3 ms·
> They're completely secure. No. They are an insecure transport, like most of the internet. The majority of high profile sites, services, and apps will now u
by ygjb 7y ago
> They're completely secure.
No. They are an insecure transport, like most of the internet. The majority of high profile sites, services, and apps will now use TLS by default, but this is one of the few edge cases where a reputable VPN provider would help protect end users from poorly secured apps and services. I would trust the VPN folks vetted by Mozilla, but I am biased because I worked at Mozilla for years and have a great deal of trust for the folks there, or for the technical audience at HN I would recommend using one of the cloud service provider templates for standing up your own VPN server.
- itake 7y agoHow does using a VPN protect you from poorly secured apps and services? My understanding is a MITM attack can happen between your VPN provider and the service, just like it may work on the wifi point.
- vorpalhex 7y agoYou should do your initial vpn setup and first connection over a known good secure connection. Good vpn apps also pin certs and will warn you about migrating hosts or unexpected IPs.
- ygjb 7y agoIt doesn't, it simply protects the transport between the untrusted network location (e.g. coffee shop, airport, or Apartment 23C's unsecured wifi) and your VPN endpoint, which presumably has a suitably "safe" transport. Without digging into too much detail, or providing a whack of data because I am not writing long form about this and I spent too much time writing comments on HN this morning :P, but my observation has been that the majority of unsecured apps have service endpoints that are deployed in cloud service provider environments, so if you have a VPN end point that terminates inside the same region, then it is highly unlikely that your traffic will hit the Internet before arriving at it's destination. That said, it's TCP/IP, so all it takes is a routing change and all of those assumptions go out the window... Beyond that, MITM and traffic monitoring is happening all of the time in many network service providers, not all of it's nefarious -- alot of traffic analysis is just sampling to make sure that the network is working well and to understand whats happening. That said, there are many service providers and jurisdictions that opportunistically capture data or modify traffic in flight for purposes other than quality of service (e.g. ISPs injecting advertisements into HTTP traffic, surveillance, etc) Using a VPN in this way doesn't protect you against those kinds of threats - the value in using a VPN here is about preventing local eavesdroppers from monitoring network metadata that can be used to classify your traffic and track you. There are many examples, but one clear one is for marginalized people, such as folks from the LGBT community using specific apps (e.g. gay dating apps such Grindr or Growlr) that could out them to a monitoring service while in a jurisdiction or community hostile to them. Having that traffic tunneled safely to a "known safe" destination, e.g. an AWS or GCP instance in a safer region, would provide a measure of protection. I had a discussion with a colleague about this about a year ago, but I think it would be very awesome to build an open source VPN service that leveraged AWS & GCP VPCs and inter region peering so that it would egress in the same cloud provider regions as destination IP blocks to prevent as much traffic as possible from flowing over the public internet, but I haven't had the time to put into it.
- kickopotomus 7y agoWould you mind naming a "mainstream" application that does not use TLS by default?
- ygjb 7y agoYes I would mind, but only because I stopped maintaining a list when I stopped working for a browser vendor (Mozilla) and an organization that has an intercepting proxy as a part of it's core product(OpenDNS). It's not a hard experiment to run, and "mainstream" has different meanings in different locations. Get a femto cell or other remote access point set up an open wireless network in a high traffic area, especially in a place where there is a transit hub, and hang out for several hours. You could also grab the Alexa top 1 million or Cisco Umbrella top 1 million, and scan them for http endpoints, and work backward from there for sites that don't bounce you to a TLS endpoint.
- Maximus9000 7y ago> I would trust the VPN folks vetted by Mozilla Does mozilla have a list of "vetted" VPNs? I'm interested in seeing that list.
- ygjb 7y agoAFAIK just ProtonVPN right now, but I haven't worked at Mozilla in almost 5 years. Tweet @MozillaSecurity and they will probably point you in the right direction, most of them are super helpful!