Why is browsing while logged onto a VPN from public wifi more secure than not?

Question

I've been trying to wrap my brain around VPNs for a while now, but can't find a good source that answers the questions I have.

In particular, I can't understand why browsing from a public access point is more secure while logged into a VPN than not. It's my understanding that a VPN encrypts and routes traffic from the computer to the access point, across the Internet, to the VPN server, where queries are then directed to the appropriate destinations; responses then follow the trail in the opposite direction (Please correct me if this is a misunderstanding.)

Where exactly is the danger in not doing this? That is, why are my packets less secure originating from the public access point than they are from home? They still travel to the same destinations across the same Internet, and are likely going to be locally routed by the same ISP.

(There's something that seems like a good answer to this question here, but if I'm understanding it correctly, then it seems that all the articles touting the inviolable security of public browsing while logged into a VPN are misinformed.)

Answer 1

The thing about a VPN is that the connection between your computer and the VPN end point is encrypted.

If you go to Joe's Coffee House and use their public WiFi, depending on the configuration it is possible that anyone in the range of your WiFi radio can snoop on your traffic. Even if Joe has secured his WiFi properly, anyone with access to the physical equipment (not necessarily Joe, but anyone with access) can tap the connection at the transition from WiFi to wired, where the WiFi encryption no longer protects the signal.

If, instead of connecting directly to wherever you want to go, you connect to a VPN, and from the VPN's endpoint connect to your destination, then everything that passes through Joe's is encrypted. Your data could be sent in the clear from the VPN's endpoint to the destination, so you need trust in the VPN's endpoint. From the endpoint of the VPN, your packets travel exactly the same path they'd travel if your computer were physically located at the VPN endpoint. The VPN protects your egress from a network the trustworthiness of which is suspect.

Finally, most sensitive web sites these days, and many that are not, use TLS encryption. Give or take a POODLE attack†, without the VPN, a snooper at Joe's could see where you connected, but not what you send. With a VPN, the snooper can only see that you connect to the VPN, and not that you then connect to Bob's Bank in the trailer on main street.

† In 2020, POODLE attacks should be completely mitigated; to be vulnerable, you'd need both an antique browser and a server not updated since about 2016.

Answer 2

@bob-brown did a great job explaining some of the attacks to a fellow wireless user.

Peers

To expand, consider a typical public (e.g. coffee shop?) wifi as not having the monetary means to afford enterprise level equipment. Therefore lacking in security controls necessary to secure it's users. This means users should consider themselves adjacent to each other on the same network without any sort of isolation. Allowing peer-to-peer connections if desired. This is the basis for why public wireless is insecure as it creates a threat model much lower on the OSI Model then it would if the user was on their own protected network. For example, now everything from layer two traffic (e.g. arp) on up is of concern. Additionally hardware can be targeted by going after the network drivers since traffic is seen directly on the wire.

Router

Consider the infrastructure of public wifi. Consumer grade routers have been compromised and even some commercial grade hardware have had security vulnerabilities. Can you be 100% certain traffic leaving the public wifi will arrive at it's destination without taking a significant detour? Thus the importance of HTTPS and other secure communication channels.

DNS

Probably the most concerning since this is the "phone book of the internet". That same router may be running an old version of BIND or dnsmasq and configured as a caching recursive resolver. Making it feasible to poison the dns cache.

VPN

Not all VPN's are the same and its important to define the type of VPN being used.

Full Tunnel

A full tunnel VPN is one where all traffic traverses the VPN tunnel. This is the most secure as it will use the entire network infrastructure where the VPN terminates. You essentially become an extension of the LAN. Most importantly it uses DNS from your LAN.

Split Tunnel

A split tunnel VPN will only tunnel traffic to resources residing on the LAN. Thereby using the public wifi (i.e. not the VPN) for accessing resources not on your LAN. This would be things such as personal email and basic browsing.

TEST!

Be sure to fully test your solution. Don't assume a VPN will be the panacea for all your security concerns. For there are different ways to configure a VPN where using one would provide little security benefit.