0

I am using a VPN on my iphone https://itunes.apple.com/us/app/hotspot-vpn-free-secure-fast-internet/id1121846465?mt=8

Their privacy policy states that they can get data but doesn't says that will install a cert on my mobile

My assumption for VPN is

My Mobile ---> VPN ---> ANY WEBSITE I want to access

now in case of non https site, vpn server will be able to view all traffic, however incase of https site, vpn server can view traffic only if they install a custom certificate on my computer

My question is

Is my assumption for vpn working is correct ? How do i know in iPhone if the vpn client has installed cert or not ? safari dont even let you see the certificate ? any help in this regard will be appreciated thanks

Improve this question

2 Answers 2

Reset to default
4
+50

Your base assumption is correct, your VPN provider is very literally a MitM and can use that position to conduct all the questionable snooping and tampering an attacker can normally do. As you said, if you are making a connection over HTTP the VPN provider could easily sniff all of your traffic and data and based on their privacy policy, most likely are.

With that said, according to the following article: https://www.thesslstore.com/blog/trust-manually-installed-root-certificates-in-ios/ from iOS 10.3 and onwards, a user has to manually accept/allow a new root certificate to be installed. Therefore, it is impossible for this VPN app to install a root certificate on the device without the users permission. Which means even if they try to do it without telling you, all of your visited webpages over HTTPS will be flagged by your browser as dangerous. Alternatively if you never accept a root certificate and your browser is not warning you about HTTPS traffic's bad certificates, then you appear to be home free!

Hope it helps!

Improve this answer
1

Is my assumption for vpn working is correct ? - yes

How do i know in iPhone if the VPN client has installed cert or not ? - if your iphone is not jailbroken, all certs have to be installed by you manually.

Some more explanations:

  1. For HTTP - provider will see everything
  2. For HTTPS - provider got 2 ways:
    • Install cert to MITM you
    • Use some HTTPS inspection / SSL decryption without cert. This way can be very resource consuming for VPN provider, but still can be done.

You should use VPN chain for better security and anonimity

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .