Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This is causing me major concern and i can understand it is for a lot of users as well. I have nothing to hide but it's the moral aspect of snooping which has ticked me off.

Can a VPN avoid the Prism Surveillance Programme?

Meaning will a VPN prevent the exposure and collection of personal data?

From my understanding it prevents the tracking of visited sites and physical location but can it do more than just that?

share|improve this question
1  
I would just encrypt your personal documents. A VPN will only protect your browsing history, and unless your hdd is encrypted, is sort of pointless. Unless you encrypt all data not on your own physical hardware somebody somewhere has access to it. –  Ramhound Jun 11 '13 at 11:43

4 Answers 4

up vote 11 down vote accepted

There isn't really enough information out there to know exactly what is being collected, but if most of it is meta data in nature or user records from services, then a VPN isn't really relevant.

For the first situation (phone/Internet connection meta-data), the contents are not being requested, but only what connections are made. While the contents of your IP traffic are protected by a VPN, unless a time delay is incorporated, it is fairly easy to match an incoming and outgoing packet based on timing in most cases. Thus, it would likely still be completely possible for your VPN traffic to be traced without revealing the contents.

As for the access to user data, if you are putting information out there and it is associated with your account on one of the companies, there has never been reason to think that the government couldn't get it if they had a legitimate reason to need to and a VPN wouldn't help there at all.

The real question raised by the PRISM disclosure isn't so much if such mechanisms are possible (It's been very well known that it COULD be done and that in itself isn't news.) The news is the scale at which they have been doing it and the question is if the government has a right to do so or not.

share|improve this answer
4  
+1 for the "It's been very well known that it COULD be done and that in itself isn't news." People is upset with the PRISM disclosure like if it was something new. –  yzT Jun 10 '13 at 14:19
    
Backdoors into Google, Microsoft, Apple etc. This is new. –  Ke. Jul 22 '13 at 10:19
    
@Ke. - the idea that the government could get information from private parties that agree to work with them isn't really new either, and the idea that they would work with a lot of the big companies to reduce costs of requesting information by putting in an automated system isn't surprising, it's good business (as long as it doesn't become a public scandal.) Why pay for a team of dedicated customer support staff to process government requests when you can just give the government access? (from the businesses perspective) I'm not at all shocked. –  AJ Henderson Jul 22 '13 at 13:25
1  
@Nitrl - It should be assumed that ISPs that provide connection to the VPN are going to cooperate with law enforcement, if so, the data going in to the routers and coming out of the routers can be matched up based on time and traced that way. If the network is low latency, I send VPN exit node a packet and it immediately sends it out again from itself. Anyone that has visibility of the routing of both the incoming and outgoing packets can put two and two together than the incoming request was forwarded. –  AJ Henderson Aug 11 '13 at 1:10
1  
@nitrl - for example, if you route through, say Iran, then to friendly border routers they might see traffic going in from unknown A, B, C and D and coming out going to E, F, G and H. The next packet, they see packets from B, C and D going to E, F and G. The next one they see packets around the same time from F and A going to G and H. By process of elimination, most likely A is talking to G. To get around it you either have to have a larger unfriendly pond or incorporate latency (which also increases the size of the pond.) –  AJ Henderson Aug 11 '13 at 20:09

If your data is stored at an endpoint which PRISM has access too, then there is little you can do and not even a VPN will work.

share|improve this answer

The answer (is a VPN secure?) depends on a lot of factors. For example, if using Checkpoint, you can decrypt, and view traffic on the wire, right from the CLI. There are also appliances that can do similar depending on how the VPN is configured.

When I state "depending on how your VPN is configured", this boils down to the set-up. If you're using an SSL certificate for your VPN, there are plenty of devices that can pivot into a session without detection. As well as mechanisms to detect and defeat that too. (Detecting and Defeating Government Interception)

The LIKELIHOOD of being targeted though is 1 of N_Billion (where N_Billion, equals the amount of IPs in the world). The cost do undertake a NON-SSL-VPN, is high. In that scenario, there ARE attackable vectors, but the feasibility of pulling them off is low. Besides, would you spend N_Million amount of dollars and man hours to see a message that is already useless.

EDITED TO ADD CLARITY TO THE CHECKPOINT CLI COMMENT see below

Supposing there is ABSOLUTELY no mechanism to break a VPN. It all goes down the drain with an insecure/misconfigured/poor password firewall. Same applies for each endpoint of the tunnel. For example, if someone manages to exploit at an endpoint via a client side attack , the VPN tunnels are useless as an attacker is now no different from the end-user

share|improve this answer

The word on PRISM is that organizations like the NSA are capturing metadata and using it as a basis for possible terrorists. Depending on whether you are talking about VPNing from your mobile device, say a laptop in a coffee shop or a company smart phone, back to the main office then all traffic that would be tracked going out of the phone/laptop would be destined for the main corporate office.

On the flipside of that, all the metadata could still be tracked coming out of the corporate internet connection.

There are VPN providers that you can pay for that allow you to choose fun stuff like an exit node in various physical locations. The benefit of this would be that the data would be encrypted and useless coming out of your personal internet connection. Though it could still be obtained at the VPN provider level.

No matter how many layers of VPN you go through, there is always going to be an exit node and they would just have to track it link by link (which according to PRISM they would have everything they would need to do so) till they get to the end.

This brings up some interesting (though slow) solutions like a TOR proxy, which allows you to pick two random other people using this and your traffic gets encrypted then sent out, received at the first middle node, this repeats for a second node, and then goes out to the final node. The exit node, where in regular plain text goes out to you destination. It then gets it's response and sends it back down the pipeline (after being re-encrypted)

The beauty of the TOR solution is that you and no one knows where the data exits. The downside is that considering they have a whole internet's worth of data, they could theoretically piece this together based on the whole of the metadata, but it would always be encrypted (PKI which is hard to bruteforce) until the very last step. The other downside is you may end up the endpoint of someone downloading kiddie porn.

Long story short, the only way you can legally avoid the PRISM spying scheme is to have a VPN connection that is outside the reach of the NSA and will not cooperate (think what thepiratebay does with copyright infringement notices) with this kind of crap.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.