3

Suppose all my sensitive traffic is handled over a https connection. Further assume, I've no interest in hiding which sites I visit just want to hide the sensitive contents. i.e. If an adversary knew the fact that I did a dns lookup for foobar.com that doesn't affect me.

Now is there any special advantage to using a VPN?

I mean there's a distinction between anonymity vs security right? If I want anonymity I might use something like tor.

If I want to access geo-restricted content (say) then I might see why I would use a VPN that makes my traffic seem to originate for a US IP even if I am located in (say) Saudi Arabia.

Or if I want to access legacy software that only works over the office intranet and it's rather simple to make it seem like my remote laptop is virtually within the office intranet than to go about modifying all legacy software individually.

But other than these use cases is there any fundamental benefit to using a VPN over just https?

3

If all you do is surfing the web and all the surfing you do is already protected with https and you only care about encrypting the traffic but don't care that somebody might see which sites you visit and when and if you can be sure that your https is not intercepted by some local antivirus, local malware/adware or some enterprise firewall or you don't care, then it is enough to use https.

If any of these conditions are not met a VPN might make sense depending on what you do. And note that a VPN is no replacement for https: https provides end to end protection while VPN offers no protection after the traffic leaves the VPN endpoint which is usually not the endpoint of the connection.

  • Thanks Steffen! I agree. But one quibble: If a local malware is capable of intercepting https traffic before it gets encrypted then neither is a VPN going to save me right? i.e. If the local machine is compromised then all bets are off, right? https / VPN are both rendered ineffective. Correct? – curious_cat Feb 19 '17 at 7:21
  • @curious_cat: that's correct. If the local machine is compromised the attacker might even use a browser extension/inject to grab the data before encryption. – Steffen Ullrich Feb 19 '17 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.