5

At my office we have two wireless networks - an official one, and a "Guest" one. There is extensive filtering on the official one, and using it requires a users work credentials. The Guest one is basically "wide open", and anybody can connect without credentials (this is so that employees can use e.g. personal devices, while keeping them isolated from our official infrastructure).

I know one of the people who works in our network security department, and he tells me, "Oh yeah, I see all kinds of nasty malicious crap on that Guest network, I would NEVER connect my personal device to it". I assume he is talking about e.g. port scans, exploit attempts, etc.

My friend openly admits that he's usually overly paranoid, but in this case he feels very strongly about this.

I have proposed that connecting over a VPN provider would mitigate a lot of his concerns, but he does not agree. It was my understanding that a VPN to e.g. my own home's Internet connection would be effectively the same as connecting directly while I'm actually at home.

Assuming I trust the VPN provider, am I any worse off doing

[Device]-->[Trusted VPN client]-->[Nasty Wifi]-->[Trusted VPN server]-->[Home Network]

... than I am doing

[Device]-->[Home Network]

... ?

The device in question is an up-to-date Android device, and I should reiterate that I am assuming that I trust the VPN provider implicitly.

Improve this question

2 Answers 2

Reset to default
7

The VPN connection will not protect you from other devices attempting to connect to your device. The VPN will encrypt your network transmissions. If your friend states that he has noticed port scans and exploit attempts, the VPN will not protect you from that. The described malicious network activity is going after your actual network adapter and attempting to connect into your computer via known ports and exploits.

For best protection in such an environment, you would want a personal firewall that explicitly denies all inbound traffic to your computer.

Improve this answer
2
  • Thanks, that makes sense. Marking this as answered. As a follow-up question (which probably doesn't justify a separate post) - how risky is it to connect to untrusted wifi networks assuming I'm up-to-date in my security patches in Android (Google Pixel which get's updates directly from Google)? Barring some zero-day vulnerability, aren't modern phones relatively hardened against random open ports?
    – loneboat
    Jan 26, 2018 at 16:36
  • @loneboat The most common security recommendation for untrusted wifi is to use a VPN like you've asked. The common security threats in such situations are rouge access points acting like the unsecured network and packet sniffing (see cnet.com/how-to/tips-to-stay-safe-on-public-wi-fi for some tips). Also, I did a port scan on my Galaxy S8 and found 3 open ports mostly from installed apps. Three open ports is a relatively small attack surface but my phone isn't as invisible as my laptop with a firewall that blocks all inbound connections.
    – waltonob
    Jan 26, 2018 at 17:26
1

The VPN isn't going to make your device invisible on the network, it is just going to afford privacy for your outgoing connections.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .