I have read an article about programmers who use AES VPN tunnels when working remotely with clients from other countries. The article writes that this way their countries are unable to track their activities and to charge tax.

What is the story about AES VPN tunnels? Can someone explain to me in simple words?

The article even writes that this way they can import money without being tracked.

  • A link to the article would help. – Mark E. Haase May 29 '12 at 12:34

VPN is essentially a way to connect a remote system to a local network, as if it were actually on the local network. This is usually done via L2TP (Layer 2 Tunneling Protocol), which forwards network traffic over UDP packets. The protocol itself does not provide any encryption or authentication, so it is usually ran alongside a security protocol, e.g. SSL or ipsec.

When a VPN is tunneled through SSL, the data will be encrypted in a way that prevents eavesdroppers from reading (or modifying) the conversation. This is essentially the concept you've read about in the article, and it's a popular trick in countries with censorship and oppressive governments, e.g. China.

There are attacks on these security measures, though. It's possible to identify L2TP traffic even when encrypted, using heuristic analysis on packet sizes, timings and flags. This doesn't reveal the encrypted information, but allows governments to make a reasonable estimate that you're trying to circumvent their censorship or other laws. Self-signed certificates can also be broken via man-in-the-middle attacks, since there's no certificate authority to ensure the validity of the certificate.

  • Thanks. Great explanation. But what does VPN have to with receiving money to avoid taxes? It's illogical... – clearojne May 28 '12 at 9:33
  • @clearojne I'd imagine they're using the VPN to run business operations in other countries, avoiding certain tax laws, then moving money via electronic means (e.g. BitCoin). Sounds implausible though. – Polynomial May 28 '12 at 9:58
  • Yes, digital money could be what they were talking about. But I had impression of dealing with real money. Who knows... – clearojne May 28 '12 at 10:00
  • They could perform all business operations within another country, using a bank in that country, then transfer the money to a local account and write it off as a gift. It's stupid and obvious, but in corrupt countries you can probably get away with it. – Polynomial May 28 '12 at 10:02
  • 1
    @Polynomial It doesn't matter where it's signed or who signed it. What matters is that you implicitly trust over 150 CAs around the world. You may buy a certificate issued by Verisign, but that doesn't mean an impersonator also needs a Verisign certificate in order to MITM you. An impersonator can get an identical certificate signed by any CA in the world, and it's equally valid to your browser. (Unless you manually remove root CAs that you don't personally trust.) – Mark E. Haase May 29 '12 at 13:40


Most VPN Providers "provide" you an IP (like a Proxy). They also encrypt your connection through the internet so that your login (for example) is encrypted!

Even that this may prevent hackers or the authorities from spying you, most VPN Providers keep logs (for some days or weeks) to prevent hackers. What this means is that if the Authorities ask them to disclose your Internet activity, they will do so.

I think that only nVPN (http://nvpn.net) doesn't keep logs and protects you from the authorities. (However, you need to pay to use their VPN...)

What you said about if they use AES encryption, it is up to them what encryption they use. Among others, AES is one of the strongest encryptions available, however, secure = slow, so they can use other less secure encryption algorithms in order to guarantee speed.

Thus, hiding your activity on the Internet using VPN is possible!


Can people use AES VPN tunnels to hide their activities from authorities?

They can, but authorities can still know what's going on. It depends on many things but technically there are plenty of attack vectors against cryptographic systems AND workstations.

I'd strongly advise to use cryptography in all business related activities, but technology will not solve a problem that has nothing to do with it. Taxes are circumvented like that but it could be otherwise, and governments/institutions, trust me, generally have other ways to detect fraud.

Relying on technology to mitigate a problem (taxes) is really a bad approach. First it's illegal (for obvious reasons), second it may create other problems (accounting, paying employees with undeclared money, hiding it, etc).

  • 2
    They can, only insofar as the endpoints haven't been compromised. – Fiasco Labs May 28 '12 at 20:28
  • Among other things yes. There's always a risk to being a defector, playing with a technology that one doesn't fully understand is a good way to fail. Although I doubt governments will use such drastic measures, it's not a big enough problem (yet?). – Aki May 30 '12 at 11:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.