Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I know that VPNs are the standard way to secure communication between a remote user and their primary network, but I've never felt entirely comfortable relying on them when using an open wireless network, like at a coffee shop or airport. Even though I know the connection is encrypted, the fact that it can easily be sniffed makes me too nervous to connect to any important systems.

Is that fear unfounded, or is it a good idea to avoid transmitting sensitive information over the air, even when it's encrypted?

I guess the bottom line is, would you feel comfortable logging into your bank's website from a coffee shop, as long as it was tunneled through a VPN? (For the sake of simplicity, assume that the VPN is properly configured, physical security isn't an issue, etc... the scope of this question is just the VPN's role).

share|improve this question
1  
As long as it's certificate based and it gives you a warning if the certificate doesnt match, and you train the user, it gives some extra protections. PPTP can be hijacked with MITM while OpenVPN will show a warning. –  Andrew Smith Aug 2 '12 at 16:26

2 Answers 2

up vote 4 down vote accepted

With due considerations to the recent developments in terms of PPTP based VPN connections that lead to compromise of data, usage of Wifi under a VPN is still highly secure for a number of reasons.

Firstly, if you're a casual user who's performing Internet Banking, the practical overhead of performing the exploit procedure and then the decryption of the captured data is quite significant. No local coffee shop hacker would do it, and professionals wouldn't be interested in spending his time on you.

If security is absolutely critical to your transactions then, there are a number of simple additions:

  • Ensure that the VPN connection is at least an AES-256 with certificate authentication. Do the usual checks to ensure that the certificate is not compromised to a MiTM attack. Eg OpenVPN
  • Keep the sessions inside your VPN connection them self encrypted. ie. Don't use HTTP, use certified HTTPS, replace FTP by SFTP, etc.
  • VPNs are over-rated as per me. A good SSH tunnel configured properly works as a lower cost and light weight, easy to deploy solution for encryption. Plus you channel it through your rented server and if you have the need and resources you could for example, setup any custom modifications of the encryption procedure. I'm not encouraging obscurity, just saying you don't have to limit yourself to the current textbook compliance procedures and thus use infamous but more secure encryption techniques.

My point being, for banking, the chances of an attacker being able to break through a VPN encryption, then say a SSH tunnel and then finally your HTTPS web page traffic is extremely improbable, even for highly confidential EOW data.

And even then, banking sessions generally last for a few minutes at max. Apart from certain broken information, there would be no way in any practical banking system with even basic security to use that in order to steal money from you or hack you.

share|improve this answer
    
Actually in my Cafe this is the case, it's next to university and there is LOADS of hacking all the time, especially chinese students, they even hijack the cash machine. –  Andrew Smith Aug 2 '12 at 17:35
2  
Andrew, reading/learning about security theoretically makes stuff look easy. But rest be assured even a professional would rather social engineer you into getting your credentials then go through a VPN and then a HTTPS connection. It's simply not that viable without major funding/resources. –  Rohan Durve - Decode141 Aug 2 '12 at 17:39
    
But PPTP attacks are trivial now for 10 years or so, and every some time there is something new about it. PPTP is considered unsecure for a very long time and I guess the OpenSSL in OpenVPN is no better either. –  Andrew Smith Aug 2 '12 at 17:45
1  
Practical security is different from theory. You can't ask clients to compromise usability due to security. And you need to provide solutions, not only critics. Nothing is ever truly secure, but using a VPN + HTTPS is secure enough for banking transactions against people that are collecting packets on a WiFi network at a coffee shop. It's a whole set up for normal citizens that use plain text. –  Rohan Durve - Decode141 Aug 2 '12 at 19:00
1  
@AndrewSmith "REST and so on" can you explain, or at least give a link? –  curiousguy Aug 3 '12 at 1:41

Yes, as long as good ciphers and protocols are used. However, the most popular VPN solution, PPTP with MS-CHAPv2 (Windows compatible PPTP), is considered insecure since a few days ago.

https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/

I'd recommend using OpenVPN with AES-256 and certificate authentication.

share|improve this answer
    
Moxie gave it to us all. But I'd imagine it's been broken since DES was cracked really. –  Ori Aug 2 '12 at 22:25
    
What about ARP Spoofing? Are MITM attacks still possible, or are they still too difficult due to the encryption layer? –  king_julien Oct 30 '12 at 19:30
2  
If you are using server authentication in your VPN client (using certificates) and someone is pretending to be your VPN server, your VPN client should give you a warning and refuse to connect. Once the encrypted connection is established between you and the VPN server, the attacker can do very little, unless the encryption is very weak (DES). –  Matrix Oct 31 '12 at 11:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.