I’m sure as shit trusting proton over some random public network in a cafe setup by some random open reach engineer or something
They have 54% one star reviews on TrustPilot
But none that I saw were about security/privacy instead just comments about pricing.
Don’t hire that contractor lol
So I’m confused networking stuff has never been my strong suit, is this saying you can still be fucked on public WiFi even if you connect through a VPN?
Yes, to a degree. A VPN protects you from an attacker on the same WiFi network as you and that’s about it.
Most assaults on your privacy don’t happen like that, and for the most part the attacks that do happen like that are stopped by the website using https and proper modern security.
The benefit of the VPN is that it puts some of that protection under your control, but only as far as your VPN provider.A VPN is about as much protection from most cyber attacks as a gun is.
They’re not a security tool, they’re a networking tool. They let you do some network stuff securely, and done correctly they can protect from some things, but the point of them is “this looks like a small, simple LAN, but it’s not”.
It’s much easier to package and sell network tools than security tools, and they’re much more accepted by users, since security tools have a tendency to say “no” a lot, particularly when you might be doing something dumb,and users hate being told no, particularly when they’re doing something dumb.
is this saying you can still be fucked on public WiFi even if you connect through a VPN?
The quick and dirty answer is no, unless an attacker can figure out a way to get your VPN to strip it’s encryption (doubt you’ll ever see this outside something like defcon but you never know lol).
The long answer is that not all VPNs are equal depending on what you are trying to accomplish.
A VPN will simply tunnel your internet traffic over an encrypted channel to a server anywhere in the world.
On a technical level, this means that it will guarantee your internet traffic is unreadable until it hits the destination, which does mean it can make it more secure to use a public wifi/hotspot.
Of course privacy is actually a massive security iceberg, so some caveats in no particular order are:
spoiler
-
Modern protocols like HTTPS are already encrypted, although someone can still mess with stripping and poisoning techniques, so having a VPN running would be peace of mind.
-
Your privacy from companies like Google, Facebook, etc won’t be enforced by a VPN if you don’t also use a new browser session (incognito) because they can easily track your identity via cookies and accounts.
-
Even if you use a fresh session and dedicated VPN accounts, aforementioned tech companies can still identify you via statistical modeling based on your activity. They don’t really care what your IP is unless they need to pay tax for a country or follow some random media block law.
-
Your privacy from the government is nonexistent because most VPN companies will share your info if the government requests it.
-
Lots of VPNs choose to block torrenting so they don’t have to deal with protecting their customers (although lots also don’t).
-
Even if you setup your own VPN via a VPS in anonymous way, the government can still watch your exit traffic and link the origin back to you by inspecting the VPN packets (which is why Tor exists, a much different solution to the privacy problem).
You should use a VPN if:
- You want to torrent copyrighted material (yar har piracy)
- You want to spoof your location to get access to geolocked content
- You want to negate an attackers ability to mess with your connections on public WiFi
- You want a secure channel between two of your own locations (make two separate networks accessible to eachother, or VPN to home/work to access resources on that network).
- ^ same thing but remote access etc.
You should not use a VPN if:
- You need to hide what you do on the internet from the government (See Tor, journalists stuck in shithole regimes).
- You want privacy from internet megacorps (you’d have to keep fresh sessions or use them sparingly which you can 90% do without a VPN anyway)
- You want to hide anything after it reaches the VPN server (public VPN services, doesn’t apply if you VPN to something you physically own and access only its local resources).
–
After all that, the use case basically becomes:
- VPN to within your own country to secure your connection on public WiFi
- VPN to home or work to access network
- VPN with a good public service to other countries to watch or torrent media
-
No, the context is that for many years, shady commercial VPNs would sponsor YouTubers and the scripts they were given were full of lies and half truths about the dangers of public WiFi, with the implication being that if you purchase their VPN service they will “protect you”. But the problems these VPN companies were claiming to solve have already been solved by HTTPS and it’s perfectly fine to use public WiFi without a VPN. They are using scare tactics to sell you a product.
What this poster is saying is that they’re disappointed to see this same fear mongering misinformation from Proton, who have an otherwise good reputation for being consumer friendly.
Exactly. Using a VPN can improve your anonymity, provided you trust your VPN operator more than the infrastructure you’re using. But many VPN vendors claim a VPN is essential to provide security, which isn’t true in the slightest, and Proton shouldn’t be stooping to that level. There are plenty of good reasons to use a VPN that don’t involve illegal activities, but it’s hardly essential for the average person.
no, you can’t have intercourse over the Internet.
There are some attacks you are vulnerable to on public WiFi that a VPN can help with.
More generally, whoever is transporting your data knows who you are talking to. If you don’t use a VPN, your ISP and whoever owns the router know what websites you are visiting (although they don’t know the specific content). If you use a VPN, your ISP and router know you are using that VPN, but not what websites you are visiting. Now your VPN knows what websites you are visiting, but they still don’t know what the content is.
I hope that helps.
What about DoH/DoT which comes enabled by default in some browsers I believe? This should “hide” your activity from isp/router as well, shouldn’t it?
Yes and no.
Modern HTTPS connections send the URL you are connecting to in the initial hello, so the remote webserver knows what security certificate to use when you connect. A lot of web servers host multiple sites, especially for smaller webpages, and so it doesn’t assume that since you connected to that specific webserver, that you’re connecting to the site that the webserver is hosting, even if it’s only hosting a single site.
This can leak the data to anyone sniffing the traffic.
You can also determine some traffic by IP address, this is for larger web services like Facebook, youtube and other sites of similar size. They load balance groups of IPs for their traffic, all are serving the same data. So if you connect to an IP that’s owned by Facebook, for example, then your actions can be easily derived.
Since the connection is still secured by TLS, the content can’t be deciphered, but the location you are going to absolutely can.
It really depends on a lot of factors.
Ok, thank you and all the others for explanation.
DoH & DoT still leak the domain name (and of course IP address) you’re connecting to. The domain name leak can be solved by Encrypted Client Hello but that’s still a draft and not turned on for many servers.
The ISP will always know the IP you’re connecting to. Encrypted DNS might get you slightly more privacy for sites using shared IPs like with Cloudflare. But in a lot of cases, there’s only 1 website per IP, so the ISP still knows where you’re browsing. A VPN solves this by routing all traffic through the VPNs IP first. But you can still be tracked just the same by the VPN and to an extent, the VPNs ISP.
What about using tor instead of a vpn?
You can substitute “Tor” for “VPN” in the above and be largely correct. Tor acts like a VPN, but every packet goes through multiple hops, so an attacker would need to do quite a bit of work (i.e. compromise multiple nodes) to link traffic to you.
So:
- TLS (https) - network owner can’t see specific content, but can determine what sites you visit
- VPN - network owner can’t tell what sites you visit, but can tell you’re on a VPN; VPN can tell what sites you visit, but not specific content
- Tor - network owner can’t tell what sites you visit, but can tell you’re using Tor; Tor exit node operators can see what sites people using it visit, but can’t attribute it to an individual user w/o a sophisticated attack
In most cases, TLS is perfectly fine, provided you make sure to not click through any TLS errors (i.e. certificate can’t be validate => probable middle-man attack), and using a VPN is probably overkill. A VPN protects you from that middle-man attack, but honestly, if you’re savvy enough to use a VPN, you’re probably savvy enough to not get compromised by a middle-man attack. Likewise if you use Tor, you’re probably savvy enough to not get compromised by a middle-man attack.
That said, I fully support using Tor and VPNs, I just won’t go so far as to say someone is dumb for not using them on public Wi-Fi. Make sure you’re connecting to a real Wi-Fi service and don’t disable TLS protections and you’re probably fine, from a security perspective. If you’re likely to be targeted by a government agency, Tor is the bare minimum of what you should use.
Yup. The way I’ve always described it is this:
Http means your employer knows you watched porn on the company WiFi, and they also know which specific videos and what your username for the site is. If site security is particularly lax, they may even know your password.
Https means your employer can see you watched porn on the company WiFi, but they don’t know which video(s) specifically, and they don’t know your login info.
VPN means your employer only knows you connected to a VPN. They may be able to take educated guesses at what type of content you were viewing (streaming video, for example, has a pretty easily identifiable pattern of data transfer,) but they don’t know what video you were watching, or what site it was coming from. The VPN service knows you watched porn, but the aforementioned rules about http and https still apply; If you’re using https, they don’t know specifics.
Tor means even the VPN doesn’t know which specific video(s) you’re watching, because they just see a connection to another Tor node, which sees another tor node, which sees another tor node… Etc. In order to know what you’re watching, they would need to own every node in the chain. If they own both the entry and exit node they may be able to match it to you with a timing attack, (they see packets going into the Tor network at the same time they see packets coming out towards you). Again, they can make educated guesses based on pattern recognition, but they won’t have a clear picture without owning both your entry and exit nodes and performing a timing attack.
Now you can substitute “your employer” for anyone who is trying to get your info. Public WiFi spoofer, your ISP, etc…
Probably worth noting that, if you are using an employer owned system to watch said porn, they likely have software on the endpoint which will let them see what porn you are watching, regardless of HTTPS/VPN/Tor. Depending on how much your employer cares about such things, that may or may not come back to bite you. I’ve worked at places where we regularly reported on users watching porn on work computers, and I’ve worked at places where we only reported on users getting malware while browsing porn at work. But, never assume your activity isn’t being monitored on employer owned systems.
Networking stuff IS my strong suit, and I’m confused about what points most people here, including OP, are trying to make here. Maybe I’m just not awake enough yet.
Wtf proton what? What do people think Proton is saying and what’s the WTF part…?
Look at the link in the description.
Basically, someone went on a rant saying using public wi-fi w/o a VPN is extremely risky, and Proton is basically boosting it, implying a relationship w/ the OP. Proton argues that this is satire and part of a viral trend of misattributing quotes and topics, and the poster here is calling Proton out on it, likening them to the scammy VPN companies that sponsor YouTube videos and other SM content that oversell their claims.
So basically Proton claims they’re being satirical, and the poster is saying they’re just as bad as other VPN companies.
I don’t think the confusion has anything to do with networking. I’ve been puzzling over this post for a few minutes now… To be honest, I think I’m just more confused.
Maybe this is some sort of AI battle of the wits or contagious stroke or something.
Yes. X.509 means https is worthless protection from APTs
Mulvad.
The only effective antivirus program known to man is called a backup
How is this related to a VPN? Antivirus does nothing against a MITM attack.
Woosh
I’m saying that no system is secure on a long enough timeframe . But that if you do get infected you can nuke and pave if you have a backup. Most of these VPN advertisers treat their product VPN like a magic shield / antivirus when it is In fact, nothing more than a fancy condom.
VPN is not an anti-virus program. Also, you can’t really backup your online accounts and restore them in case they are hacked.
I am fully aware it’s not an antivirus program which is why I’m mocking people who pretend that they are. Just being on a virtual private Network does not protect you from man in the middle attacks. Sure it hardens your device against Wi-Fi eavesdropping. But you are still vulnerable to DNS spoofing session hijacking cache poisoning and SSL stripping. Aka a VPN won’t protect you from man in the middle attacks once you’ve entered a site app or network under someone else’s control.
My day job is in web hosting.
This was poorly executed. The National Park Service twitter account does jokes well.
Considering how most of the Internet is encrypted with TLS, if you add DNSSEC +DoH/DoT on top, trying to MITM someone on a public WiFi is way harder than it was, unless you’re a state-level adversary and you’re able to craft valid certificate for a domain you don’t control from a globally trusted certificate autority (which will lose its trusted status quite fast once doscovered).
Not all applications on your computer may be encrypting their packet traffic properly, though. That goes especially for the applications that might be trying to reach out for resources on your local home network (like printers, file shares, and other home servers) as well as DNS requests which are usually still made in the open. I would not recommend eschewing an entire security layer willy-nilly like that. On public Wi-Fi, I would definitely still suggest either a VPN or using your cell phone as a tether or secure hotspot instead if possible.
Sure, but it’s also like, if you’re stepping away from your laptop for a few minutes should you lock the screen or shut it down completely.
The most secure option is to shut it down completely, but also it’s fine to just lock your screen.
If you’ve already got a VPN and it’s as easy as locking your screen to enable, go for it, use it. But if you don’t, you don’t need to go out and get one. You’ll generally be ok without one.
The most secure option is bringing the laptop with you.
I mean, technically - the most secure option is irrevocably destroying the laptop everytime you have a break.
Yeah, the days of your local coffee shops Wi-Fi being a problem or mostly gone. Not the VPN doesn’t have a place anymore though. If you’re trying to hide your downloading of ISOs from your ISP it’s still a perfectly reasonable method. Or temporarily relocating yourself to another country to make a purchase or watch some streaming content both perfectly reasonable.
Of course some of the streaming providers are getting wise to this.
why would I need to hide my terabytes of Linux ISO downloads?
Because we see which distros you’re using, and we judge you for it.
Gentoo, in 2024? Really? You should be using Arch if that’s your thing. It’s not the 90s any more.
Bill Gates, man, Bill Gates
It’s all fun and games until a Microsoft Purity Enforcement squad is kicking in your door.
Nah, it’s all good I subscribe to Linus Torvalds protection services. When the Microsoft vans get within four blocks of my address, They’ll drop ship in dozens of fully-armed penguin paratroopers. After the incursion they even send in a penguin based cleaner team to help get rid of the remains.
You don’t want their admin to contact you about how you’re a n00b for not using Arch.
I have a VPN so I can securely access my home network when I’m away
Yeah, pptp will always have a strong purpose and home. I’m more speaking to the viability of commercial anonymization VPN.
I have a feeling you are using pptp as shorthand for Point to Point disregarding protocol and already knows what I’m about to say. To anyone else reading this - PPTP is obsolete and unsafe. Use an alternative such as OpenVPN, WireGuard or SSTP.
Tailscale FTW. I honestly haven’t looked at the underlying protocols in years. Was using ubiquiti’s implementation of openVPN but it seemed to get grumpy when you connect one user multiple times.
Poking around at available products, I had settled on zero tier and tailscale, I went ahead and tried tail scalefirst because it was basically free for my house. One month in, I had a few decent detectable guys at work join me on a trial there. Full licenses for everybody at work cost less than my Cisco refresh. And makes it so that the office is no longer a critical hosting site.
OpenVPN allows multiple connections if you enable duplicate-cn:
–duplicate-cn
Allow multiple clients with the same common name to concurrently connect.
In the absence of this option, OpenVPN will disconnect a client instance upon connection of a new client having the same common name.
https://openvpn.net/community-resources/reference-manual-for-openvpn-2-4/There’s also headscale if you wanna selfhost the tailscale control server:
https://github.com/juanfont/headscaleIt was allowing me to make multiple connections but they were unpredictable, I assumed it was a unified problem back in the day thanks for the information!
I use a VPN for the same reason I use the Internet. Porn.
Or the tld is .mobi
Interesting read, thanks!
I’m not online enough to understand this.
Hailey “Hawk Tuah” Welch is an influencer that gained a lot of popularity from her nickname (the sound of spitting, with HEAVY implications of performing fellacio). She used her platform to voice a very reasonable and intelligent opinion, which surprised a lot of people because her nickname is essentially blowjob queen.
One of her opinions is that it’s important to spread cyber security and used her fame to try to educate the public (potentially a fake story from the image? Idk this drama). And some xit-head claiming to be a cyber security expert ate the onion and offered some shitty advice. Proton fact checked them, because there are a ton of fake news stories about her right now.
Popular format
I’m pretty sure that Proton quoting her in the first place is fake. I know she’s milking her 15 minutes of fame for all she can, but this seems outside her experience.
but this seems outside her experience.
When has that ever stopped people from saying shit.
Sorry, not just implication; she was straight up talking about that.
Thanks for clarifying. This thread has felt like the cyber security equivalent of the Flat Earth Theory.
Hailey “Hawk Tuah” Welch is an influencer
Ah, OK, I’m out.
how do I reboot my computer?
Throw a brick at it.
That’s just turning it off with Style✨
that’s gonna brick it. it’s right there in its name.
people on the internet and their advice sometimes, ffs.
Nah, you just gotta do it correctly, yeah you might brick a few computers, TVs, cars or a couple electrical mains boxes, but once you master the technique you’ll be able to restart anything.
We call that percussive maintenance… the brick is optional.
What is he talking about, public WiFi can easily poison and monitor your DNS requests (most people don’t know or use encrypted DNS), and there’s still tons of non-https traffic leaks all over the place that are plain text. Even if encrypted, there’s still deep packet inspection. VPNs can mitigate DPI techniques and shift the trust from an easily snoopable public WiFi to the VPN’s more trustworthy exit servers.
This guy really needs to elaborate on what he’s trying to say when the cyber security field very much disagrees with this stance. I’m not a huge fan of Proton, but they aren’t doing anything wrong here. You should use it for public Wi-Fi.
Dpi only works if they install a cert on your phone. Else they can’t crack it (in real time) or you would receive HTTPS errors
You dont need to examine the contents of http traffic to do what many services call DPI.
you can still read unencrypted traffic, like most DNS. Or even without that, you can frequently tell from the endpoint IP who someone is talking to, and what types of applications from port numbers used. Etc.
If you’re torrenting, for example, that’s pretty easy to see.
Still not DPI. Regardless of what other manufacturers or devs call it.
At best it’s a network monitor. Literally pihole can give you most of those stats as well.
most people don’t know or use encrypted DNS
But a cybersecurity expert does. That’s the point. If you know those things, VPNs become obsolete, for most people. So why not teach people about it, instead of promoting VPNs?
And can you really trust an extremely profit focused company, that is built on user data, more than your local Café? If you’re in China, sure, use a VPN, they’re the lesser evil. But most spots don’t have the resources or expertise to analyze and sell or otherwise misuse your logs. VPN companies not only do, most rely on it.
If you’re a highly targeted person, it’s another story, but in that case your only hope is Tor or a new identity.
Proton is a non profit.
But Proton Bad? I don’t understand. The armchair security nerds on Lemmy want me to hate something.
I agree here. It’s clear that some people here really want me to be outraged at SOMEONE, but dont seem to really understand who or why.
Lmao, we’re not worried about the cafe. We’re worried about the man in the middle. And yeah with enough tech knowledge you can set up an encrypted tunnel home and use your normal connection from there. But most people aren’t that tech savvy
If you’re not relatively tech savy, a typical VPN IS the man in the middle. That’s the problem. A VPN, in itself, is very good. But as you said, non-tech savy users won’t be able to set up a VPN themselves, so they need to trust a company to route all their traffic, be their DNS server, not log anything, not be hacked and not give any data to current or future totalitarian governments. Not even I could recommend any VPN company that fulfills enough points there, especially the security related ones.
For the average person, data sales aren’t the worry. Heck their phone is already recording everything. The worry is straight up criminal enterprise, like keylogging bank passwords. If the VPN company is doing stuff like that then they’re going to eat a RICO charge. Most people really don’t care that their data gets sold.
And then just setting a private DNS and checking “the little lock at your address bar” fully prevents any digital sniffing of your credentials. No VPN needed.
But most spots don’t have the resources or expertise to analyze and sell or otherwise misuse your logs.
Most spots don’t have also the resources or expertise to secure their own spot. As I remember, cheap routers used in public places may contain a lot of vulnerabilities.
encrypted DNS
Will it help me if I’m using LbreTorrent do download piracy content on my phone? Or how it would help me to hide my location from mobile apps that extract location from IP?
No. That’s a whole different use case. We’re discussing what most people in a public network should do. Some people, such as whistleblowers, journalists etc. maybe should use a VPN. For you grandparents, it would be pure snake oil. And even as such an endangered person, choosing the wrong, so almost all, VPNs would be even more dangerous.
For your problems, a VPN could be useful, even though for the former I would use the usenet or soap2day-like sites, which do not have you seed that content. If you still want to share it, then use a VPN. ONLY for the torrent process, not for anything else, as that would still be bad for privacy and security, as the VPN company could, and most WILL, surveil and log you. And for the latter problem, don’t use such apps except in closed environments or without internet access.
And for the latter problem, don’t use such apps except in closed environments or without internet access.
While that is a right answer, I do not want to avoid such apps because I need them. I need my mobile bank app, I need google camera, sometimes I need Google maps, etc. For me using VPN to hide my real IP from greedy apps and to hide DNS requests from the cracked public WiFi is still a good tradeoff between security, privacy and my own user experience.
If it works for you, and you found a VPN provider you can trust, or at least have the feeling of that, great! That is one of the very rare use cases where VPNs are not only useful, but actually have a purpose.
On a broader scale, most people won’t find a trustworthy VPN, and would use it for way more than they need to, essentially giving all data to the VPN company now, instead of just to the local Café or google.
And for the bank app, there is no replacement. Google’s camera can be replaced by OpenCamera, or just disallowed to access the internet, and google maps can almost perfectly be replaced by organic maps
I have Pixel with GrapheneOS and I tried most of FOSS camera apps, but all of them are still far behind the GCam. I hope one day there will be a good replacement, but not today.
I’m using Organic / OsmAnd for most of use cases and daily navigation. But if you need to find a specific office, shop, food or ATM nearby you still need GMap from time to time…
Doesn’t Graphene not support Gapps at all?
Encrypted DNS doesn’t solve everything. Handshake for TLS sessions is still in clear, you can usually see the SNI, and since we are talking about Wireless, usually this data is available to anybody who is in the vicinity, not just the network owner. This already means that you can see what sites someone is visiting, more or less. TLS 1.3 can mitigate some of this (for those who implement ESNI, but you don’t know that beforehand). Also TLS works until the user is not accepting invalid certificates prompts (HSTS doesn’t work for everything) and there are still tons of HTTP-based redirect (check mailing newsletters and see how many first send you to an HTTP site, for example) that can be used for MiTM attacks.
A VPN moves the trust to a single provider that you can choose, which is much better than trusting every single WiFi network you can attach to and the people connected to it, I would say.
Also if you pay for the VPN (I pay Proton), it’s not true that the company business is based on user data, they are based on subscriptions.
People can’t learn not to throw trash in the street, climate change that is backed by decades of science is a problem, or hell, they can’t even learn to effectively not click on super suspicious phishing links.
How on earth are they going to learn about implementing encrypted DNS when most barely know the difference between a browser and a computer.
Then they won’t know what a VPN is either.
99.9% of people don’t throw trash in the street.
At least in most countries.
So why not teach people about it, instead of promoting VPNs?
Ok then, in the meantime the rest of us will use a fucking VPN? I don’t know what “encrypted DNS” means, and I’m 99% you’re going to respond with either “whaaaaat you don’t know something that 99.999% of other people also don’t know? Clearly you are too dumb for the internet” or else “oh sure I’d be glad to explain that! It’s real simple, see when you have a Rosendin gembal, it befrazzles the gesticulators of your brangles (link to a Wikipedia article on brangles). So you just have to re-delineate the scanditrons to break the tensor lines in your scintrins! You can code a fairly simple app from scratch to do it, and there’s a FOSS program someone made to help you identify the cabangs in your computer’s lenticles: (link to a github page that is literally just a transcription of an eldritch god screaming in binary)”
VPNs are extremely user friendly and they are happy to explain in layman’s terms exactly what they do and how they work. If there’s a better way, it’s locked behind years of techie knowledge.
And most users don’t know what a VPN is. In both cases, they’re not gonna learn anything about it. Except you need to pay for a VPN, after figuring out which one is kinda trustworthy instead of snakeoil, while encrypted DNS is a simple setting on any OS. Nothing more. You don’t need whole articles to explain what your product does and why you respect privacy and blah, while not saying a single word that’s true. It’s a simple setting. VPNs are not only user friendly, they’re a full ripoff for most people and snakeoil. They don’t explain what they do in “laymans terms”, most of them just blatantly lie. Anything for the cash. If you want an explanation of encrypted DNS:
A DNS is kind of like your GPS. It translates an address into something more usable, e.g… like your GPS translates ‘123 Baker Street, Washington’ into coordinates, so you can use it on a map, for example. A DNS does the same, but for the internet: It translates “google.de” into a format that is actually readable and usable to the computer. However, to translate “google.de” you need to reach out to someone else, that knows the address. The thing is, if someone just pretends to give the right answer, but in fact gives you their own address, you may end up at the wrong website, or in the GPS example, at the wrong house. So instead of visiting your actual bank’s website, you’re going to visit someone else’s website, which looks basically the same, except once you log into your bank account the attacker can read that and steal all your money. In the GPS example, you would now be at the slaughterhouse instead of Disneyland. An encrypted DNS just means that you specify exactly whom you will trust, for example google, and that you want your communication with google to be encrypted, so no one can even read which website you want to visit.
If someone doesn’t understand this, they wouldn’t understand what a VPN is, even broken down to bare concepts. So for those people: It makes you safe just trust me just set this setting, no app, no account, no money required. Because that’s the level a typical VPN company argues on.
It seems like your whole threat model is avoiding DNS poisoning, which is fine, but I fail to see how you can compare using DoH/DoT to a VPN.
so no one can even read which website you want to visit.
Except for the DNS provider (in your example, Google, so… yikes), the operator of the network you’re on (since the destination IP can be rDNS’d or WHOIS’d, or simply grabbed from the Host header if your browser still tries HTTP first). Any traffic that is not encrypted will be snoopable. Traffic volume and connection times to each destination can be analyzed.
By contrast, a VPN will also use secure (if you trust the provider ofc) DNS servers for your requests, plus making all of the traffic completely opaque except for “going to this server”.
no app, no account, no money required
You can also make your own, free VPN service with a little technical knowledge.
Yup. You can grab any unencrypted data passed between the user’s browser and a server literally out of thin air when they’re connected to an open access point. You sit happily at the Starbucks with your laptop, sniffing them WiFi packets and grabbing things off of them.
We need a switch like Firefox has that disallows anything non-HTTPS, but from the phone level. Companies like Apple and Google could also eventually warn apps that they’re going to make it the default setting.
Apps don’t use the system browser to connect to REST endpoints. Neither do they use the OS. Apps typically use a statically linked library. There are use cases for HTTP-only connections so it’s unlikely that those libraries would mess with forcing or even warning its users that they’ve used HTTP instead of HTTPS. Point is Google and Apple can do little in this regard. Unless they scan apps’ source code which could be possible to some extent but still difficult because URLs are often written in pieces.
Sure, I didn’t say they use the system browser - I said the opposite. I’m saying the OS should be able to block non-HTTPS connections. If you have control of the OS you can control what protocols are used by apps, unless I’m missing something.
What cases are there for non-HTTPS? I can’t think of any. It’s 2024. All communication should be encrypted.
The OS interfaces provided to apps (generally POSIX) have no idea what HTTP is. They’re much lower level than that. If an OS is to control what protocols are used by apps, it has to offer some functionality that does HTTP for the apps and apps have to use it. Unfortunately the only way to force that would be to disable the general OS interfaces so that apps can’t just use existing libraries that use those. If you did that your OS would become useless in other ways that rely on the basic interfaces.
The other way the OS could do anything about it is to inspect network traffic going over its network interfaces. That would be a significantly different can of worms and it’s not free in terms of processing power and therefore battery. Then you’d have the screams of privacy people that Android or iOS is looking at all network traffic.
So all in all, the OS isn’t very well suited to police application level protocols like HTTP. At least not on devices whose primary purpose isn’t network traffic related.
Just FYI https://shop.hak5.org/products/wifi-pineapple. There are ready-made devices that can do basically what you are describing!
Oh nice. Just gotta dress em up like Unifi or Aruba then stick em up on the ceiling.
Yep, my partner gave one for my birthday, it’s basically plug-and-play. It can automatically harvest credentials, spoof captive portals, etc. I bet that in most places nobody would question something like this hanging on the ceiling indeed.
Also, any unlatched, unfirewalled vulnerabilities you have are immediately available to anyone on that local WiFi network. One thing VPNs may do is cause you to ignore requests from systems on the local network, which helps.
That’s an interesting one. I know it depends on configuration, but in the run-of-the-mill case, does connecting through VPN stop local services to listen on local IPs? I know our corpo VPN kills local LAN access but I’m curious what the default for OpenVPN/Wireguard might be.
Yeah, while it is true, lots of VPN companies are grifts just buying VPS’s and installing OpenVPN, this “Cyber security expert” puts far too much faith in HTTPS and probably never seen a lecture from the Black Hat conference
Many VPNs using OpenVPN is…fine.
The value adding is the VPN infrastructure they’re providing. You can’t just install the standard OpenVPN client and expect it to DO anything without some kind of service.
True on the HTTPS thing.
probably never seen a lecture from the Black Hat conference
Not defending Robert Graham because I’m also eyebrow raising his statement. And while you may be 100% correct that he never actually stayed to listen to a lecture, he absolutely spoke at a lot of them since 2000.
My bad for judging without checking 😔
How is DPI a problem if it’s encrypted? That would only work if the attacker had installed their CA cert on your client machine, right?
I’m doing DPI on my own network and I can still view TLS certificate fingerprints and some metadata that provides a good educated guess as to what a traffic flow contains. It certainly better that it’s encrypted, but there is a little information that leaks in metadata. I think that’s what was meant.
True, but this is generally not useful information to anyone. They can see you’re visiting bank.com, but they still can’t see your bank details.
It might be useful if they’re trying to target you for phishing, but a targeted attack is extremely unlikely.
Client isolation doesn’t help. That is just the access point not routing traffic between connected devices. The problem with WiFi is it is a radio signal. Everybody in range can receive 100% of all communication on that network. Just by being in range the attacker can do passive sniffing. No wiretap needed like with cabled networks.
WiFi is encryoed if it uses a password. So any public WiFi without a password can be sniffed by literally every device in range (no need to connect to the WiFi for sniffing). On public WiFi with a password, the radio signal is encrypted but everybody knows the encryption key. So everybody connected to the WiFi can still sniff the traffic of everybody else.
That encryption is only on the WiFi level, so encrypted radio signals, not on the actually traffic level (like TLS/HTTPS etc).
Yeah, deep packet inspection really doesn’t work without breaking https security via man in the middling everything.
I think it might be confusion between inspecting plaintext metadata like SNI vs actually inspecting encrypted contents (e.g. HTTPS content, headers, etc.).
I’m not even an expert in this stuff, but with a tool I found online I demonstrated that it was easy to snoop people’s passwords on my school’s wifi networks back in the day. It took minutes.
That must’ve been quite a while ago
I mean, yes, I’m in my 40s, but it’s just as effective today.
I guarantee you it’s not.
I’m sorry, but I don’t believe it is. Nearly all traffic is TLS. When this is attacked, you’d get TLS error. Am I missing something?
There exist plenty of services on school campuses that send passwords in plaintext. There are services outside of school campuses that do, too. Hell, I’ve been able to bypass 2FA checks by just navigating around them, I don’t know what else to tell you, not everything out there uses the best security practices, so don’t assume that they do.
This was nothing more than a poorly executed joke from Proton. Some people are massively overreacting.
How could one have known that this was meant as a joke?
I like Proton but to me it seems like the social media person from Proton did an oopsie and as a reaction they try to save it.
The only real use case for VPNs is to bypass geo blocking on streaming sites, and the VPN providers know this. They also know that if they lean too hard into that, eventually someone will sue them and their business model will evaporate - so they add the “iT MaKEs yOu mORe SeCurE” nonsense as a fig leaf so they can say with a straight face that they operate a product with legitimate uses
I can’t say VPNs are great for bypassing geo restrictions in 2024, unless you’re talking about tunneling through your home network.
That is definitely what 90% of people use them for.
I think Tom Scott is the only person who’s ever done an honest VPN sponsor read.
Taking cybersecurity advice from someone called Hawk Tuah is modern day version of clicking banner that says find 40+ single women in your zip code
Hot MILFs wanna talk to YOU!
"It’s a prank bro"😅 but seriously as an IT guy I’m tired of pushing VPNs down our (collective) throats, not saying the threat isn’t real but it’s really overblown by the ads
Just free, unregulated market shenanigans.
Better to have ads pushed down our collective throats than let collectivists have us by the throat. An ‘unregulated’ market lets us choose whether or not to use them, instead of justifying their necessity to avoid censorship.
I have a vpn for… reasons… 🏴☠️⚓️🏴☠️
I have VPN so I can look at porn.
Dude!
I just wanna look at me Japanese cartoons
why?
or Utah
Texas ig
Yup, browsing on lemmynsfw is interesting, because redgifs automatically blocks Texas IPs. So it’s a nice handy reminder to enable my VPN, because gifs refuse to load.
Wow, I left the US ten years ago, I had no idea it had got this bad. You need a VPN to browse porn? :(
Land of the free
It depends on your state. There’s a handful that passed laws requiring porn sites to verify age via ID. Several sites have just outright banned them based on IP as they don’t want to deal with the privacy nightmare.
Then sometimes you’re like me, living in AZ, not even on a VPN, being told “You Texans should be asking for ID” and just wondering how the fuck that’s happening
What’s AZ? Azerbaijan?
Also - using someone who got famous by describing sucking dick seems quite weird :) Who wants technical advice from her?
That’s the joke.
What does sucking dick have to do with technical competency?
