3 ms·

Isn't it misleading, to discuss it as a "vpn service"? If you install a binary, that not only controls vpn channel on both sides, but is also a browser, do I un

Isn't it misleading, to discuss it as a "vpn service"? If you install a binary, that not only controls vpn channel on both sides, but is also a browser, do I understand it right, that it can completely highjack the trust mechanisms, and happily MITM anything you visit? Is there any way to find out if it's really establishing, well, vpn connection (e.g. openVPN or Wireguard), without DPI hardware and corresponding expertise?

anc84 8y ago
This is the same as any non-tech person using a "VPN". They do not care about privacy or anything. So this makes sense.
- nbabitskiy 8y ago
  Please correct me, if I'm wrong. When a non-tech person buys a vpn subscription, she may be provided with a tunneling software, but the key exchange is still happening in the browser. If the site shows a green lock, you can trust the connection to be encrypted, to the extent you trust Mozilla. Also, many vpn providers let you use open source software, like OpenVPN. Opera, however, can ship an installer with a statically linked mock ssh lib, that's always showing a green lock. It's a much more sinister threat model.
  - Drdrdrq 8y ago
    Mozilla could do the same. That said, I do trust Mozilla quite a bit more.
magnetic 8y ago
If you have a malicious browser publisher, you have bigger problems than the networking layer to worry about. The browser already has access to all your keystrokes and all the data it's displaying to you. In some way, it's a "Man In The Middle" that sits at the UI layer and will be able to sniff anything both ways irrespective of the networking layers. That password coming from your "secure keychain" (or any other password manager)? It is also visible "in the clear" by the browser. Only challenge-based, out-of-browser authentication methods will keep the browser from seeing your secret, but it'll still be able to snoop your interaction both ways, and make sensitive API calls on your behalf (like transferring money, etc). There are other methods like OTP that also limit the exposure of your secret, but don't protect against the main threat of hijacking an authenticated browser session. Thankfully some services add another layer of authentication for "sensitive actions", but it's not that common, and it is often weak (for example, sending an SMS with a code). Better than nothing of course.

anc84 8y ago

This is the same as any non-tech person using a "VPN". They do not care about privacy or anything. So this makes sense.

nbabitskiy 8y ago
Please correct me, if I'm wrong. When a non-tech person buys a vpn subscription, she may be provided with a tunneling software, but the key exchange is still happening in the browser. If the site shows a green lock, you can trust the connection to be encrypted, to the extent you trust Mozilla. Also, many vpn providers let you use open source software, like OpenVPN. Opera, however, can ship an installer with a statically linked mock ssh lib, that's always showing a green lock. It's a much more sinister threat model.
- Drdrdrq 8y ago
  Mozilla could do the same. That said, I do trust Mozilla quite a bit more.

magnetic 8y ago

If you have a malicious browser publisher, you have bigger problems than the networking layer to worry about. The browser already has access to all your keystrokes and all the data it's displaying to you. In some way, it's a "Man In The Middle" that sits at the UI layer and will be able to sniff anything both ways irrespective of the networking layers. That password coming from your "secure keychain" (or any other password manager)? It is also visible "in the clear" by the browser. Only challenge-based, out-of-browser authentication methods will keep the browser from seeing your secret, but it'll still be able to snoop your interaction both ways, and make sensitive API calls on your behalf (like transferring money, etc). There are other methods like OTP that also limit the exposure of your secret, but don't protect against the main threat of hijacking an authenticated browser session. Thankfully some services add another layer of authentication for "sensitive actions", but it's not that common, and it is often weak (for example, sending an SMS with a code). Better than nothing of course.