It gets worse. Some VPN providers, in order to save money on bandwidth will implement split-tunneling where they route HTTPS traffic out the hostile side of the

It gets worse. Some VPN providers, in order to save money on bandwidth will implement split-tunneling where they route HTTPS traffic out the hostile side of the connection rather than via the VPN tunnel with the assumption that since it's HTTPS it will be protected. A shockingly high number of applications including more than two dozen banking apps I've reviewed in the last 18 months fail to properly validate the public certificate provided by the server during the TLS handshake and allow self-signed certs like those generated by SSLSplit. In the context of free WiFi and a VPN provider that routes HTTPS traffic out the hostile side of the connection in a split-tunneling model it is possible for a man in the middle (MitM) to have full control over the HTTPS application traffic. One of the first things you should do if you have a VPN solution is to make sure, via HTTPS that your IP address is the actual IP address of the VPN provider: https://www.google.com/?gws_rd=ssl#safe=off&q=what+is+my+ip+address https://www.google.com/?gws_rd=ssl#safe=off&q=what+is+my+ip+...