Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I visit the website which uses https, is there a point using an VPN? In places like coffee shop where internet is not secure. Because I think https already encrypts data?

share|improve this question
up vote 8 down vote accepted

Some VPNs actually establish there connection via SSL. SSL really is a sort of VPN between you and the server, so as long as you don't mind people knowing that you are talking to that server and you don't mind the site knowing your IP, then you are fine to just access it directly.

If you want to avoid letting anyone know what system you are talking to or you want to have a VPN act as a proxy to protect your identity (from the site you are visiting) then you would still need a VPN.

share|improve this answer

A VPN would provide another layer of security. Someone local who is eaves dropping on your HTTPS session would be able to capture the metadata (e.g. what website you are going to). If you are tunneling through a VPN, they would not be able to obtain this metadata as the whole packet gets encapsulated, thus hiding the target website.

Going through a VPN would also protect against some local attacks on TLS / SSL, such as the recently disclosed BREACH attack on your HTTPS session: Reference: As well as other local attacks such as hijacking your initial SSL handshake negotiation, and replace your list of available ciphers with one that is weak, thus downgrading the security of the session.

For additional reading on this, I suggest checking out the following link

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.