Timeline for Do VPNs provide sufficient protection over public wireless networks?
Current License: CC BY-SA 3.0
13 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 6, 2012 at 13:10 | comment | added | Rohan | ARP Spoofing to me is just another methodology to ensure MiTM Attacks, it re-directs all packets you send/receive to go through an evil host. Either case, if your VPN is doing its job right, there shouldn't be any trouble. SSL Strip and other measures can allow an evil host to get past SSL during an ARP attack tho, if you're not using better encryption (...like VPNs). | |
| Oct 30, 2012 at 19:30 | comment | added | king_julien | What about ARP Spoofing? Are MITM attacks still possible, or are they still too difficult due to the encryption layer? | |
| Aug 3, 2012 at 11:46 | comment | added | Andrew Smith | theregister.co.uk/2011/09/19/beast_exploits_paypal_ssl - BEAST attack, this is one of the most recent serious exploitable flaws. | |
| Aug 3, 2012 at 11:44 | comment | added | Andrew Smith | Not the PPTP, please what are you talking about, this is the most commonly exploited protocol including the mobile and wifi, only crazy would use this for connecting with the bank even using the SSL connection. There is software, which automates the processes and does the proper job, and it's not a rocket science to develop and to use it. | |
| Aug 3, 2012 at 1:41 | comment | added | curiousguy | @AndrewSmith "REST and so on" can you explain, or at least give a link? | |
| Aug 2, 2012 at 20:09 | vote | accept | Ian Dunn | ||
| Aug 2, 2012 at 19:00 | comment | added | Rohan | Practical security is different from theory. You can't ask clients to compromise usability due to security. And you need to provide solutions, not only critics. Nothing is ever truly secure, but using a VPN + HTTPS is secure enough for banking transactions against people that are collecting packets on a WiFi network at a coffee shop. It's a whole set up for normal citizens that use plain text. | |
| Aug 2, 2012 at 18:23 | comment | added | Andrew Smith | Well yes, there are various kinds of issues so using plain SSL from cafe is also very risky. E.g. via negotiation attack, or REST and so on. | |
| Aug 2, 2012 at 18:08 | comment | added | Rohan | Fine, they manage to crack your "VPN data". You telling me they can also crack SSL or TLS Encryption and also SSH tunnels? If they had this knowledge, hacking citizens at a local coffee shop would not be the best use of it. :| | |
| Aug 2, 2012 at 17:50 | comment | added | Andrew Smith | And since it's very profitable business, there are attacks like this performed in certain places from time to time, you cant assume that it wont happen, because this is not security but BS | |
| Aug 2, 2012 at 17:45 | comment | added | Andrew Smith | But PPTP attacks are trivial now for 10 years or so, and every some time there is something new about it. PPTP is considered unsecure for a very long time and I guess the OpenSSL in OpenVPN is no better either. | |
| Aug 2, 2012 at 17:39 | comment | added | Rohan | Andrew, reading/learning about security theoretically makes stuff look easy. But rest be assured even a professional would rather social engineer you into getting your credentials then go through a VPN and then a HTTPS connection. It's simply not that viable without major funding/resources. | |
| Aug 2, 2012 at 17:23 | history | answered | Rohan | CC BY-SA 3.0 |