First, let's just take a moment to appreciate the tin foil hats. Everyone has them, we just put them to different uses. As a security architect, I cherish mine for both the safety it provides and the bountiful feast it helps me supply for my family. Thank you, tin foil hats.
Your question is legitimate. Your concern is legitimate. So that's a good start. Let's start digging into why the question and concern are legitimate and discuss simple things you can do to analyze what's occurring on your machine to ensure you're not broadcasting anything you don't want to be.
VPN as a method of privacy on an encrypted network is great for ensuring that no one can eaves drop on the conversation. The tunnel provides encrypted security when there isn't one natively on the network to begin with. Since you stated that you travel a lot, it makes sense that you would want this peace of mind especially when travelling around the globe. There are some sketchy places out there not to mention shady ISPs and routers providing access for malicious purposes (eg. Evil twin attacks).
Now, when your machine boots up, it will load your core services and essential applications and any other non essential applications you may have chosen. These could be slack or email or a number of other services that you have used on your machine. If any of these services leverage a network protocol that is not secure (ie. HTTPS or IMAP/POP/SMTP w/o TLS) then you may have an oops moment.
Since most services start the back and forth with authentication, that means that any of these applications running at start up are attempting to authenticate to a remote service. This may mean that you are transmitting a password and username in the clear even though you didn't want/intend do (and again is largely dependent on the type of protocol the application is running). Ideally, you would not transmit any of this data before your VPN session is fully established.
So there is the risk, what can you do about it?
Look at your start up application lists. If there is anything you don't need to launch right away, remove it from the start up lists and launch it when you feel safe in your network environment. If you have multiple apps you wish to start at once, you could try building a simple start up script that you can execute at your leisure.
Determine if your VPN client permits the blocking of network communication before a tunnel is created. This restricts your application clients from reaching out before your network tunnel is established. A good way to keep your start up applications managed by the OS too.
NOTE: This may have adverse effects if you want to present inside of another company, as an example. I know companies I have worked for explicitly prevent VPN tunnel connections from any guest networks, which would be a set back if you needed internet hosted materials.
- Ensure that you are using VPN only and not running in split tunnel mode. Split Tunnel Mode will allow your applications to bypass your VPN Tunnel to communicate. This is definitely a feature of some clients that should be turned off.
And I just want to circle back to the paranoia. So long as your paranoia doesn't prevent you from functioning in your role, it's probably a good thing. Being aware of security and the risks you run into, especially when you're on the go, is a good thing. In fact, depending on your travel I would tell you that there are some countries where you should never bring a device that you care about and use. Stay aware, share the awareness, and keep yourself secure and in your own way you're helping to make the internet a safer place.
