0

Many popular VPN services (that provide encrypted tunnels between the users' devices and distant VPN servers) authenticate users using a pair of email address and password. What attacks would the disclosure of the credentials of a user allow (against the user)?

If the VPN provider doesn't log any user data, is there any way that past traffic could be inferred by the attacker? Does this allow the attacker to read (ie. decrypt) all future traffic of the user?

  • Each VPN tunnel are suppose to be unique. – mootmoot Jun 25 '18 at 15:07
1

A lot of the answers depend on the VPN technology used, but assuming it's a TLS-based vpn, knowing a user's credentials would allow someone to assume that user's identity, but not decrypt past or future traffic. If the VPN provider gives access to VPN logs (which is extremely rare), having someone's VPN credentials would allow the attacker to see usage history.

Generally, though, it only allows someone to use the stolen VPN account without paying for it and doesn't compromise the security of VPN sessions.

Edited to add: obviously, if it's the kind of VPN account that grants access to restricted resources (such as private company networks), then it's different.

  • Thank you. I do understand that it totally depends on the implementation on question but I was wondering what could be said in a general case, so this is a rather soft question... – gen Jun 26 '18 at 10:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.