Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My ISP is rubbish and the state of the internet in the UK seems to be heading to 1984. I've started looking at VPNs and stumbled on IPredator as a cheapy test.

It gives you the option of OpenVPN and provides a guide for Ubuntu.

Part of the guide involves downloading a certificate and its private key. You download it over SSL but the certificate isn't unique to you the user. Anybody can go to that page and download both halves of the key.

This question really comes from not understanding how OpenVPN uses TLS but...
How is the connection secure if a malicious party knows the encryption details and keys?

(Can somebody add the openvpn tag to this? That seems like it should be a valid tag here.)

share|improve this question

1 Answer 1

I've just been talking with the IPredator guys on IRC and it's quite interesting. I've made some incorrect assumptions.

As part of the installation process you add their CA. That's fair enough. So the whole connection happens through RSA (or similar) public-key encryption.

The key-pair is just an additional TLS encryption layer for authentication. They freely admit it offers no additional security for users but it does mean that anybody trying to connect needs that pair of keys. Requiring them has meant a sharp drop in connection-style DDoSes.

So it is still secure. The key-pair is just some additional security-through-obscurity.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.