2

I'm staying in a Hotel for a couple of nights and I will want to use any available public wi-fi on my android device that may include banking logins and password logins. I'm relatively new to using VPN's so kind of need some reassurance about it.

I came across CyberGhost as being a highly rated free VPN service and currently have it running on my device. I've been to ipleak.net and it looks like my vpn created ip address is working correctly, I don't have a webRTC leak and a 3rd party DNS server is being used, all good things right...

Based on this does it sound like this vpn is secure? I'm under the understanding that once connected to a vpn all traffic is encrypted right? Are there any other precautions I should take?

1

I do not see free VPN solutions to be secure. Because you have to ask yourself why is someone providing you a service (of "encrypting" you data and tunneling it for you) for free.

The best thing to do in your situation is to use SSH dynamic port tunneling. You need a machine you can trust, let's say you set up a Raspberry Pi running 24/7 at your home with some Linux distribution and OpenSSH packet installed. You need to be listening on a port you specify to wait for a connection and once connection occures your Raspberry Pi will encrypt your traffic while acting as a proxy. You will have to configure SOCKS Proxy in your browser to point to and IP address of your Raspberry Pi. Also take care of NAT if RPi is behind it with port forwarding and use a service like no noip.com so you can reach your home network if you don't have public static IP. I would recommend you to use certificate based authentication for SSH and to turn off root login and user login with password so nobody can use wordlist attack on your RPi box.

  • Are you suggesting then that free VPN's are complete scams or that they just can'y be trusted? SSH dynamic port tunneling is out of my depth and to be honest I don't even know what your talking about. I'm still very new to VPN's. At the end of the day I've only got a couple of day's to put something in place. I'm on Galsxy S4 btw, I also have Tor/Orbot installed but I don't know Tor well enough to know whether it is set up correctly. – Kol12 Oct 22 '16 at 2:43
  • I've briefly looked up SSH dynamic port tunneling "Android" and it might not be as complicated as it sounds, I will continue reading... – Kol12 Oct 22 '16 at 2:47
  • Well I'm not rooted so probably not going to be the quickest solution... – Kol12 Oct 22 '16 at 2:52
  • I used SSH dynamic port tunneling on Android but you need to have terminal emulator app (Termux to be more specific) you don't need to root your phone to install it. VPNs are secure if you are running them, otherwise you can't be for sure who is doing what with that traffic. If you setup site to site VPN on your own then you know it's somewhat secure becuse you made the configuration. I also don't use Tor because it's been broken several times. I don't have problems with anonymity I just what to make sure that nobody is stripping that encrypted tunnel. – user3746426 Oct 22 '16 at 2:55
  • Look for tutorials on OpenVPN (you wont have to do any port forwarding its easier to set up) there is also app for android for OpenVPN – user3746426 Oct 22 '16 at 2:56
0

As long as you are NOT using a split tunnel connection for your VPN you should be fine. In other words, make sure ALL of your traffic is going over the VPN.

  • 1
    Hi, As mentioned I relatively new to VPN's so not sure what a split tunnel connection is, how do I check on that? – Kol12 Oct 22 '16 at 1:20
  • Unsure with the CyberGhost VPN client, but check the settings as well as the help to see if it mentions a split tunnel option. If it doesn't, chances are it doesn't support split-tunneling. – HashHazard Oct 22 '16 at 2:19
0

The real problem is the WiFi spot itself. Some are fully open, meaning that they let any traffic in and out, but others are secured (*). Many hotel wifi hotspot only allow the following traffics:

  • SMTP over port 25 (basic), 465 (SSL), 587 (STARTTLS) for sending mail
  • POP over port 110, or IMAP over 143 (basic) or 993 (SSL) for reading mail
  • HTTP over port 80 or HTTPS over port 443 via their own (transparent) proxy
  • DNS to their local relay only

Depending on the way the client VPN works (and I could not guess from their internet page) it can work smoothly or not at all. I use a professional (private) VPN to connect to my corporate network from the outside, and it often does not work with hotel Wifi hostspots.

Anyway, it looks like GhostVPN is intended to do a good job to hide your address. I'm unsure it is intended to protect the data exchanged. HTTPS is normally enough to protect your data provided you:

  • ensure that you only type secret data on a HTTPS page
  • ensure the domain of the page is correct and belongs to your bank (for example)
  • ensure that the certificate provided by the server is a valid one and don't type any secret if it is not valid for the domain used

If you do not control that, a VPN will not protect you anyway because it only encrypts traffic between you client machine and its final server but cannot do anything for what happens after.


(*) when their offer a wifi service to their clients, hotels become de facto Internet Service Providers. As such in case of legal inquiry, some countries require that they can give logs of Internet traffic. If they cannot, and if their network was used for illicit operations, they can be prosecuted for complicity.

  • Can you explain further what the problem is when the wifi is fully open? Can we tell if it is secured? Why does your VPN not work with hotel Wifi hotspots? What makes you suspect GhostVPN is not protecting the exchanged data? Are you suggesting VPN is of no use for public wifi? I agree that most of our sensitive data exchange should be done over HTTPS regardless. – Kol12 Nov 26 '16 at 9:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.