1

In many computer magazines I found the recommendation to use a public Wifi only with VPN (of course, you should trust the VPN provider).

Assuming all websites with sensitive data (complete website, not only login) and email providers offer up-to-date TLS: Is a VPN for a notebook in public Wifi/WLAN still recommended?

From what I have read here on StackExchange it rather seems as if a VPN only adds little security given the previous assumption.

Is the situation different with a Wifi not using a shared key, but individual keys as in WPA2 enterprise?

Improve this question

1 Answer 1

Reset to default
2

Short answer: it depends.

Long Answer: HTTPS is secure over public hotspots. Only a public key and encrypted messages are transmitted (and these too are signed by root certificates) during the setup of TLS, the security layer used by HTTPS. The client uses the public key to encrypt a master secret, which the server then decrypts with its private key. All data is encrypted with a function that uses the master secret and pseudo-random numbers generated by each side.

Thus,

  • the data is secure because it is signed by the master secret and pseudo-random numbers
  • the master secret and pseudo-random numbers are secure because it uses public-private key encryption when the TLS handshake occurs
  • the public-private key encryption is secure because:
    • the private keys are kept secret
    • public-private key encryption is designed to be useless without the private key
    • the public keys are known to be legitimate because they are signed by root certificates, which either
    • came with your computer
    • or were specifically authorized by you (pay attention to browser warnings!)

Thus, your HTTPS connections and data are safe as long as:

  1. you trust the certificates that come with your computer,
  2. you take care to only authorize certificates that you trust,
  3. you make sure the website has valid and active SSL.

Conclusion: You don't require VPN as long as website is using HTTPS over public network.

Improve this answer
2
  • There are two notable objections to your conclusion: 1) the ssl-strip attack is still valid, as long as the site you visit didn't set an HSTS header (or it's not in the preload set). 2) you're leaking private data to the owners of the wifi network and any eavesdroppers about the sites you visit via your DNS requests and SSL SNI headers. I would advise always using VPN when on wifi.
    – mricon
    Commented Jul 30, 2018 at 15:59
  • @mricon The original question and your objections could have endless debate. For instance, will you trully trust on VPN? Does VPN is protected from all attacks? etc. Finding these answers is cumbersome process for a normal user. BTW I do not want to debate; I've just put my thoughts to answer the question, based on my knowledge. Answer to your objections: 1) SSL-Strip is more sophisticated attack and the valid SSL won't be active on the user browser, so user can identify that. 2) the basic information even can't be protected by VPN so (I think) there's no harm as long as website has HTTPS.
    – Atlas_Gondal
    Commented Jul 30, 2018 at 17:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .