public WiFi hotspot-What is leaking at that tiny moment before connecting to a VPN?

Question

When you sign up for a VPN account you also download the service's client,be it for Android, Windows etc but this question is specifically for Android or portable devices connecting through public hostspots.

For the VPN client to connect you through its VPN service you first have to connect through a wifi hotspot which itself assigns you an IP of its own network.

During that moment between connecting to the hotspot and connecting to the vpn,what kind of leaks that can identify you are taking place? What kind of information can the hotspot collect? Besides,applications like Gmail automatically connect when they become aware of a network connection,which could be very well be the one prior to the vpn's.What can those leak and how can you control them?

Answer 1

Between connecting to the hotspot and establishing the VPN nothing is protected(encrypted) by the VPN. Anything already encrypted (HTTPS/SSL/etc.) can not be read by the hotspot owner without installing a certificate on your device, but that requires your active permission. Specifically the Gmail app uses encryption. The opposite is also true, anything not encrypted can be read as plain text from the hotspot owner.

Some VPN apps like FREEDOME from F-Secure have an automatic killswitch (screenshot below) that blocks all in- and outgoing connections until the VPN is established.

Answer 2

It really depends on what applications your device is running. The first thing that comes to mind are DNS requests, which are not encrypted (unless you went to great lengths to encrypt them), and happen pretty much continuously in practice. And even for encrypted TLS connections, the first leg of the TLS handshake (the "Client Hello") contains plain-text information (the "Server Name Indication") which provides information about what your computer is trying to access.

The best way to know is to run a packet capture. There are lots of things running in the background that will generate traffic. Email clients, OS updates, random applications, web pages, etc.