasked with connecting prior to the internet, they don't make claims about privacy, they can reveal information about clients without necessarily putting anyone off, most of the clients for large ISPs have probably never heard of a VPN. If a VPN wanted to they could get audits by pen-testers to warrant their ability to provide secrecy. A VPN provider that's been around a while and claims to offer a high level of privacy probably does. Slight aside: >My ISP can see the domain name of the result I click, and a VPN would mask that from them. // There was a paper a little while ago, they directly identified pages by mitm-ing HTTPS by using meta-data (page size alone IIRC). Success was something like 80%.
pizzazzaro 8y ago
Im actually glad that the author pointed out that once you log in somewhere that will track you, that connection is associated with you. A vpn is not a cure-all. It is only as private as you're willing to make it. If you want to pirate movies and chat on facebook at the same time, you're probably gonna have a bad time. What you do is absolutely a part of your advertising/tracking profile. Payment information - some prefer to use cryptocurrency, which in their minds, is private. Again, once metadata connects you, there's no denying that that's you. A third party consultant takes your payment? Maybe. Especially if you've got some anonymizing layer to your credit card info that has earned a similar trust. This will of course add to the cost of the transaction. Even the way you type can connect you. Sufficient amounts of text - such as this reply - are usually enough.
- tya99 8y ago
  > Im actually glad that the author pointed out that once you log in somewhere that will track you, that connection is associated with you. Exactly, and it's usually a cookie or some sort of persistent storage. I use a VPN, but I use it at the router level. https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi_(IPv6) https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... I know my ISP logs my metadata (by law), whereas I trust that my VPN provider does not. Essentially VLAN2 all traffic is routed direct to my ISP, and VLAN3 all traffic is routed to VPN. My machine normally sits in VLAN3. I make sure not to log into anything social media related or tied to my real identity. If I need to do banking, Facebook or something like that I'll use a device in VLAN2 (a separate computer). All phones and devices like that are broadcasting information anyway so those are in VLAN2 as well, unless they are devices with LineageOS and no Google Apps. > A vpn is not a cure-all. It is only as private as you're willing to make it. If you want to pirate movies and chat on facebook at the same time, you're probably gonna have a bad time. What you do is absolutely a part of your advertising/tracking profile. See in this scenario I would have a system in VLAN3 that I use for my downloading, and another computer in VLAN2 that is used for the facebooking. I use a hardened browser with https://github.com/ghacksuserjs/ghacks-user.js https://github.com/ghacksuserjs/ghacks-user.js that hardens the browser and helps against fingerprinting. I also use a number of addons, for various purposes That requires hardening. Currently I use * CleanURLs https://addons.mozilla.org/addon/clearurls/ https://addons.mozilla.org/addon/clearurls/ (remove UTM and parameter tracking) * CSS Exfil Protection https://addons.mozilla.org/addon/css-exfil-protection/ https://addons.mozilla.org/addon/css-exfil-protection/ * Decentraleyes https://addons.mozilla.org/addon/decentraleyes/ https://addons.mozilla.org/addon/decentraleyes/ (prevent tracking via CDN) * Firefox Multi-Account Containers https://addons.mozilla.org/addon/multi-account-containers/ https://addons.mozilla.org/addon/multi-account-containers/ (used for sites to keep me logged in) * HTTPS Everywhere https://addons.mozilla.org/addon/https-everywhere/ https://addons.mozilla.org/addon/https-everywhere/ * Redirect AMP to HTML https://addons.mozilla.org/addon/amp2html/ https://addons.mozilla.org/addon/amp2html/ (no to AMP) * Temporary Containers https://addons.mozilla.org/addon/temporary-containers/ https://addons.mozilla.org/addon/temporary-containers/ (Prevents tracking via ETags and other things like IndexDB) * uBlock Origin https://addons.mozilla.org/addon/ublock-origin/ https://addons.mozilla.org/addon/ublock-origin/ (block adverts) * uMatrix https://addons.mozilla.org/firefox/addon/umatrix/ https://addons.mozilla.org/firefox/addon/umatrix/ (block 1st party JavaScript)
prophesi 8y ago
It should be noted that SSLstrip is a thing. Those sites would need to properly force HTTPS, which is easy to get wrong. And it's much easier to allow both HTTP/HTTPS.
jsight 8y ago
I felt exactly the same way. I've run into people who have the idea that public wifi is insecure, as in don't hit your bank's website over that insecure channel. But in reality, the services that really need security are going over TLS, where at least the connection itself is secure (presuming that you are taking the same safeguards that you'd take on a "secure" network). In reality, no internet network is naturally secure and the only security are these transport level encryptions. But, of course, there is more to it than that. What about the unencrypted connections? DNS access and logging? Ironically these are what people tend to worry the least about but are the most likely to be compromised. A VPN can be very helpful here. The article brushed across this distinction in a way that I think may have just been confusing to anyone that didn't already understand it. The net effect is that they might see these two pieces of advice as contradictory.
- subway 8y ago
  The bigger issue with public wifi is even actually finding your bank's server in the first place. HSTS largely saves the day here, but is far from universal. If any non TLS requests are in the request chain, and you don't have an eagle eye on the address bar, all bets are off.
- ridgewell 8y ago
  >But in reality, the services that really need security are going over TLS, where at least the connection itself is secure. I think other considerations include whether or not the sites that you visit implement HSTS. While many sites do support HTTPS-only logins, several webservices are actually quite vulnerable to software such as SSLstrip[1], which redirects hijacked users to plaintext HTTP pages whenever feasible. While many sites implement TLS, several sites don't implement HSTS. I am not sure about the HSTS policies of the top 3000 sites so I will not comment on that. [1]https://moxie.org/software/sslstrip/ https://moxie.org/software/sslstrip/
- surge 8y ago
  Right, and he's not counting the metadata an ISP or wifi provider can be collecting about you, they might not be able to see your private traffic to your bank, but now they know who you bank with. You might be passing that information on to ProtonVPN, but I'm more afraid of what someone sniffing wifi traffic can find out about me than a service I'm paying for, its about the same risk with my ISP. AT&T even collects data from its consumers.
fonosip 8y ago
We usually do not have a choice of ISP. A VPN gives you the option of where to "attach" to the internet. As an added bonus at that point you can filter ads, malware, tracking.

