3

Firstly, I am not sure if this is the correct forum to be asking this question so I apologise if not. What I would like to know is, what do VPN browser plug-ins (such as zenmate) actually do and how secure are they?

I understand that they re-rout your internet traffic through different secure servers making it difficult to track and intercept but what is actually happening?

Also continuing with the browser plug-in theme, do these VPNs re-route all network traffic or just data that is directed through your browser, specifically will they also redirect traffic from desktop games etc that are played online?

3

Browser-based proxies only work in the context of your browser. All other non-proxied actions (such as Skype, et al) will be performed in the context of your ISP.

Here's a better explanation:

  1. You use a browser-based proxy for web-surfing. While surfing, if the VPN actually works correctly, you will appear as the proxied address. For example, overflow.my.buffalos-proxy.co.uk
  2. You don't use a proxy to connect to anything else. You will appear as what your ISP designates you as. For example, c-13-333-33-37.hsd1.ca.comcast.net (fake address) when playing games / Skyping / et al.

I understand that they re-rout your internet traffic through different secure servers making it difficult to track and intercept but what is actually happening?

Here's a dumbed-down version of what's happening:

  1. You connect to your VPN before sending a request through an encrypted connection.
  2. Your VPN receives the encrypted content, and decrypts it. If you're using HTTPS, it will be preserved. Remember, you're just encrypting the data to and fro. A man-in-the-middle attack is possible.
  3. Your VPN connects to the website, and sends the request you asked for.
  4. The website returns the data to the VPN.
  5. The VPN encrypts the traffic, and sends it back to you.

Does hiding behind proxies protect you?

Using a browser-based VPN plugin can betray you if you have Flash, Java, or even other plugins installed. Anything that can get read/write access to your file system will betray your presence.

There has also been a recently-discovered exploit that affected users of private internet access, a VPN provider.

It's also not that difficult to track you online, even if you're behind a bunch of proxies. Why?

  1. Browser-fingerprinting
    • This essentially allows anyone with access to a browser-fingerprint database to track your surfing habits, if you have Javascript, Java, and/or Flash enabled, or aren't using a plugin to randomize your values on page load. Even with a plugin that randomizes these values, Flash and Java will betray you, and Javascript can do so as well, but not to the extent of what Java and Flash can do.
  2. Surfing with Javascript Enabled
    • Javascript is notoriously exploited, and there are always new vulnerabilities popping up. Anything that can execute remote code on your system is dangerous. D
  3. Surfing with Flash Enabled
  4. Become a victim of Java exploits, or even legitimate Java programs.
    • There are multiple tricks to reveal your network interface / computer hardware information. Unique serial numbers on devices are a thing, and this is one of the ways Microsoft attempted to thwart piracy, only to affect legitimate users the most.
  5. Signing into services/accounts that you normally use, while surfing anonymously.
    • For example, keeping Steam, Skype, or something else running, or even having Windows check for updates! These leave a huge bread-trail.
  6. Using browser plugins with read/write access.
  7. Analyzing connection logs for recent activity.
    • User A connected to Proxy A at X time.
    • Proxy A connected to Proxy B close to X time at Y time.
    • Proxy B connected to Proxy C close to Y time at Z time.
  8. Your VPN disconnected you at an inopportune time, and you reestablished connection to all services under your real IP.

Also continuing with the browser plug-in theme, do these VPNs re-route all network traffic or just data that is directed through your browser, specifically will they also redirect traffic from desktop games etc that are played online?

Browser plugins in general will only re-route traffic to and from the browser's requests. That's it. If you're playing a browser-based game, then sure, I don't see why not.

Desktop games will not be redirected unless the browser plugin does some weird tomfoolery that manages to install an application on your desktop which does this.

2

I understand that they re-rout your internet traffic through different secure servers making it difficult to track and intercept but what is actually happening?

Normally if you load http://www.example.com, your computer makes a connection to www.example.com and loads and displays the web page. If you're using a VPN, the request goes through the VPN provider's VPN server first, then on to www.example.com, back to the VPN server, and then to your computer. The link between your computer and a properly configured VPN server is encrypted, so your ISP and anyone on your network cannot see any details of what you're browsing.

do these VPNs re-route all network traffic or just data that is directed through your browser, specifically will they also redirect traffic from desktop games etc that are played online?

Every VPN service/software will be different, so I'm going to address the specific one you mentioned. From Zenmate's FAQ:

Please note that the browser Extension cannot affect traffic going through other programs on your device. If you're looking for full desktop security, check out our full Desktop VPN Clients for Windows and Mac OS X!

So the Zenmate browser extension encrypts only your browser traffic through the VPN, not traffic from any other apps on your computer. Looks like they have a full-computer solution available though.

  • 1
    I believe this would be the case for all browser plug-in based vpn's as the plugin only runs in the context of the browser and so cannot intercede for traffic outside the browser. – Hearth Dec 2 '15 at 23:55
  • Additionally, you need root privileges or equivalent to add the necessary routes to send all traffic through the VPN. – multithr3at3d Dec 3 '15 at 1:19
0

A proxy server is a server that your browser goes to that handles your communications by proxy i.e. it does it for you.
You tell your browser: I want to go to Google Your browser tells the proxy server: I want to go to Google. The proxy server goes to Google and sends you the result. It can get a little more hairy when you get into SSL/TLS stuff and authentication, but that's the long and the short of it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy