Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Many popular VPN services (that provide encrypted tunnels between the users' devices and distant VPN servers) authenticate users using a pair of email address and password. What attacks would the disclosure of the credentials of a user allow (against the user)?
If the VPN provider doesn't log any user data, is there any way that past traffic could be inferred by the attacker? Does this allow the attacker to read (ie. decrypt) all future traffic of the user?
A lot of the answers depend on the VPN technology used, but assuming it's a TLS-based vpn, knowing a user's credentials would allow someone to assume that user's identity, but not decrypt past or future traffic. If the VPN provider gives access to VPN logs (which is extremely rare), having someone's VPN credentials would allow the attacker to see usage history.
Generally, though, it only allows someone to use the stolen VPN account without paying for it and doesn't compromise the security of VPN sessions.
Edited to add: obviously, if it's the kind of VPN account that grants access to restricted resources (such as private company networks), then it's different.
