0

I saw an ad for a vpn provider recently where they claimed that, without using a vpn, my credit card information is "wide open to hackers" while shopping on-line. I guess the implication here was that vpns are encrypted, while regular connections are not. However, isn't https encrypted, and therefore safe to use without vpn? And aren't on-line stores required to use https or other forms of secure payment?

  • Don't know that you can say "required" - you can certainly run an online store without HTTPS, but you probably shouldn't - see security.stackexchange.com/questions/33783/… – Matthew May 9 at 15:59
  • "Required" needs a context (i.e. required by law? in which jurisdiction? Required by your card processor? And so on) but in the end, it seems like an aside to the real question here. – dwizum May 9 at 16:57
5

It depends.

If you enter your credit card information on a site which is not protected by HTTPS then a VPN will provide at least part of the missing protection, like addressing the problem of an attacker in the local WiFi hotspot.

If you enter your credit card information on a site which does not properly handle this information neither a VPN nor HTTPS will not protect you. This might be cases where the site accidentally puts this information online by itself or where it got attacked and the data exfiltrated.

Similar if you enter your credit card information on a site which is already compromised the attacker might grab the information right where you enter these. A VPN will not protect you against this and neither does HTTPS.

  • So it doesn't look like a vpn increases your security much when shopping on-line... that ad feels misleading to me now. – Dunno May 9 at 17:14
  • @Dunno: Unfortunately ads in the security area are often overly simplified and misleading since most will not understand the real implications anyway. And fear sells well. – Steffen Ullrich May 9 at 17:53
  • 1
    @Dunno Steffen's answer explains it perfectly. VPN's use cases are the following: anonymity, censorship bypass. Besides those, it doesn't provide any security improvements or features. Also worth noting is that if you download a banking trojan, HTTPS, VPN and encryption will not stop the attacker from getting your CC info – leaustinwile May 9 at 18:17
  • @leaustinwile: Your description of what VPN are used for is only true for the typical VPN sold as kind of protection for non-business users. And even then there have more use cases, like bypassing geoblocking, protecting traffic against interception when using open Wifi networks ... But VPN in general have more use cases, like allowing mobile users to connect to their companies network, link different locations of a company, ... – Steffen Ullrich May 9 at 18:25
  • 1
    Yes, I know. I was just explaining the use cases that the question asker would use it for. I use VPN every day for connecting to my internal corporate network – leaustinwile May 9 at 18:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.