1

When I use my VPN (ExpressVPN) to connect to a site that only uses HTTP, is that something I need to worry about?

Let's say I talk to someone on a site that only use HTTP, will the messages be easily traced back to the sender?

What is the difference in privacy/security when connecting to a website that uses HTTP vs HTTPS when I am already connected to a VPN server?

Edit: I found out that the vpn provider has built in SSL in the vpn server. Does this mean I am using https Even though it says http in the web browser?

4

Let me split up your questions and hopefully it will make sense...

When I use my VPN (ExpressVPN) connecting to a site that use only http, is that something i need to worry about?

A VPN is an encrypted tunnel between your computer and the VPN end point, in this case the ExpressVPN servers in the country you connect to. Any internet traffic is therefore encrypted (people could intercept it but wouldn't be able to understand it) until it exits at the ExpressVPN server. One advantage here is that even if people (governments, etc.) are monitoring what comes out of the ExpressVPN server you connected to, they won't be able to tell that it was you that sent it. Just that some traffic has emerged.

Quick edit: As noted by someone in the comments (thanks!) - any traffic to http sites will be visible to someone monitoring. So while the source of the traffic will look like the VPN server, the traffic itself could contain info to tie it back to you (e.g. names, ip addresses,...).

One obvious use of VPNs is to access region locked content in other countries as the content provider thinks that your computer is actually in the same country as the ExpressVPN server you connected to.

Lets say i talk to someone on a site that only use http, will the messages be easily traced back to the sender?

What is the difference in privacy/security when connecting to a website that use http vs https when I am already connected to a VPN server?

Let's take https connections first... if you are connecting to a https site via a VPN then communication is still 'further encrypted' between the ExpressVPN server and the https site. i.e. effectively encrypted the whole way from your computer to the https site but going via the ExpressVPN server. If you are communicating with an http site then someone could be intercepting and reading the connect of the traffic but would only really be able to tell that it was coming from the ExpressVPN server and not from you or your computer. So you are probably okay. However, if that http site requires a login and it is poorly designed it could link your message back to you if you have previously logged in without using the VPN.

The explanations above are quite simplified and there is a lot that could be discussed about the various encryption technologies.

Another important consideration is whether your VPN logs what you do. Most good ones don't. There are various VPN ratings pages you can find including this one from the EFF in 2013 (couldn't find a newer version but I only looked briefly) which will tell you more about what your VPN does and doesn't keep track of. If your VPN logs your activity then they could be passing it on to others or selling it. General rule of thumb is that if you are using a free or very cheap VPN then the price you are paying is your privacy - they are likely making money from selling on activity details. A lot of people don't care about this as they just care about accessing region locked content.

P.S. For what it's worth, I'm in the UK and with the passing of the 'snoopers charter' I won't be doing anything without a good VPN going forward as our ISPs will be required to log all activity metadata which will be searchable by ANY law enforcement official (including my neighbourhood policeman) without a warrant!

  • So if exchange messages with someone on an ordinary http site using an ExpressVPN server I would most likely be okay? I have not created an account on the http site where messages are exchanged. No passwords or log-ins like this site here requires. The site only requires that you type in your self-chosen nickname before connecting to the server that allows us to talk. – PYT765 Nov 19 '16 at 0:31
  • That depends on what you're trying to protect against. – Xiong Chiamiov Nov 19 '16 at 0:56
  • Protect against what i mentioned in the original post; a hacker tracing the messages back to me. – PYT765 Nov 19 '16 at 1:00
  • 2
    "even if people (governments, etc.) are monitoring what comes out of the ExpressVPN server you connected to, they won't be able to tell that it was you that sent it." This statement is incorrect. If they monitor the VPN part of your link it is encrypted and can only identify you if they can link your IP address to you, but if they monitor the VPN's outgoing traffic, they can read everything if not to a HTTPS site, because HTTP traffic is not encrypted. So if your packets include any identifiable info (like your name), people seeing HTTP traffic past your VPN's server know who you are. – Mark Ripley Nov 19 '16 at 8:34
  • Completely agree and should have clarified that. Thanks for picking up. – DanteAlighieri Nov 19 '16 at 9:09
1

A VPN encrypts the traffic between your computer and the VPN endpoint. It does not do anything to improve the security between the VPN server and the sites being accessed. If the site uses http, then your session is vulnerable to anyone that might be able to intercept the traffic between the VPN endpoint and the website.

Sites that use SSL (https), all traffic is encrypted between your web browser and the web server hosting the site. Using a VPN does not compensate for lacking https on the site you are visiting.

The VPN server having built-in SSL means the connection and authentication to the VPN server is encrypted through SSL, making it much harder to intercept your login to the VPN server and grabbing your credentials to that VPN server.

VPN services like VPN Express, IP Vanish, etc. are usually done for the following:

  1. Improve privacy and security - Your ISP cannot spy on you, and if your ISP is served a warrant for your online history they won't be able to show anything other than you connecting to that VPN server. Your VPN service provider, VPN Express, states they do not log your activity, and thus they cannot be compelled to provide evidence of your online activities.

If you continue to use the ISP's DNS servers, they can still know what sites you visit.

Also, other users of your computer, or within your private network behind your firewall, won't see ads that are based on what sites you visited.

  1. Avoid throttling - Some ISPs have been known to throttle traffic to Netflix and others.
  2. Access content that is restricted by geographic region. By establishing a VPN to a provider, you will appear to be coming from wherever the VPN endpoint is.
  • So all data that is being sent between the vpn server and the website is vulnerable when on a http site - OK. Let's say someone get a hold of some of that data, i.e. a message that was sent on this http site. How easy will it be tracing that message back to my personal ip? Or will the hacker most likely only be able to trace the message back to the vpn server? And secondly; What is the ISPs DNS server? Is that something I automatically use when connecting to a VPN? – PYT765 Nov 19 '16 at 17:32
  • "Quick edit: As noted by someone in the comments (thanks!) - any traffic to http sites will be visible to someone monitoring. So while the source of the traffic will look like the VPN server, the traffic itself could contain info to tie it back to you (e.g. names, ip addresses,...)." So how do I know if the traffic itself contains names, ip addresses etc? Is this only if I have written a name or an ip adress in the message that was sent that the traffic itself could contain such information? Or could the traffic itself give away such information without the sender writing it in the message? – PYT765 Nov 20 '16 at 0:01
  • If you are accessing http sites, if someone succesfully intercepts traffic between your VPN client and the VPN server, they will be able to see the TCP/IP traffic but the content will be meaningless. If they intercept the traffic between the VPN service provider and the site (http not https) they can see the content. If the site had a web form and you filled it out, everything on that form can be seen. No one can tell you exactly what data they can intercept and "see" because it depends on what the site is. – Thomas Carlisle Nov 21 '16 at 23:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.