Can a VPN Provider MitM my SSL traffic without me noticing?
Regarding this specifically, unless they have the web site's private key, then you can notice. If you trust the VPN provider's certificate in your browser(s), then you have to actively look harder at which cert each site is using, of course, but you CAN notice if you pay attention. Browser extensions like Certificate Patrol can help if you visit the sites both with and without your VPN; they'll notify on certificate changes.
Shouldn't gmail know my real IP if the traffic just gets tunneled through the provider?
If that transmission is over unbroken TLS, your information was only given to the site it was sent to and everyone that that site shares it with willingly or unwillingly.
If that transmission was unencrypted, everyone between you and them ALSO can see it.
If that transmission was encrypted with broken encryption, it's highly complex, but is somewhere between the two extremes above.
I thought about invalid certificates if the ssl gets broken, but how do next gen firewalls like palo alto claim they can do deep packet inspection on ssl traffic without the users noticing?
They do so because they have a copy of the very same private key for the certificate the web server itself uses! Just as the web server decrypts the TLS traffic with its private key, the appliance decrypts its copy of the traffic with the web server's private key.
Why can't the VPN provider just use a similar box to decrypt it?
The VPN company having a copy of the end web site's TLS private key would be a highly exceptional circumstance involving major nation-state actors, exceptional criminal activity, and/or the bleeding edge of critical zero day exploits like Heartbleed.
I am a bit curious about how much data a VPN provider could potentially collect about me.
As least as much as you think you allow them to.
Do you send your DNS requests over the VPN? They can see that. If not, your ISP can see it.
Do you allow HTTP traffic? They can see - and alter in transit - that. Watch out, that includes third party traffic.
They can definitely see which IP addresses you're going to, and the patterns of data you move. They can then match that against statistically significant analysis of lots of people's traffic as well as deliberate tests and public information they collect.
- i.e. You send some too large to be simple page request packets to https://security.stackexchange.com? You're submitting something you typed to the Stackexchange network of sites; a simple correlation of those large transmissions with new questions and answers will very quickly reveal your stackexchange username.
Do you allow broken encryption algorithms? They may or may not be able to see that.
You certainly have zero insight as to what they log, regardless of what they claim (or are forced to claim depending on the governments in control of every server involved in your traffic and of the management of that company and the people in it - if your VPN endpoint, or the corporate management, or the multiply subcontracted server admins is/are in RepressiveRegimeX, RepressiveRegimeX has a great deal of power over it.
Try, at least for awhile, Firefox with the uMatrix plugin (to show you the mappings of what third party requests are being made by the sites you visit), and with HTTPS Everywhere to limit the use of HTTP.
Also in Firefox, go to about:config, search on tls to see the TLS versions allowed, and search on ssl3 to see which cipher suites are enabled.
On each browser you use, go to SSLLabs and do a client test to see what might be weak that that browser allows on that machine; remove those.
As an advanced option, use wireshark or another tool to watch what's actually going over your VPN, and what's not. You may - or may not - be able to see an actual TLS connection being made, so you can see the cipher suite or algorithm choice negotiated.
- Pay particular attention to where your DNS requests, UDP port 53, are going. Through your VPN provider, or not?