4 ms·

Have you noticed all the ads say “Hackers can spy on your connection when you log into your bank at Starbucks.” That’s complete FUD. HTTPS completely avoids th

by KMnO4 5y ago

Have you noticed all the ads say “Hackers can spy on your connection when you log into your bank at Starbucks.” That’s complete FUD. HTTPS completely avoids this issue (especially with a bank). Very few websites use HTTP now. While VPNs do have their valid use (preventing your ISP from spying, changing geolocation, and private networks for eg, work), most of the marketing is spreading misinformation.

anonymouse008 5y ago
I've never understood how a VPN doesn't get too carried away to pull a MITM with some central cert
- gjsman-1000 5y ago
  Because if you used a central cert, every device would have to whitelist that cert, and just clocking the lock icon in your browser would reveal it.
  - jen20 5y ago
    Many consumer VPNs install a client, and it would be trivial to ship a new trusted certificate with it.
    - acdha 5y ago
      This is true, but note that, for example, on iOS an application can't do that without prompting. Now, most people would probably hit “Approve” if one of their security products said it was necessary.
    - gjsman-1000 5y ago
      That wouldn’t change that clicking the lock icon in your browser would show the same certificate on every website, and that this certificate was universally valid. Pretty obvious…
      - AdamJacobMuller 5y ago
        > show the same certificate on every website Not really, because, you can use on-demand certificate issuance. Hell, if you really want to, you can even name your certificates the same as existing certificates and the only way to detect the forgery would be to compare the actual public keys (and who does THAT). I feel like I'm writing an evil roadmap here, but, you can even do multiple root certs with different names and trust them all, do a whole "fake" PKI infrastructure which would be impossible to detect unless you were comparing the actual keys.
        anonymouse008 5y ago
        > I feel like I'm writing an evil roadmap here, but, you can even do multiple root certs with different names and trust them all, do a whole "fake" PKI infrastructure which would be impossible to detect unless you were comparing the actual keys. Yeah, just imagine being beholden to some federal statue impropriety (easiest in taxes) and running one of the these vpn organizations...
        0x0 5y ago
        If and when browsers start requiring pre-certificate transparency logging, anything like this should no longer be possible to pull off, since none of the fake certificates would be able to contain a stapled pre-certificate "signoff" from a trusted CT log.
    - throw0101a 5y ago
      > Many consumer VPNs install a client, and it would be trivial to ship a new trusted certificate with it. A lot of browsers have their own root chain, and also now do certificate pinning, so will (IIRC) only accept specifically designated certs for particular sites (doesn't Google/Chrome/Gmail do this?).
  - Nextgrid 5y ago
    On the other hand, a lot of VPNs provide proprietary client software (even though all the major OSes have built-in support for the common VPN protocols such as IPSec, L2TP, etc) so they could very well sneak the root cert in there too.
flixic 5y ago
I've seen stats for a couple of the biggest VPNs. Massive majority of their traffic is just switching geolocation restrictions (US Netflix and similar). They don't tend to advertise that. Some do, but it's not their main message, because "prevent ISPs from spying" is cleaner. iCloud+ does not solve this, so there will be a sustained need for VPNs, particularly those that invest effort into into avoiding Netflix blacklists.
- tpush 5y ago
  > They don't tend to advertise that. IME of podcast advertising they all advertise this very openly.
dehrmann 5y ago
> “Hackers can spy on your connection when you log into your bank at Starbucks.” I've also heard this from a reputable news source (NPR) in the past few years, even though it hasn't been true for banks for at least 15 years, ~5 for most websites.

by KMnO4 5y ago

anonymouse008 5y ago

I've never understood how a VPN doesn't get too carried away to pull a MITM with some central cert

gjsman-1000 5y ago
Because if you used a central cert, every device would have to whitelist that cert, and just clocking the lock icon in your browser would reveal it.
- jen20 5y ago
  Many consumer VPNs install a client, and it would be trivial to ship a new trusted certificate with it.
  - acdha 5y ago
    This is true, but note that, for example, on iOS an application can't do that without prompting. Now, most people would probably hit “Approve” if one of their security products said it was necessary.
  - gjsman-1000 5y ago
    That wouldn’t change that clicking the lock icon in your browser would show the same certificate on every website, and that this certificate was universally valid. Pretty obvious…
    - AdamJacobMuller 5y ago
      > show the same certificate on every website Not really, because, you can use on-demand certificate issuance. Hell, if you really want to, you can even name your certificates the same as existing certificates and the only way to detect the forgery would be to compare the actual public keys (and who does THAT). I feel like I'm writing an evil roadmap here, but, you can even do multiple root certs with different names and trust them all, do a whole "fake" PKI infrastructure which would be impossible to detect unless you were comparing the actual keys.
      - anonymouse008 5y ago
        > I feel like I'm writing an evil roadmap here, but, you can even do multiple root certs with different names and trust them all, do a whole "fake" PKI infrastructure which would be impossible to detect unless you were comparing the actual keys. Yeah, just imagine being beholden to some federal statue impropriety (easiest in taxes) and running one of the these vpn organizations...
      - 0x0 5y ago
        If and when browsers start requiring pre-certificate transparency logging, anything like this should no longer be possible to pull off, since none of the fake certificates would be able to contain a stapled pre-certificate "signoff" from a trusted CT log.
  - throw0101a 5y ago
    > Many consumer VPNs install a client, and it would be trivial to ship a new trusted certificate with it. A lot of browsers have their own root chain, and also now do certificate pinning, so will (IIRC) only accept specifically designated certs for particular sites (doesn't Google/Chrome/Gmail do this?).
- Nextgrid 5y ago
  On the other hand, a lot of VPNs provide proprietary client software (even though all the major OSes have built-in support for the common VPN protocols such as IPSec, L2TP, etc) so they could very well sneak the root cert in there too.

flixic 5y ago

I've seen stats for a couple of the biggest VPNs. Massive majority of their traffic is just switching geolocation restrictions (US Netflix and similar). They don't tend to advertise that. Some do, but it's not their main message, because "prevent ISPs from spying" is cleaner. iCloud+ does not solve this, so there will be a sustained need for VPNs, particularly those that invest effort into into avoiding Netflix blacklists.

tpush 5y ago
> They don't tend to advertise that. IME of podcast advertising they all advertise this very openly.

dehrmann 5y ago

> “Hackers can spy on your connection when you log into your bank at Starbucks.” I've also heard this from a reputable news source (NPR) in the past few years, even though it hasn't been true for banks for at least 15 years, ~5 for most websites.