Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Tunnelbear is a VPN with an easy interface to choose your country IP - https://www.tunnelbear.com/

On installation it installs a network service.

When the app is turned off would it be able to access any passwords etc? I dont know what the network service does or can do.

When using the VPN is it secure to use passwords? Tunnelbear say they encrypt data but do they themselves have the ability to decrypt this data?

share|improve this question
    
possible duplicate of What are the pros and cons of a VPN for privacy –  Simon Sep 16 '13 at 14:24
8  
You can trust anything that has a bear in its title or logo. –  Adnan Sep 16 '13 at 14:33
    
Thanks for the link on VPN privacy, but my question is security not privacy. I dont see any answers about security of sending credit card details over VPN etc, or more specifically what this VPN does with its network connection –  Jon Sep 16 '13 at 14:45
    
@Jon While you're using VPN, you're securely sending data from your computer to the VPN server. In most cases, VPN is pretty secure, the problem is with the VPN provider; do you trust them? Thus, your question is a dupe. –  Adnan Sep 16 '13 at 14:56
    
well maybe someone knows tunnelbear and says they are trustworthy? Or has installed & investigated their software? –  Jon Sep 16 '13 at 15:04
add comment

closed as primarily opinion-based by Lucas Kauffman, Adnan, Xander, TildalWave, Gilles Sep 16 '13 at 19:47

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

The application which you "install" to use the VPN service is local code. If that code is hostile, then you have lost: as soon as you run malicious code on your own machine, that malicious code can more or less hijack your whole machine.

Theoretically, if you run the code as a non-privileged user, and your operating system ensures perfect isolation against non-privileged local users, then you might recover from running malicious code without reformatting your complete hard drive. However, this is not a reasonable foundation, because no practical OS succeeded at enforcing such an isolation. All OS have local privilege escalation holes. Moreover, a VPN must hook itself in the OS network subsystem, which will require some non-trivial privileges, so the point is moot.

Assuming that the TunnelBear's application is not malicious, then the VPN, being a VPN, protects data only in transit, between your machine and the VPN exit point, on TunnelBear's servers. These servers, by construction, see all your data unencrypted. A VPN (when done properly) is like an armoured steel tube between your machine and the exit point; it does nothing whatsoever for traffic beyond that exit point.

If you want to protect your data against inspection by the VPN maintainers, then you must use end-to-end security with whatever machine you are trying to contact, which basically means SSL (i.e. HTTPS). This begs the question of why you would want a VPN in the first place, of course.

share|improve this answer
    
I was not so concerned about running the exe. It is a commercial program tested for ware etc. This program offers a simple interface to change your IP location, which is handy for me in certain situations. But if I send CC info, or login to email or amazon with password while using the VPN what risks am I looking at? –  Jon Sep 16 '13 at 15:20
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.