deleted 8y ago

[deleted]

lifthrasiir 8y ago

He made this point explicit: > Networks like these make it easy for attackers to get a copy of your network data, and if you send something unencrypted, the results can be quite harmful. The web should be ideally end-to-end encrypted with HTTPS. But in case this assumption breaks down, VPN gives an additional headroom for security. Not much (as explained in the article, and thus should not be advertised so), but still useful.

thinkloop 8y ago
The VPN only protects the first hop, it would not be a good backup for https.
- lifthrasiir 8y ago
  Yes, but if the target site does not use https there is no alternative.
- quickthrower2 8y ago
  It protects the first hop for request data. But response data could be interfered with too.
iuguy 8y ago
> The web should be ideally end-to-end encrypted with HTTPS. No. People designing public access networks should use encryption and AP client isolation.
- baddox 8y ago
  They should, of course. And for when they don’t, a VPN can protect you. That’s what the article is saying.
  - iuguy 8y ago
    I'm responding to OP's comment, not the article.
dahfizz 8y ago
The internet is so much bigger than just websites. HTTPS is great but VPNs provide encryption at a much lower level, where it should be. Even when using https you are exposing a lot of unencrypted data because https is an application layer encryption. It's not enough.

sigmar 8y ago

>most of the web is now end-to-end encrypted with HTTPS. So why does he need a VPN at the airport? What percentage of (typically rushed) people at an airport will notice that a website is loading over http instead of https? SSLsplit is pretty useful.

tedunangst 8y ago
Does your bank, or whatever, not use hsts?
- jeltz 8y ago
  Last time I checked, about 2 years ago, none of the Swedish banks used HSTS. And a couple of them used HTTP on their main page and and HTTPS on their internet bank which was put on some weird domain. Chrome's changes has since then forced them to move everything to HTTPS but I would be very surprised if they all use HSTS now.
- stordoff 8y ago
  My bank doesn't _and_ there's a redirect to a different domain (rbs.co.uk homepage does to personal.rbs.co.uk, rbs.co.uk/englandandwales or the login link goes to rbsdigital.com). Serve a redirect on the non-HTTPS rbs.co.uk to some other plausible domain with a valid HTTPS certificate, and I probably wouldn't notice.
viraptor 8y ago
SSL everywhere is also a good workaround for this: https://www.eff.org/https-everywhere https://www.eff.org/https-everywhere

iuguy 8y ago

> So why does he need a VPN at the airport? Because the airport made a shitty choice in designing it's wifi, and people who connect to such networks are making shitty choices. HTTPS is nothing more than a content protocol wrapped in a transport encryption layer used for a subset of your overall traffic. When you connect to an open wifi network your device is literally screaming 1s and 0s into the air like a maniac. A subset of these 1s and 0s are the things you're actively telling the computer to do. Most of this stuff is things like ARP, Name resolution services and other stuff that isn't encrypted for perfectly understandable reasons. Instead, when connecting to an open airport wifi network, a personal decision is made that the connectivity is more important than encryption. Airport wifi connections could and should be encrypted with AP client isolation, but they aren't.

m0dest 8y ago
How exactly is the airport supposed to offer a WiFi network that is encrypted and open without breaking usability and compatibility? This hasn't been possible until WPA3, which has barely started rolling out.
- CKN23-ARIN 8y ago
  Many ways to do this. Make the password widely-known. Announce it over the intercom. Post it on the walls. Offer both encrypted and non-encrypted SSIDs. The non-encrypted SSID could even just be a captive portal with instructions to connect to the encrypted SSID. If you're feeling wild, use WPA2 Enterprise, and accept any credentials.
  - 0xf00d 8y ago
    Doesn't the widely-known password render the encryption useless to anyone that has captured the 4-way handshake at the beginning of your WIFI-session? With the PSK and your session keys an attacker can decrypt your traffic if I remember it correctly.
  - icebraining 8y ago
    "WPA and WPA2 don't provide forward secrecy, meaning that once an adverse person discovers the pre-shared key, they can potentially decrypt all packets encrypted using that PSK transmitted in the future and even past, which could be passively and silently collected by the attacker. This also means an attacker can silently capture and decrypt others' packets if a WPA-protected access point is provided free of charge at a public place, because its password is usually shared to anyone in that place. In other words, WPA only protects from attackers who don't have access to the password." https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Lack_of_forward_secrecy https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Lack_of...

ignoramous 8y ago

I think the whole point is you'd want both IPSec and TLS, and just TLS might not be enough. A good VPN impl provides better protection when you're connecting over public networks you don't trust, for protocols that don't use TLS.

alasdair_ 8y ago

>Seems like a contradictory message. He just got through telling us how most of the web is now end-to-end encrypted with HTTPS. So why does he need a VPN at the airport? Is he checking his email? I can't imagine that he's using an email service that doesn't use HTTPS. Because the Internet is more than the stuff that lives on port 443? What does the author do about UDP packets? It’s interesting that you mention email. SMTP can use TLS of course but I know of plenty of POP3 email providers that still send unencrypted and even if it were, it’s not using HTTPS. What about DNS requests too? Those are still often sent in cleartext. Even with actual HTTPS with a browser, the domain itself is visible. In short - the Internet is not just the web.

viraptor 8y ago
That would imply the author cares enough about privacy / security to use VPN to hide for example POP3, but not enough to immediately drop an email provider which uses unencrypted POP3 service. And that's a strange argument.
- michaelmrose 8y ago
  Probably because a person can more trivially be taught vpn = privacy than understanding ANY of the details and be legitimately better off especially if they are doing other stupid things like using unencrypted pop3 or use the same password at random http site as they use on their bank.

headmelted 8y ago

I can't help but shake my head at this whole argument. For literally years I've been telling people that a VPN run by a third party does not enhance privacy or security, but because the consensus is "VPN = secure" it's a losing battle, and I sound like a tinfoil-hat-wearing loon. Most VPN services are not designed to provide privacy or security, and if you have a subscription to one, that's probably not the reason you bought it either. They're designed to provide the minimal amount of traffic hiding required to allow you to pirate TV/movies/video games without getting in trouble or hitting blocked URLs. And it works, or you wouldn't still have the subscription. Now, as both the buyer and the seller need a non-shady cover story, they describe hiding your suspect downloads as "security and privacy" - it's not utterly inaccurate, but it implies far more than what's happening. The problem with the narrative is that it makes laypeople think they are "more secure" when using a VPN, when in reality, the opposite is true. As an example, when I perform a Google search, my traffic is encrypted over SSL, so my ISP can't see that. My ISP can see the domain name of the result I click, and a VPN would mask that from them. But now a new third party (the VPN provider) can see that instead. This makes sense if you're downloading pirated media (as the VPN service doesn't care), but the buyer is in effect trading: 1) An ISP, which is in most western countries heavily regulated, with legal commitments to auditing and your privacy (just not from law enforcement). for: 2) Some computer somewhere that is run by an utterly unregulated company or individual that may or may not know how to configure OpenVPN correctly and that you don't know anything about, other than they run a shady business based on allowing you to download pirate files on the internet. Also they're not at all regulated or audited, and may not even be in a jurisdiction that requires them to protect your data at all. Given this trade-off, trusting a VPN to do a better job of protected your privacy than an ISP seems like madness to me, given that they could easily sell whatever information they have on you on and there's nothing you can do about it (and you'd likely never find out). It may not even be a crime depending on where they're located. There's arguments for VPN in preference to unsecured Wi-Fi, but in reality, how often is that an issue? How many scenarios are there where you can't use mobile data instead? (And even where/when you can't, you still have all the downsides above which may or may not be better).

pbhjpbhj 8y ago
I don't think your analysis is complete. Most VPN's raison d'être is providing privacy. If it's publicly known that they don't then that kills their business. An ISP is tasked with connecting prior to the internet, they don't make claims about privacy, they can reveal information about clients without necessarily putting anyone off, most of the clients for large ISPs have probably never heard of a VPN. If a VPN wanted to they could get audits by pen-testers to warrant their ability to provide secrecy. A VPN provider that's been around a while and claims to offer a high level of privacy probably does. Slight aside: >My ISP can see the domain name of the result I click, and a VPN would mask that from them. // There was a paper a little while ago, they directly identified pages by mitm-ing HTTPS by using meta-data (page size alone IIRC). Success was something like 80%.

pizzazzaro 8y ago

Im actually glad that the author pointed out that once you log in somewhere that will track you, that connection is associated with you. A vpn is not a cure-all. It is only as private as you're willing to make it. If you want to pirate movies and chat on facebook at the same time, you're probably gonna have a bad time. What you do is absolutely a part of your advertising/tracking profile. Payment information - some prefer to use cryptocurrency, which in their minds, is private. Again, once metadata connects you, there's no denying that that's you. A third party consultant takes your payment? Maybe. Especially if you've got some anonymizing layer to your credit card info that has earned a similar trust. This will of course add to the cost of the transaction. Even the way you type can connect you. Sufficient amounts of text - such as this reply - are usually enough.

