4

TL;DR: Can other users connected to a VPN Provider exploit my computer or information?

I usually use a VPN service when connecting to the Internet. The provider is a private company whose business is providing "integrity services".

As I understand it, a VPN can be seen as a secure solution when accessing networks in public spaces. In my case the risks are quite the opposite – I'm at home connecting to a pretty much unknown VPN network.

What are the risks associated with this? More specifically, is there a practical risk that other users connected to the VPN can gain access to or exploit my computer in any way?

FYI, this is what the company states regarding its security:

  • AES-256-CBC encryption of traffic behind a 2048 bit Diffie-Hellman key.
  • OpenVPN protocol
  • Private DNS servers
  • No logging
  • Physical security
Improve this question
2
  • When you're connected to the internet, anyone else on the internet poses a threat. Perhaps you could edit the question to make it more concrete.
    – Neil Smithline
    Nov 14, 2015 at 23:32
  • 1
    @NeilSmithline Are the risks increased compared to if I wasn't connected to VPN?
    – P A N
    Nov 14, 2015 at 23:35

2 Answers 2

Reset to default
5

When you use a VPN provider, you need to trust that they have properly configured their servers. If they have not, there can be additional risk posed by other users of the service. For example:

  • Client-to-client visibility: OpenVPN (and likely other VPN software) has a client-to-client option that can be enabled on the server. This allows everyone using the VPN to "see" everyone else connected to the same VPN. If this feature is enabled, it could allow increased visibility of your system to an attacker or other malicious user.
  • DNS monitoring: You mentioned that your VPN provider has their own DNS servers. There is some additional risk of DNS based attacks. Or, if caching is enabled, potential fingerprinting of websites that other users have visited.

This is not an exhaustive list of vulnerabilities, but it should give you an idea of the risks if your provider's servers are slightly misconfigured. You can use this information to better reason about whether you need a VPN.

Improve this answer
1
  • This seems to be the best answer for now, unless someone adds more examples.
    – P A N
    Nov 15, 2015 at 13:51
3

I think the possibility that other users can be harmful to you and your privacy is low. Instead, if there are many users connected to a same VPN provider, it may even make you less identifiable thanks to the diversity in the connections. What's worth mentioning here is that you state that the company claims "No logging" in their service. However, you should not trust in this statement because most of the revealed cases show that the VPN providers do log and keep the log data for quite a long period of time in case they are requested by the government. Or, even when your provider does not log, its ISP (internet service provider) can still monitor and log the communication from you to the VPN provider's server, thus your privacy is not 100% guaranteed.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .