4 ms·

Truth is - if hackers did a MIM attack and collected a bunch user traffic (for how long?) they could have everything.. banking info, emails, logins... at this

by readhn 7y ago

Truth is - if hackers did a MIM attack and collected a bunch user traffic (for how long?) they could have everything.. banking info, emails, logins... at this point if i was a user of that VPN service - i'd be replacing all of my sensitive passwords, secret questions/answers to key accounts.

lijogdfljk 7y ago
While I agree with you - I do think it's slightly less bad than you make it out to be. For example, if I connected to my bank over this VPN I would only be as concerned as my HTTPS connection. So my VPN still doesn't know my bank login, assuming my TLS was sound, right? This would hypothetically be as bad as logging into my bank on a public wifi. Am I paranoid enough to not log into my bank on a public wifi? Yes. So I should be concerned here. But, it's at least not immediately insecure.
- smolder 7y ago
  TLS is probably not sound, judging by history, even if exploits aren't known. But apart from that, there may have been ways to infiltrate a target client from the VPN host and make their TLS moot.
rocqua 7y ago
MitM-ing a VPN does not break HTTPS. Hence, any passwords send over HTTPS are still safe. You could speculate that a VPN MitM is a nice way to get an MitM position for a further attack on TLS. But that requires a lot more speculation. What isn't safe is your browsing history. True, any HTTP data isn't safe, but trusting that to be safe is baaaaad anyway. In short. This leaked browser behavior, and could be a single step in getting a MitM possition on users.
- catalogia 7y ago
  NordVPN's advertising has deliberately downplayed the significance of HTTPS, as part of their fear mongering campaign about public wifi and residential ISP connections, so it's not really surprising to see such misconceptions raise their heads when NordVPN screws the pooch like this.
deleted 7y ago
[deleted]
morpheuskafka 7y ago
Only to the existent that any other ISP already could. Banking info, email, etc would all be protected by encryption in transit (HTTPS or TLS), so an MItM attack shouldn't affect them. The attacker would only know what hosts you were communicating with, any unencrypted headers (ex. TLS SNI), but not the actual data itself.
TheDong 7y ago
A MITM attack of a VPN allows attackers to collect unencrypted traffic. Most people access email over a webmail interface, like gmail, that uses modern TLS encryption. All that's sent unencrypted is the SNI header, e.g. "mail.google.com", and roughly how much traffic total is transferred, e.g. "20 MB of browsing on mail.google.com". A VPN can't easily defeat TLS. It would require the user to ignore many scary warnings from the browser. You're still right that a user should change their passwords for any websites that do not use TLS (very few these days), or for any that use old versions of TLS if their threat model includes someone with close to nation-state resources attacking their connections individually. It also probably doesn't hurt to be paranoid and rotate anyway, but it should be with a proper understanding of the threats, not because of some ridiculous "the sky is falling" incorrect information like this.
- readhn 7y ago
  The sky is not falling! Everyone is discounting one thing - State actor possibility behind this attack. With state actor comes completely different ball game - totally different budget and capabilities to crack things. NOBODY knows what their unpublicized capabilities could be! So it is good practice to stay vigilant!

by readhn 7y ago

lijogdfljk 7y ago

While I agree with you - I do think it's slightly less bad than you make it out to be. For example, if I connected to my bank over this VPN I would only be as concerned as my HTTPS connection. So my VPN still doesn't know my bank login, assuming my TLS was sound, right? This would hypothetically be as bad as logging into my bank on a public wifi. Am I paranoid enough to not log into my bank on a public wifi? Yes. So I should be concerned here. But, it's at least not immediately insecure.

smolder 7y ago
TLS is probably not sound, judging by history, even if exploits aren't known. But apart from that, there may have been ways to infiltrate a target client from the VPN host and make their TLS moot.

rocqua 7y ago

MitM-ing a VPN does not break HTTPS. Hence, any passwords send over HTTPS are still safe. You could speculate that a VPN MitM is a nice way to get an MitM position for a further attack on TLS. But that requires a lot more speculation. What isn't safe is your browsing history. True, any HTTP data isn't safe, but trusting that to be safe is baaaaad anyway. In short. This leaked browser behavior, and could be a single step in getting a MitM possition on users.

catalogia 7y ago
NordVPN's advertising has deliberately downplayed the significance of HTTPS, as part of their fear mongering campaign about public wifi and residential ISP connections, so it's not really surprising to see such misconceptions raise their heads when NordVPN screws the pooch like this.

deleted 7y ago

[deleted]

morpheuskafka 7y ago

Only to the existent that any other ISP already could. Banking info, email, etc would all be protected by encryption in transit (HTTPS or TLS), so an MItM attack shouldn't affect them. The attacker would only know what hosts you were communicating with, any unencrypted headers (ex. TLS SNI), but not the actual data itself.

TheDong 7y ago

A MITM attack of a VPN allows attackers to collect unencrypted traffic. Most people access email over a webmail interface, like gmail, that uses modern TLS encryption. All that's sent unencrypted is the SNI header, e.g. "mail.google.com", and roughly how much traffic total is transferred, e.g. "20 MB of browsing on mail.google.com". A VPN can't easily defeat TLS. It would require the user to ignore many scary warnings from the browser. You're still right that a user should change their passwords for any websites that do not use TLS (very few these days), or for any that use old versions of TLS if their threat model includes someone with close to nation-state resources attacking their connections individually. It also probably doesn't hurt to be paranoid and rotate anyway, but it should be with a proper understanding of the threats, not because of some ridiculous "the sky is falling" incorrect information like this.

readhn 7y ago
The sky is not falling! Everyone is discounting one thing - State actor possibility behind this attack. With state actor comes completely different ball game - totally different budget and capabilities to crack things. NOBODY knows what their unpublicized capabilities could be! So it is good practice to stay vigilant!