6

I've seen a lot of VPN providers and they all seem to agree on one thing: ask user to install their own Root CA.

I don't get why they do it. A legit server should have a certificate generated by trusted CA which means the certificate would be verifiable all the way down to the trusted root certificates installed on the device.

This is like trusting someone who says he's the president because he vouches for himself.

Why don't they have certificates generated by legit CAs? Their websites sure do. Why isn't this the case for their VPN Servers as well?

With that in mind, does it even make sense to use VPN for privacy? If the provider is able to perform MITM attacks then you're basically giving them everything including your money.

So this leads to my second question: how is this game working and no one is calling it out?

Extra: To be frank, I was thinking of turning my own device into a mini VPN server for some people I know. The only problem is verifying my server's certificate on the client side. Yes if I'm writing the client I can ignore this part, but that's dangerous for my friends' devices. Therefore, the solution I came up with was deploying my own Root CA certificate with my VPN client which will use it to verify my server and so they can connect to me. The thing is, if I paid a trusted CA to generate certificate for me I wouldn't need to ship my own Root CA certificate with my client.

Update: I have just checked my own VPN provider, it installs its own Root CA. So I went right ahead and removed the certificate from my system. Guess what, the VPN service was unaffected. So just a tip, try to uninstall the certificate if you have one, at least that way you can still prevent them from acting as MITM.

Improve this question

1 Answer 1

Reset to default
7

This allows the VPN server to decrypt your encrypted traffic. For corporate VPNs, this is common in order to comply with policies that require monitoring. It may also be used by free VPNs for the purpose of injecting ads, which could not be done otherwise. The reason they cannot get a legitimate CA to sign it is because they want a certificate that is valid for every site, including Google and Facebook and Stack Exchange. No CA will give vpncompany.example.com a certificate that is valid for google.com.

With that in mind, does it even make sense to use VPN for privacy?

Unless your goal is to be able to safely use open Wi-Fi without risking some script kiddie stealing your passwords, then no, it does not make sense. The "private" in Virtual Private Network refers to IANA-reserved private IP addresses (e.g. 10.0.0.0/8), not the right to privacy or anything of the sort.

how is this game working and no one is calling it out?

But people do call it out! A lot of people tell you VPNs are not useful for privacy or anonymity, but they're always ignored by the hordes of people who buy into VPN marketing schemes who suggest everyone buys a VPN. In reality, there are only three valid uses of a VPN, the first of which is the biggest one:

  1. Internal networking (e.g. a corporate VPN to get you onto a company network).

  2. Protect your data when using an insecure public network (e.g. at an airport).

  3. Torrent relatively safely (for those who are too poor to afford a seedbox).

Therefore, the solution I came up with was deploying my own Root CA certificate with my VPN client which will use it to verify my server and so they can connect to me.

No! Don't create a root certificate! Those are capable of overriding every other certificate. What you would want to create is a single self-signed certificate for authentication with OpenVPN (or whatever protocol you are using). There is absolutely no need for a root certificate in that circumstance.

Improve this answer
5
  • 2
    Why would they need it to decrypt my encrypted traffic? Isn't the VPN server basically acting as a router for my traffic to the destinations I'm talking to? Why does it need to decrypt my traffic with those websites? I know we need to encrypt/decrypt traffic between me and the VPN server. Anyway, what I meant when I designed my own VPN is actually creating a self-signed certificate.
    – Everyone
    Apr 9, 2019 at 19:28
  • 2
    @Everyone It doesn't need to, but if it does, it's likely either for monitoring or injecting ads. That's assuming it's a root certificate that they want you to install.
    – forest
    Apr 9, 2019 at 19:34
  • 2
    Inject ads or even play as MITM and spoof all your passwords and cookies. So why are they called "secure" when the provider basically ruins all your security? I don't care about privacy, this is about security.
    – Everyone
    Apr 9, 2019 at 19:41
  • 3
    @Everyone They call themselves secure. That doesn't mean they are.
    – forest
    Apr 9, 2019 at 19:43
  • It's all part of the data salesmanship just like social media and so on. Ever since I've been working in security I've known there is no such thing as "secure" or "privacy." After all, trusted root CAs are still capable of getting literally everyone's details. So it's all based on trusting other entities without actually having secure measures. These protections are useful on the everyday level against amateur hackers.
    – Everyone
    Apr 9, 2019 at 19:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .