I saw an ad for a vpn provider recently where they claimed that, without using a vpn, my credit card information is "wide open to hackers" while shopping on-line. I guess the implication here was that vpns are encrypted, while regular connections are not. However, isn't https encrypted, and therefore safe to use without vpn? And aren't on-line stores required to use https or other forms of secure payment?
2
-
Don't know that you can say "required" - you can certainly run an online store without HTTPS, but you probably shouldn't - see security.stackexchange.com/questions/33783/…– MatthewCommented May 9, 2019 at 15:59
-
"Required" needs a context (i.e. required by law? in which jurisdiction? Required by your card processor? And so on) but in the end, it seems like an aside to the real question here.– dwizumCommented May 9, 2019 at 16:57
Add a comment
|
1 Answer
It depends.
If you enter your credit card information on a site which is not protected by HTTPS then a VPN will provide at least part of the missing protection, like addressing the problem of an attacker in the local WiFi hotspot.
If you enter your credit card information on a site which does not properly handle this information neither a VPN nor HTTPS will not protect you. This might be cases where the site accidentally puts this information online by itself or where it got attacked and the data exfiltrated.
Similar if you enter your credit card information on a site which is already compromised the attacker might grab the information right where you enter these. A VPN will not protect you against this and neither does HTTPS.
answered May 9, 2019 at 15:59
-
So it doesn't look like a vpn increases your security much when shopping on-line... that ad feels misleading to me now.– DunnoCommented May 9, 2019 at 17:14
-
@Dunno: Unfortunately ads in the security area are often overly simplified and misleading since most will not understand the real implications anyway. And fear sells well. Commented May 9, 2019 at 17:53
-
1@Dunno Steffen's answer explains it perfectly. VPN's use cases are the following: anonymity, censorship bypass. Besides those, it doesn't provide any security improvements or features. Also worth noting is that if you download a banking trojan, HTTPS, VPN and encryption will not stop the attacker from getting your CC info Commented May 9, 2019 at 18:17
-
@leaustinwile: Your description of what VPN are used for is only true for the typical VPN sold as kind of protection for non-business users. And even then there have more use cases, like bypassing geoblocking, protecting traffic against interception when using open Wifi networks ... But VPN in general have more use cases, like allowing mobile users to connect to their companies network, link different locations of a company, ... Commented May 9, 2019 at 18:25
-
1Yes, I know. I was just explaining the use cases that the question asker would use it for. I use VPN every day for connecting to my internal corporate network Commented May 9, 2019 at 18:26