3

Suppose all my sensitive traffic is handled over a https connection. Further assume, I've no interest in hiding which sites I visit just want to hide the sensitive contents. i.e. If an adversary knew the fact that I did a dns lookup for foobar.com that doesn't affect me.

Now is there any special advantage to using a VPN?

I mean there's a distinction between anonymity vs security right? If I want anonymity I might use something like tor.

If I want to access geo-restricted content (say) then I might see why I would use a VPN that makes my traffic seem to originate for a US IP even if I am located in (say) Saudi Arabia.

Or if I want to access legacy software that only works over the office intranet and it's rather simple to make it seem like my remote laptop is virtually within the office intranet than to go about modifying all legacy software individually.

But other than these use cases is there any fundamental benefit to using a VPN over just https?

Improve this question

1 Answer 1

Reset to default
3

If all you do is surfing the web and all the surfing you do is already protected with https and you only care about encrypting the traffic but don't care that somebody might see which sites you visit and when and if you can be sure that your https is not intercepted by some local antivirus, local malware/adware or some enterprise firewall or you don't care, then it is enough to use https.

If any of these conditions are not met a VPN might make sense depending on what you do. And note that a VPN is no replacement for https: https provides end to end protection while VPN offers no protection after the traffic leaves the VPN endpoint which is usually not the endpoint of the connection.

Improve this answer
6
  • Thanks Steffen! I agree. But one quibble: If a local malware is capable of intercepting https traffic before it gets encrypted then neither is a VPN going to save me right? i.e. If the local machine is compromised then all bets are off, right? https / VPN are both rendered ineffective. Correct?
    – curious_cat
    Feb 19, 2017 at 7:21
  • @curious_cat: that's correct. If the local machine is compromised the attacker might even use a browser extension/inject to grab the data before encryption.
    – Steffen Ullrich
    Feb 19, 2017 at 7:31
  • A VPN is at best an additional attack surface and at worst a MITM scam, so you may even be better off not using it.
    – Fax
    Aug 7, 2020 at 12:59
  • @Fax: Your comment is at best a limited view of VPN and at worst trolling, so one is better off ignoring it.
    – Steffen Ullrich
    Aug 7, 2020 at 13:19
  • @SteffenUllrich I mean in the exact circumstance where HTTPS is sufficient, not in general (obviously). Or are you suggesting there's no way VPN could possibly reduce security?
    – Fax
    Aug 10, 2020 at 14:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .