Right now I'm using a Web browser under the following circumstances:

  • I am making this post over HTTPS
  • I am connected to a password-protected Wi-Fi network with WPA/WPA2, EAP-PEAP, and MSCHAPV2 security
  • I am using the Private Internet Access VPN

When I ask for a web page under these conditions, how many times does my computer have to decrypt it? I'm assuming three? One for HTTPS, one for the wireless router, one for the VPN. While we're at it, what factors would change the number of times that incoming data has to be decrypted?

  • What's important is not how many times it's encrypted, but whether or not encryption at a certain layer addresses the threat model of your particular scenario. – Lie Ryan Mar 2 '17 at 6:12
  • Can you elaborate? – JesseTG Mar 2 '17 at 7:45
  • This is a question about networking stacks and the OSI model. Each layer can add its own encryption, depending on the technology used at that layer. But at any layer, you can add duplications that can increase the "number" of times a piece of data is encrypted (VPN tunnel within a VPN tunnel, etc.) – schroeder Mar 2 '17 at 8:08
up vote 1 down vote accepted

You're correct that data is being decrypted three times with that configuration. Disabling the security of any of those layers (which is not recommended) would reduce that number, and adding more proxying, Tor, etc. would increase the number.

When using HTTPS, only the contents of the requests and responses are encrypted. The size of each message, the hostname of the web site you are visiting, and the fact that you are using HTTPS are not kept secret. If you use HTTPS over a VPN, the hostname and protocol are encrypted, but the message size can still be observed.

The traffic over a WPA2 WiFi is indeed encrypted, but it can be read by other people on the network that have the WiFi password.

So while the request content may be encrypted three times, this does not really provide "three times the security". It depends on what you are trying to hide from whom.

  • "the Wi-fi password" The password or a password? At my university, each student can log in to wi-fi with their LDAP (I assume) credentials. And then different departments may have their own networks and credential systems, too. – JesseTG Mar 2 '17 at 16:52
  • Also, this question wasn't about whether this pattern of encryption is more secure (I know it's a bit more complicated than that). This was strictly about telling how many times traffic is encrypted – JesseTG Mar 2 '17 at 16:58

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.