3

I was reading this article about a certain in flight WiFi provider issuing fake SSL certificates for Google. This doesn't really surprise me all that much since I'm well aware of the concept of proxies re-terminating SSL connections. In the end of the article the author says that you could use Tor or a VPN to bypass the security issue. My question is: would technologies like Tor or VPN really be of any use here? It seems to me that unless the session were already established before connecting to the untrusted access point, they could MitM these services just as easily as any other since they will always be the first hop. Am I missing something critical here?

EDIT: Its becoming clear to me that I wasn't quite clear enough in the original question. I know most browsers will throw errors and that these errors can be ignored. My intended question was, will things like Tor or VPN be able to defeat this type of MitM on a technical level?

Improve this question

2 Answers 2

Reset to default
1

To be clear, issuing the *.google.com certificate causes the browser to explode with errors. You have to explicitly accept the certificate in most browsers in order to render anything, let alone become vulnerable to MitM attacks.

The same is true with other secure protocols. If somebody attempts to MitM a VPN, you probably have TLS authentication again and your client should explode. Same with Tor. TLS encryption won't validate.

You could probably ignore certificate errors in your VPN or Tor client... But why would you do that?

So the short answer is both VPN and Tor defeat MitM attacks... But so do modern browsers.

Improve this answer
3
  • 1
    This is a good point. There is quite a bit of notice that it is happening, which is probably more than enough for anyone who understands what is happening. However, most people (including many business people who would be using VPNs simply because their IT guys told them they had to) wouldn't understand how serious this warning is and would simply bypass it. At this point the P in VPN becomes more public than private, correct?
    – Alex N.
    Commented Jan 7, 2015 at 16:34
  • As noted in Web users ignoring security certificate warnings, many users will ignore warnings from their browsers about certificate errors: "Researchers from Carnegie Mellon University have found that Web users often ignore warnings in browsers about the validity of a Web site's digital certificate."
    – MoonPoint
    Commented Feb 15, 2015 at 21:50
  • @MoonPoint This is a few years old, using FF2-3 and IE7. Modern browsers are much more explicit about the risk of dodgy certificates so I would like to think that a similar study today would show better results.
    – Oli
    Commented Feb 16, 2015 at 7:57
1

If you've ever watched a person experience an MITM attack, you'll see that a few certificate errors don't stop them browsing. Especially on a mobile device. Chrome browsers really rub it in your face and are enough to make people panic a little, but at the end of the day, people love the internet and will keep clicking around until they find websites that don't throw up errors.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .