I connect to my VPN provider using openVPN. The server uses a combination of username / password and TLS authentication.
If I am on a public wifi and connecting to my VPN, is my username encrypted?
In other words, could my username be sniffed out?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
If I'm reading your question correctly, you're connecting to your VPN using a combination of TLS client authentication and username / password combination.
In this case a MitM attacker can read the full contents of the client certificate (link to the relevant message in the handshake protocol), which may include your username. The attacker can not read the username / password combination because they're sent after the TLS handshake is completed and thereby encrypted.
The mitigation is simple on the protocol level: Don't make a mutually authenticated connection to the server outright, but a unilaterally authenticated one and then let the server initiate a renegotiation with client authentication. This is different, because the conection will be encrypted using the cipher suite from the first connection and so an attacker can't eavesdrop on your client certificate.
If this mitigation isn't possible for whatever reason, you can try and make the two user names unique and distinct. For example you could assign the user a fully random common name in the certificate, which is checked in the internal database / access control list to a) be allowed access and b) match the readable / human-chosen password. This way an attacker can not learn the user name needed for the username / password pair. As far as I can tell, such a setup is possible with OpenVPN.
I hope I read your question correctly, but if you are connecting through a VPN the moment that tunnel is created all data between the point-to-point VPN tunnel would be encrypted. This includes the packets traveling from your device over the Wifi.
I would be willing to bet that if it requires a username/password to create the VPN tunnel it is most certainly being passed encrypted before the tunnel is created, probably with https, which uses TLS/SSL.
An attacker would have to have the keys to decrypt the data as a normal sniffer trying to view your traffic would only see what appears to them as gibberish.
Unless the attacker was able to find an exploit or obtain the keys, all information passed including your username and password would indeed be encrypted.