I apologize for this thread drifting way off the OP.
I agree the comments are PC centric, and for a reason, the OP was a PC centric question and this is a PC centric forum. Luckily Googles search algorithms have come a long way in being able to determine the context of this post.
Comments re TLS were never meant to say that TLS is not used by banks in other ways like back end transactions, what the defaults are or are not or the security posture of individual American banks, I will not weigh in on that, as I believe that was not the intention of the OP or my comments, they were PC centric and in the context of the security of using the net as a whole in a public place. Context is important in that statement. I apologize if the context was not clear.
Your comments re the green padlock is probably the biggest step users can take to ensure they are not a victim of a man in the middle attack when surfing with https. A green padlock does not guarantee you are secure to the destination (ie bank), it means you are secure to someone and that someone could be the attacker. A man in the middle attack is no different than Deep Packet Inspection, which many large organizations rely on to be able to watch encrypted traffic in their organization. By clicking on the padlock and VERIFYING who the certificate issuer is, is the only way to ensure that you are secure to the destination you think you are. The point though, is that https is not a guarantee that your traffic is safe, it is a good start, add to that having an up to date OS and browser goes further.
It is important to note that this is not a conversation about American banking security, but overall security when surfing in public places and American banking is only a small piece of the conversation. We rely on many other sites and services to put personal information in than just Bank of America or Chase and these sites and services like the campground itself, may not have the same access to security staff or security posture as a large American Bank.
The other thing to consider, is that TLS and many other security protocols and encryption algorithms are ASSUMED to be safe. Up to a few years ago OpenSSL was assumed to be safe and Revenue Canada, an organization that cannot be argued that security is of the upmost importance fell victim to a flaw a few years ago. It is not a question of if current security protocols will be compromised but when and for how long before it is discovered and patched.
VPN's are absolutely about trust, you need to trust the service you are using to secure your traffic. There is a wealth of good information on the trust of each specific VPN service. You can NEVER guarantee public WIFI is secure (sometimes it maybe under some circumstances), but based on peer and professional reviews and public disclosure you CAN determine if a VPN service can be trusted. Which is why my original comments stated that browser based or free VPN services may not be the best option as you many not be able to verify trust.
I think we can agree that regardless of the specifics, the point of this thread is the OP wants to be secure in a public place and there are different ways to do this, and different sites and services have different levels of security. But I will say it again, the single biggest way to avoid being a victim is to not be the lowest hanging fruit. Not using an old or not updated OS goes a long way, and using a trusted VPN goes a long way as well. Does this mean that you will prevent hacking, no never, but not being the low hanging fruit goes a long way to hackers passing you over when surfing in a public place.
Sorry for any insult my comments have caused.
Rob
rvtechwithrvrob.com
