5 ms·

> Commercial VPNs are not as useful and secure as you think. That's highly contingent on the "as you think" part. For example, I use ExpressVPN on public WiFi

> Commercial VPNs are not as useful and secure as you think. That's highly contingent on the "as you think" part. For example, I use ExpressVPN on public WiFi networks because I trust them a whole lot more than random public WiFi providers. Sure, they have access to the URLs I've accessed while using their service. Then again, so does my ISP. The crucial part is, said random public WiFi providers won't have access to that data. Additionally, and much more importantly, some public WiFi providers try to MITM secure connections, which is effectively prevented when using a trustworthy VPN.

unshavedyak 4y ago
Yea, i use it to avoid Comcast mostly out of spite. "Aren't as secure as you think" seems to imply Comcast or the foreign wifi has what, broken the encryption? If so, tell me! But i kinda doubt it.
- BostonEnginerd 4y ago
  I think the problem is you’re trading one set of untrustworthy actors for another set of lesser known untrustworthy actors.
  - unshavedyak 4y ago
    Yea, but that's not _my_ problem. My problem is "fuck comcast". As for the public wifi, i get that i can't trust my random Dropbox VM for example, but i can surely trust it more than an actively hostile public wifi, no? If i can't trust any remote computing VM, how can i host anything on infra i don't own?
    - BostonEnginerd 4y ago
      Of course, I fully expect someone commenting on HN to understand the issues and to have made the trade off. It took a lot of explaining to my parents why a VPN didn’t add any meaningful security for them.
      - unshavedyak 4y ago
        Very good point. They also sell it as if _just_ using a VPN equals security. I can't count the number of ads i've seen that over sell that :/
leftcenterright 4y ago
While public Wifi providers may try to MITM, TLS effectively prevents that from happening unless you are prone to accept "insecure certificate/connection" warnings. Leaked keys or keys obtained/accessible by law enforcement from vpn providers effectively allow them to MITM you: https://www.byos.io/blog/nordvpn-torguard-and-vikingvpn-breached https://www.byos.io/blog/nordvpn-torguard-and-vikingvpn-brea... That said, why did you choose EXpressVPN? > If you're an ExpressVPN customer, you shouldn't be. - Snowden, Sep 16 2021 - https://twitter.com/Snowden/status/1438291654239215619 https://twitter.com/Snowden/status/1438291654239215619 - https://www.zdnet.com/article/trust-but-verify-an-in-depth-analysis-of-expressvpns-terrible-horrible-no-good-very-bad-week/ https://www.zdnet.com/article/trust-but-verify-an-in-depth-a...
- BjoernKW 4y ago
  > While public Wifi providers may try to MITM, TLS effectively prevents that from happening unless you are prone to accept "insecure certificate/connection" warnings. For connections happening via a browser that's true. For other applications, it depends, since those might happily accept a certificate that has been tampered with without the user being aware of it. > That said, why did you choose EXpressVPN? Put snarkily: Because I'm not Edward Snowden and I'm not subject to the same kind of threat level. At the time (2018), ExpressVPN for me was the right choice in terms of sufficient security for my requirements and - not to be underestimated - user experience. Other VPN products I tried out back then were more difficult to install and use (sometimes significantly so) and suffered from slow or even regularly dropped connections.
  - leftcenterright 4y ago
    TLS validation is enforced in all mobile applications unless you have spyware/malware which would use insecure CAs or self-signed certificates. Please see my comment above https://news.ycombinator.com/item?id=34159195 https://news.ycombinator.com/item?id=34159195 All standard mobile clients do TLS validation. They just can't be MiTMed by anyone using self-signed certificates/CAs which is how most mitm tools work (e.g. mitmproxy) Do you have any examples of apps not doing TLS validation? I am really surprised to see this misconception. > Put snarkily: Because I'm not Edward Snowden and I'm not subject to the same kind of threat level. Well that is alright, we should all make decisions based upon our own threat models. It is just that in that case you are also at no risk with public WiFis unless you are sincerely looking for a fully secure alternative.

unshavedyak 4y ago

Yea, i use it to avoid Comcast mostly out of spite. "Aren't as secure as you think" seems to imply Comcast or the foreign wifi has what, broken the encryption? If so, tell me! But i kinda doubt it.

BostonEnginerd 4y ago
I think the problem is you’re trading one set of untrustworthy actors for another set of lesser known untrustworthy actors.
- unshavedyak 4y ago
  Yea, but that's not _my_ problem. My problem is "fuck comcast". As for the public wifi, i get that i can't trust my random Dropbox VM for example, but i can surely trust it more than an actively hostile public wifi, no? If i can't trust any remote computing VM, how can i host anything on infra i don't own?
  - BostonEnginerd 4y ago
    Of course, I fully expect someone commenting on HN to understand the issues and to have made the trade off. It took a lot of explaining to my parents why a VPN didn’t add any meaningful security for them.
    - unshavedyak 4y ago
      Very good point. They also sell it as if _just_ using a VPN equals security. I can't count the number of ads i've seen that over sell that :/

leftcenterright 4y ago

While public Wifi providers may try to MITM, TLS effectively prevents that from happening unless you are prone to accept "insecure certificate/connection" warnings. Leaked keys or keys obtained/accessible by law enforcement from vpn providers effectively allow them to MITM you: https://www.byos.io/blog/nordvpn-torguard-and-vikingvpn-breached https://www.byos.io/blog/nordvpn-torguard-and-vikingvpn-brea... That said, why did you choose EXpressVPN? > If you're an ExpressVPN customer, you shouldn't be. - Snowden, Sep 16 2021 - https://twitter.com/Snowden/status/1438291654239215619 https://twitter.com/Snowden/status/1438291654239215619 - https://www.zdnet.com/article/trust-but-verify-an-in-depth-analysis-of-expressvpns-terrible-horrible-no-good-very-bad-week/ https://www.zdnet.com/article/trust-but-verify-an-in-depth-a...

BjoernKW 4y ago
> While public Wifi providers may try to MITM, TLS effectively prevents that from happening unless you are prone to accept "insecure certificate/connection" warnings. For connections happening via a browser that's true. For other applications, it depends, since those might happily accept a certificate that has been tampered with without the user being aware of it. > That said, why did you choose EXpressVPN? Put snarkily: Because I'm not Edward Snowden and I'm not subject to the same kind of threat level. At the time (2018), ExpressVPN for me was the right choice in terms of sufficient security for my requirements and - not to be underestimated - user experience. Other VPN products I tried out back then were more difficult to install and use (sometimes significantly so) and suffered from slow or even regularly dropped connections.
- leftcenterright 4y ago
  TLS validation is enforced in all mobile applications unless you have spyware/malware which would use insecure CAs or self-signed certificates. Please see my comment above https://news.ycombinator.com/item?id=34159195 https://news.ycombinator.com/item?id=34159195 All standard mobile clients do TLS validation. They just can't be MiTMed by anyone using self-signed certificates/CAs which is how most mitm tools work (e.g. mitmproxy) Do you have any examples of apps not doing TLS validation? I am really surprised to see this misconception. > Put snarkily: Because I'm not Edward Snowden and I'm not subject to the same kind of threat level. Well that is alright, we should all make decisions based upon our own threat models. It is just that in that case you are also at no risk with public WiFis unless you are sincerely looking for a fully secure alternative.