0

As far as I know, the initial connection to a commercial VPN service is the most vulnerable.

Let’s say I have a persistent attacker on my tail.

My home modem-router from the ISP is likely compromised.

Local telecoms untrustworthy.

Is there a way to securely sign up and connect to a commercial VPN service without my keys being intercepted?

  • For this to be true, your TLS implementation would have to be broken. – Jonathon Reinhart Sep 21 '17 at 3:21
  • I’m not a security professional, so I don’t know the details, but I’ve repeatedly seen news about TLS coming under attack (FREAK, DROWN, etc.), so wouldn’t it be possible for the TLS implementation of a commercial VPN to be vulnerable? Also, with recent revelations about perfect forward secrecy weaknesses (Diffie-Hellman), wouldn’t this make my concerns more valid? – JollyBob Sep 21 '17 at 3:41
2

As far as I know, the initial connection to a commercial VPN service is the most vulnerable. ... Is there a way to securely sign up and connect to a commercial VPN service without my keys being intercepted?

Assuming that you start with a clean an not compromised system then the initial connection is only a problem if you rely on blindly trusting the connection, i.e. either don't use a TLS connection, ignore any certificate warnings or simply connect to a system which sounds like it would be a trustable VPN provider but is not.

If your TLS gets already actively intercepted and you notice it than you need to rely on different ways to establish a contact to the trusted VPN provider. This can be for example snail mail for initial contact and then getting some pre-configured system or software to connect to the VPN. Or it can be the use of a more trusted internet connection of some friend. Also note that if your upstream is that invasive then it might simply block the VPN connection.

... but I’ve repeatedly seen news about TLS coming under attack (FREAK, DROWN, etc.), so wouldn’t it be possible for the TLS implementation of a commercial VPN to be vulnerable? Also, with recent revelations about perfect forward secrecy weaknesses (Diffie-Hellman), wouldn’t this make my concerns more valid?

You are escalating problems you've heard somewhere without understanding what they actually mean and where they apply. While they were bugs in specific implementations and use cases TLS by itself is not broken. Also, the problems you cite can currently only be exploited by an attacker with lots of resources.

But, attackers usually don't waste money on such attacks if it can be done the cheaper way. If you face such an attacker you should stop trusting not only your ISP etc but also the vendor of your computer hardware, your operating system, any programs you've installed (where do you got these from - downloaded somewhere from the internet?). You should also question if the commercial VPN you want to use can be really trusted, i.e. if it has a secure infrastructure itself and will not cooperate with your enemies given enough money, which is usually still cheaper than breaking TLS.

Also, make sure nobody can enter your house to physically attack you or just manipulate your computer to install software which allows you to be tracked even if you use a VPN.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.