HTTPS and VPN

"He has a dedicated hardwired PC that is ONLY used for financial transactions."

Big deal, most data theft occurs after the data is "secured" at the other end.

Friend mine is a super high end security guy... He doesn't talk about it at all, but I suspect NSA.

He was in an airport once and got pinged by someone in the airport. He was able to electronically identify the culprit and from there physically identified him. Broadcast a popup directly to the guys computer describing his clothing and told him you're being watched. Guy packed up and immediately left.

Some day I'm going to spend some time with him securing my network and computers better. He has a dedicated hardwired PC that is ONLY used for financial transactions.

mike-s wrote:

Bachelor wrote:
I still don't get it, when all the popular VPN providers provide excellent encryption such as Nord, Express, PIA and several others. They've all been tested and receive generally high marks. How can they be useless, as many of you say? This enquiring mind seeks answers.

For those types of VPN the encryption is only between your PC and the VPN provider. From there it flows across the public Internet, just as it would if there were no VPN. VPNs hide your IP address (there's a NAT gateway at the provider). They don't provide any more connection security than an HTTPS connection, but are popular for use with geographically restricted services (e.g. get US Netflix from some country where it isn't offered).

There are also enterprise VPNs (which were around first), where the VPN provides a tunnel between a client and an enterprise network (or between enterprise networks). Those encrypt all traffic crossing the public Internet, so are basically as secure as being directly on the enterprise network.

Excellent clarification! All my experience is with the latter. I knew the former existed but never quite understood why.

I think I understand better now. Thanks to everyone.

Bachelor wrote:
I still don't get it, when all the popular VPN providers provide excellent encryption such as Nord, Express, PIA and several others. They've all been tested and receive generally high marks. How can they be useless, as many of you say? This enquiring mind seeks answers.

For those types of VPN the encryption is only between your PC and the VPN provider. From there it flows across the public Internet, just as it would if there were no VPN. VPNs hide your IP address (there's a NAT gateway at the provider). They don't provide any more connection security than an HTTPS connection, but are popular for use with geographically restricted services (e.g. get US Netflix from some country where it isn't offered).

There are also enterprise VPNs (which were around first), where the VPN provides a tunnel between a client and an enterprise network (or between enterprise networks). Those encrypt all traffic crossing the public Internet, so are basically as secure as being directly on the enterprise network.

A VPN is encrypted from your PC VPN client application to te VPN server and then is unencrypted from the VPN server out to the “rest of the internet” and the reverse for “inbound traffic”. A VPN is generally used to allow access to a closed network that is attached to a public network. A by-product of a VPN is that the originating location is masked and appears to the internet as the point where the VPN connects to the internet. Keep in mind that the unencrypted traffic from a VPN server to the public internet may still contain data encrypted by an HTTPS session as described below.

By contrast, an HTTPS session is encrypted from your PC browser application to the endpoint server (such as your bank) and only the communication between your PC and the endpoint is encrypted, and your PC location is not masked.

I am not familiar with all VPN clients but would imagine most use TLS for session security just as HTTPS now does and therefore both would be subject to the same vulnerabilities (and likewise are both equally secure at this point in time). On an unencrypted WiFi network a VPN would hide all of your traffic from a local sniffer, not just your individual sessions as with HTTPS. Neither will provide protection from things like connecting to a bad WiFi network and ignoring certificate warnings.

Dave

Good point, Mr. Wizard. I had never considered that. Interesting that the VPN providers advertise security on public connections. Maybe it's all a sham. :h

Posted in error

i don't 'yet' use a VPN
but it would depend on whether the security starts in your PC or at the VPN server

if the data is encrypted inside your PC or at the VPN server

even if the data is encrypted from your browser to the vpn server

the data between your PC and the public wifi is not

every device connected to the public wifi is logging in with the same password "if a password is even needed"

which allows any evil pert, to monitor your signal traffic and attempt to break the encryption key of your VPN

I still don't get it, when all the popular VPN providers provide excellent encryption such as Nord, Express, PIA and several others. They've all been tested and receive generally high marks. How can they be useless, as many of you say? This enquiring mind seeks answers.