tya99 8y ago
> Im actually glad that the author pointed out that once you log in somewhere that will track you, that connection is associated with you. Exactly, and it's usually a cookie or some sort of persistent storage. I use a VPN, but I use it at the router level. https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a_Raspberry_Pi_(IPv6) https://wiki.alpinelinux.org/wiki/Linux_Router_with_VPN_on_a... I know my ISP logs my metadata (by law), whereas I trust that my VPN provider does not. Essentially VLAN2 all traffic is routed direct to my ISP, and VLAN3 all traffic is routed to VPN. My machine normally sits in VLAN3. I make sure not to log into anything social media related or tied to my real identity. If I need to do banking, Facebook or something like that I'll use a device in VLAN2 (a separate computer). All phones and devices like that are broadcasting information anyway so those are in VLAN2 as well, unless they are devices with LineageOS and no Google Apps. > A vpn is not a cure-all. It is only as private as you're willing to make it. If you want to pirate movies and chat on facebook at the same time, you're probably gonna have a bad time. What you do is absolutely a part of your advertising/tracking profile. See in this scenario I would have a system in VLAN3 that I use for my downloading, and another computer in VLAN2 that is used for the facebooking. I use a hardened browser with https://github.com/ghacksuserjs/ghacks-user.js https://github.com/ghacksuserjs/ghacks-user.js that hardens the browser and helps against fingerprinting. I also use a number of addons, for various purposes That requires hardening. Currently I use * CleanURLs https://addons.mozilla.org/addon/clearurls/ https://addons.mozilla.org/addon/clearurls/ (remove UTM and parameter tracking) * CSS Exfil Protection https://addons.mozilla.org/addon/css-exfil-protection/ https://addons.mozilla.org/addon/css-exfil-protection/ * Decentraleyes https://addons.mozilla.org/addon/decentraleyes/ https://addons.mozilla.org/addon/decentraleyes/ (prevent tracking via CDN) * Firefox Multi-Account Containers https://addons.mozilla.org/addon/multi-account-containers/ https://addons.mozilla.org/addon/multi-account-containers/ (used for sites to keep me logged in) * HTTPS Everywhere https://addons.mozilla.org/addon/https-everywhere/ https://addons.mozilla.org/addon/https-everywhere/ * Redirect AMP to HTML https://addons.mozilla.org/addon/amp2html/ https://addons.mozilla.org/addon/amp2html/ (no to AMP) * Temporary Containers https://addons.mozilla.org/addon/temporary-containers/ https://addons.mozilla.org/addon/temporary-containers/ (Prevents tracking via ETags and other things like IndexDB) * uBlock Origin https://addons.mozilla.org/addon/ublock-origin/ https://addons.mozilla.org/addon/ublock-origin/ (block adverts) * uMatrix https://addons.mozilla.org/firefox/addon/umatrix/ https://addons.mozilla.org/firefox/addon/umatrix/ (block 1st party JavaScript)

prophesi 8y ago

It should be noted that SSLstrip is a thing. Those sites would need to properly force HTTPS, which is easy to get wrong. And it's much easier to allow both HTTP/HTTPS.

jsight 8y ago

I felt exactly the same way. I've run into people who have the idea that public wifi is insecure, as in don't hit your bank's website over that insecure channel. But in reality, the services that really need security are going over TLS, where at least the connection itself is secure (presuming that you are taking the same safeguards that you'd take on a "secure" network). In reality, no internet network is naturally secure and the only security are these transport level encryptions. But, of course, there is more to it than that. What about the unencrypted connections? DNS access and logging? Ironically these are what people tend to worry the least about but are the most likely to be compromised. A VPN can be very helpful here. The article brushed across this distinction in a way that I think may have just been confusing to anyone that didn't already understand it. The net effect is that they might see these two pieces of advice as contradictory.

subway 8y ago
The bigger issue with public wifi is even actually finding your bank's server in the first place. HSTS largely saves the day here, but is far from universal. If any non TLS requests are in the request chain, and you don't have an eagle eye on the address bar, all bets are off.
ridgewell 8y ago
>But in reality, the services that really need security are going over TLS, where at least the connection itself is secure. I think other considerations include whether or not the sites that you visit implement HSTS. While many sites do support HTTPS-only logins, several webservices are actually quite vulnerable to software such as SSLstrip[1], which redirects hijacked users to plaintext HTTP pages whenever feasible. While many sites implement TLS, several sites don't implement HSTS. I am not sure about the HSTS policies of the top 3000 sites so I will not comment on that. [1]https://moxie.org/software/sslstrip/ https://moxie.org/software/sslstrip/
surge 8y ago
Right, and he's not counting the metadata an ISP or wifi provider can be collecting about you, they might not be able to see your private traffic to your bank, but now they know who you bank with. You might be passing that information on to ProtonVPN, but I'm more afraid of what someone sniffing wifi traffic can find out about me than a service I'm paying for, its about the same risk with my ISP. AT&T even collects data from its consumers.

fonosip 8y ago

We usually do not have a choice of ISP. A VPN gives you the option of where to "attach" to the internet. As an added bonus at that point you can filter ads, malware, tracking.