22

I know that VPNs are the standard way to secure communication between a remote user and their primary network, but I've never felt entirely comfortable relying on them when using an open wireless network, like at a coffee shop or airport. Even though I know the connection is encrypted, the fact that it can easily be sniffed makes me too nervous to connect to any important systems.

Is that fear unfounded, or is it a good idea to avoid transmitting sensitive information over the air, even when it's encrypted?

I guess the bottom line is, would you feel comfortable logging into your bank's website from a coffee shop, as long as it was tunneled through a VPN? (For the sake of simplicity, assume that the VPN is properly configured, physical security isn't an issue, etc... the scope of this question is just the VPN's role).

Improve this question
2
  • 1
    As long as it's certificate based and it gives you a warning if the certificate doesnt match, and you train the user, it gives some extra protections. PPTP can be hijacked with MITM while OpenVPN will show a warning.
    – Andrew Smith
    Commented Aug 2, 2012 at 16:26
  • @AndrewSmith can you elaborate?
    – Konrad Gajewski
    Commented Jul 3, 2015 at 19:26

2 Answers 2

Reset to default
9

With due considerations to the recent developments in terms of PPTP based VPN connections that lead to compromise of data, usage of Wifi under a VPN is still highly secure for a number of reasons.

Firstly, if you're a casual user who's performing Internet Banking, the practical overhead of performing the exploit procedure and then the decryption of the captured data is quite significant. No local coffee shop hacker would do it, and professionals wouldn't be interested in spending his time on you.

If security is absolutely critical to your transactions then, there are a number of simple additions:

  • Ensure that the VPN connection is at least an AES-256 with certificate authentication. Do the usual checks to ensure that the certificate is not compromised to a MiTM attack. Eg OpenVPN
  • Keep the sessions inside your VPN connection them self encrypted. ie. Don't use HTTP, use certified HTTPS, replace FTP by SFTP, etc.
  • VPNs are over-rated as per me. A good SSH tunnel configured properly works as a lower cost and light weight, easy to deploy solution for encryption. Plus you channel it through your rented server and if you have the need and resources you could for example, setup any custom modifications of the encryption procedure. I'm not encouraging obscurity, just saying you don't have to limit yourself to the current textbook compliance procedures and thus use infamous but more secure encryption techniques.

My point being, for banking, the chances of an attacker being able to break through a VPN encryption, then say a SSH tunnel and then finally your HTTPS web page traffic is extremely improbable, even for highly confidential EOW data.

And even then, banking sessions generally last for a few minutes at max. Apart from certain broken information, there would be no way in any practical banking system with even basic security to use that in order to steal money from you or hack you.

Improve this answer
11
  • 3
    Andrew, reading/learning about security theoretically makes stuff look easy. But rest be assured even a professional would rather social engineer you into getting your credentials then go through a VPN and then a HTTPS connection. It's simply not that viable without major funding/resources.
    – Rohan
    Commented Aug 2, 2012 at 17:39
  • But PPTP attacks are trivial now for 10 years or so, and every some time there is something new about it. PPTP is considered unsecure for a very long time and I guess the OpenSSL in OpenVPN is no better either.
    – Andrew Smith
    Commented Aug 2, 2012 at 17:45
  • And since it's very profitable business, there are attacks like this performed in certain places from time to time, you cant assume that it wont happen, because this is not security but BS
    – Andrew Smith
    Commented Aug 2, 2012 at 17:50
  • 1
    Practical security is different from theory. You can't ask clients to compromise usability due to security. And you need to provide solutions, not only critics. Nothing is ever truly secure, but using a VPN + HTTPS is secure enough for banking transactions against people that are collecting packets on a WiFi network at a coffee shop. It's a whole set up for normal citizens that use plain text.
    – Rohan
    Commented Aug 2, 2012 at 19:00
  • 1
    @AndrewSmith "REST and so on" can you explain, or at least give a link?
    – curiousguy
    Commented Aug 3, 2012 at 1:41
4

Yes, as long as good ciphers and protocols are used. However, the most popular VPN solution, PPTP with MS-CHAPv2 (Windows compatible PPTP), is considered insecure since a few days ago.

https://www.cloudcracker.com/blog/2012/07/29/cracking-ms-chap-v2/

I'd recommend using OpenVPN with AES-256 and certificate authentication.

Improve this answer
3
  • Moxie gave it to us all. But I'd imagine it's been broken since DES was cracked really.
    – Ori
    Commented Aug 2, 2012 at 22:25
  • What about ARP Spoofing? Are MITM attacks still possible, or are they still too difficult due to the encryption layer?
    – king_julien
    Commented Oct 30, 2012 at 19:30
  • 2
    If you are using server authentication in your VPN client (using certificates) and someone is pretending to be your VPN server, your VPN client should give you a warning and refuse to connect. Once the encrypted connection is established between you and the VPN server, the attacker can do very little, unless the encryption is very weak (DES).
    – Matrix
    Commented Oct 31, 2012 at 11:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .