Timeline for HTTPS vs VPN - which is more secure
Current License: CC BY-SA 4.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 25, 2020 at 9:53 | comment | added | LvB | TLS 1.3 support is not available for all servers yet. (It’s coming), downgrading tls 1.3 to 1.2 is usually still allowed disabling ECH (Encrypted Client Header). DoH does not magically make it the person running the services can not see what domain requested also it’s still in draft status (means thing can change). For the moment it’s safe to assume the hostname is not encrypted.(until DoH /DoT & TLS 1.3 & ECH are common) | |
| Nov 25, 2020 at 9:40 | comment | added | iBug | The hostname you're connecting to is not encrypted, except when you use DoH + TLS 1.3 + ESNI. | |
| Nov 25, 2020 at 8:53 | comment | added | LvB | @user000001 in that case it is still not the VPN protecting it end-to-end. End-to-end means nothing in between can read the data, the VPN can read the data, it’s not E2E protected. | |
| Nov 25, 2020 at 8:45 | comment | added | user000001 | I think the statement "VPN’s do NOT protect you end-to-end." is a bit too strong. It can protect you end-to-end as long as both ends are connected to the VPN, and you control the VPN server. But yes, for the typical user that wants to connect to services he doesn't control, VPN cannot provide end-to-end protection. | |
| Nov 24, 2020 at 18:53 | comment | added | LvB | You could also mitm the vpn .... | |
| Nov 24, 2020 at 16:35 | comment | added | Barmar | However, the ISP of the VPN endpoint will see the traffic going from the VPN to the website. Basically, the MITM needs to be somewhere else. And if they're close to the website, they can intercept both connections. | |
| Nov 24, 2020 at 14:45 | comment | added | LvB | They as in the ISP will indeed not see anything but traffic between you and vpn provider. It is scoped as Bering an intermediate between you and the vpn provider. | |
| Nov 24, 2020 at 12:20 | comment | added | Sophie Swett | "They will see traffic is going from you to the VPN but nothing more." – This kind of makes it sound like you're saying that nobody will see the traffic between the VPN endpoint and the website you're connecting to. | |
| Nov 24, 2020 at 1:50 | history | answered | LvB | CC BY-SA 4.0 |