0

Some YouTube videos have sponsors who claim "your banking can be stolen if you connect to unsafe networks like airports and hotels"

If using https, and hsts, and verifying the certificate is valid, are my connection safe, if not using vpn?

Improve this question
1

1 Answer 1

Reset to default
2

If using https, and hsts, and verifying the certificate is valid, are my connection safe, if not using vpn?

If you are using HTTPS with a valid certificate, then Transport Layer Security (TLS, née SSL) is likely adequately protecting your communication with the server that sent the certificate.

An attacker on the network may still be able to see things like the IP address of the server you are communicating with (or other header data below the application layer). But the application layer data (in this case the HTTP data and headers) will be encrypted with TLS (the S in HTTPS) and thus the network attacker will not be able to see that data.

In other words, for the most part, yes it is safe without VPN.

The above statement is subject to the usual caveat that threat models will vary. E.g., if an attacker has access to your computer and can run, say, super user processes on your local machine, then they can likely steal your data prior to TLS encryption. Additionally, if you are not positive that the certificate is valid, then the above mentioned safety would not apply. Etc.

Improve this answer
2
  • Not just the IP address, but the host name, unless ESNI is in use. The server's IP address being revealed at some point is impossible to defend against, since it's needed to connect to the web server; and traditional TLS uses unencrypted SNI to indicate the host name to which an encrypted connection is being requested. So an eavesdropper can tell whether you are connecting to one.example.com or two.example.com, but can't tell whether you're requesting /foo or /bar on each.
    – user
    Apr 20, 2019 at 14:01
  • Monitoring DNS traffic (which is traditionally unencrypted) can also be a way to determine which host name a client is connecting to, but doesn't by itself reveal what the client is going to do with that host name (even along the lines of "connect over HTTPS"). A TCP connection being established to a well-known port immediately after a DNS query is a pretty big clue, though. That by itself still doesn't tell the eavesdropper what reason the client has to connect to that host name.
    – user
    Apr 20, 2019 at 14:01

Not the answer you're looking for? Browse other questions tagged .