Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

While in Germany, I want to keep using my Netflix account, watch PBS, CNBC. I have found following services:

A VPN: https://hidemyass.com/vpn/promo/1/5/

A DNS: http://www.unotelly.com/unodns/

I an concenred about someone stealing my data trough a man-in-the-middle attack. Should I use any of these services?

I know that HTTP traffic is fair game. What about HTTPS? Would anyone be able to steal my online banking password or Gmail credentials?

share|improve this question

7 Answers 7

up vote 3 down vote accepted

What about HTTPS? Would anyone be able to steal my online banking password or Gmail credentials?

You shouldn't worry about this unless you make it a habit of installing forged certificates.

Furthermore....

If you are on a wireless connection which has a password and the proper security modes enables ( WPA, WPA2) the only way to hijack your information is to connect to somebody else pretending to be said access point.

If you are viewing a https page you are safe.

share|improve this answer
    
HTTPS can be hacked in this MITM scenario if the CRL or OCSP response is cached or replayed. That would assume that another trusted CA was hacked. It has happened before, see security.stackexchange.com/a/2273/396 –  makerofthings7 Jun 12 '12 at 12:58
    
@makerofthings7 - I indicated that is the one weakness of WPA and WPA besides brute force of course, is that IF you connect to forged access point, you are vulerable. –  Ramhound Jul 5 '12 at 18:34
    
Please note, that instant proxy services (such as HMA) see all traffic in clear-text. If you have a look at the URLs of instant-proxies, you will see: https://anon-service/https/real-server/real-url. So your browser has an encrypted connection to the anon-service and the anon-service has an encrypted connection to the real server. Using a traditional proxy will ensure an encrypted connection from the browser to the real server, unless the browser accepted untrustworthy certificates. –  Hendrik Brummermann Dec 31 '12 at 17:13

I think the chances of a man-in-the-middle attack are very low. The chances of your government monitoring your internet habits during VPN usage varies among VPN providers. Here is a good article on this subject:

http://torrentfreak.com/which-vpn-providers-really-take-anonymity-seriously-111007/

share|improve this answer

Why waste time worrying if you can trust them or not?

Just turn those services off before doing anything involving sensitive data.

share|improve this answer
    
What if he wants to check his gmail while he's watching a movie? –  pguardiario Oct 28 '13 at 23:55

As long as the certificates turn out to be correct you have nothing to worry about. On HTTP it is as insecure as any normal routing services. Everyone that owns a routing node can sniff the traffic if they want to.

SSL strip is possible for some sites but there is a protection against it built into browsers (see this question Options when defending against SSLstrip?).

share|improve this answer
2  
A question on SSLStrip has been answered before if you're interested in more information. security.stackexchange.com/questions/2113/… Alternatively the EFF's HTTPS Everywhere tool is quite nice. eff.org/https-everywhere –  SomethingSmithe Apr 5 '12 at 14:15
    
Ah yes, thank you! –  Lucas Kauffman Apr 5 '12 at 14:19

Anything sent over HTTPS is secure unless you leave compromised certificates installed, or manually install untrusted certificates. If you never install certificates yourself, and keep your OS up-to-date, you don't need to worry about HTTPS traffic.

Note, however, that even though such a VPN service cannot see the contents of your SSL traffic, they can see which servers you contact - this means that they will be able to tell that you did visit your online banking site, etc., but they won't be able to tell what you did there.

This may or may not be an issue; if it is, consider using Tor, tunneling through your home network, or simply turning the VPN off when you do things you don't want them to know.

share|improve this answer

I highly recommend UnoDNS. I have been running it since January and no issue so far. You can check out their privacy policy if you are concerned about security.

Honestly, nowadays, you are probably losing more information to Facebook and Google than any other companies combined. These smaller players can't really do much with your data unlike the big guys...

About your actual HTTPS question:

No, unless they are really good enough to break the SSL encryption which is nearly impossible for anyone other than a state-sponsored organization. These small time players have no incentive to hack you or whatever because remember, their goal is to provide you with a service and in-exchange, get few bucks a month from you. However, I would be more alert if the service was free instead of Paid.

share|improve this answer

Nothing is 100% secure. However, you can use a few technologies together. For example: using VPN over Tor. Hidemyass is known for privacy issue. You can read it here:http://invisibler.com/lulzsec-and-hidemyass/

HTTPS is mature and secure to use.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.