Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I live in a country that the government blocks most ways of accessing to the uncensored Internet (like blocking VPN pptp, l2tp), Luckily there are some very fast services still available like Kerio VPN.

But as I found out, It does not seem to be very safe as the person running the service could easily track your activity.

My question is, Is it possible for them to access to our information such as transferred data or passwords and such... ?

Is there anything you would suggest to prevent this?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Once you connect to a VPN service, they can record what they wish. A potential way around this is to VPN the VPN, if the service allows it (most do not). An alternate method is to connect to Tor from within the VPN connection, if the service allows it.

Secure connections, like https, should be encrypted, so passwords transmitted in that way would be recorded, but not in the clear. The goal is to keep as much control as you can so that you can make it difficult for your VPN provider to understand what is being passed through their network.

share|improve this answer
    
Tor endpoints can still sniff your data if it's not secure. You could also connect to Tor, then your VPN. Either way, if your data is insecure, you could be SOL. You could rent your own VM from a cheap provider like DigitalOcean starting at $5 USD / month, then install VPN software, but if DigitalOcean wants to sniff your data, they could. TLDR - Use HTTPS. –  Mat Carlson Mar 21 at 11:18

When you connect to a VPN, you are connecting to private network, but your network is only private from the greater network/Internet. Inside of the network, you have no additional protections - you are not private to the other members of the network.

You can still use HTTPS/TLS/SSL to encrypt your connection from your PC to the server you want to connect to, but this does not necessarily equate to privacy. Depending on the setup or other factors, you may be exposing yourself to more MitM attacks (ala BEAST) because the path is no longer your PC to your ISP to the interconnections - you have added another network in the middle. Even if they don't break the TLS, there is still metadata about the sites you are visiting and servers you are connecting to while on the VPN which the VPN owner can have (even if they tell you they are not, its hard to verify).

Where possible, you can use certificates to connect to an end point instead of passwords. This is more difficult to intercept. You could layer your VPNS, but most of the time people will turn to systems like TOR or other annonymizing networks. Networks such as tor are decetralized and where you exit the tor network is not always the same; however, if you control enough of the TOR nodes, privacy is not guaranteed.

share|improve this answer
    
Thanks, Great info :) –  Mohamad Mar 20 at 20:20
    
Remember that you are still creating a trail of metadata, which might clearly identify your actions. –  Bailey S Mar 21 at 0:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.