2

I know browsers use cookies so that, for example, if I log into Facebook on a public computer and forget to log out, the next person who opens up a new browser can go into my account.

Does this work the same way for shared VPNs, especially on sites that are not https? Can someone on the same VPN network tap your traffic and cookies, gaining access to your private accounts?

2

... can others on the same IP address log into your accounts?

Authentication has nothing to do with the source IP address and thus with a shared use of a VPN - unless the authentication is explicitly done by source IP. For the common use cases you describe (Facebook login etc) the authentication is not done by IP address but by username and password and after that bound to a session cookie which itself is stored only in the specific browser.

This means that users sharing the same browser would be treated as the same but not users using the same VPN or otherwise using the same IP address (like all users behind the some home router). Even different users on the same computer would be different if they are using different accounts and thus different browser profiles.

... Can someone on the same VPN network tap your traffic and cookies, gaining access to your private accounts?

Sniffing the traffic is a different scenario from just sharing the IP address. For one, the VPN provider itself could of course sniff all the traffic. Usually sniffing between users in the VPN is not possible but a misconfiguration of the VPN could actually make this possible. Apart from that a VPN only provides protection from the local VPN entry to the VPN exit. Since the VPN exit is almost never the ultimate target attackers could sniff the traffic after the VPN exit too. Therefore you should use end-to-end encryption (i.e. HTTPS) to the target no matter if you use a VPN or not.

4
  • @steffen-Ulrich Isn't OP effectively asking whether someone on the same LAN could intercept non-HTTPS traffic? If you're on a 'shared VPN' - assume OP means site-to-site VPN - then any traffic specifically not encrypted to and from a source IP could be sniffed, similar to being in a coffee shop - the VPN is almost immaterial to the situation (beyond shrinking the potential attackers down from 'anyone' to 'authorised VPN users'). – user53693 Jun 21 '19 at 7:20
  • 1
    @Ian: yes, the title and the body don't really match. Title focuses on shared IP while body asks about sniffing within the VPN - which is a different story. I've no addressed the second part too. – Steffen Ullrich Jun 21 '19 at 8:45
  • Hi @SteffenUllrich, can you clarify what you meant by VPN exit never being the ultimate target? Also, if I use a VPN on a http site, the attacker can only see the IP address of the VPN, and not my original, right? – Sharpie Jun 21 '19 at 15:13
  • 1
    @Sharpie: Network traffic flows over multiple hops (like routers). The VPN does not end at the server you want to reach (like Facebook) but earlier and there are still several hops between the VPN exit and the server. An attacker might lurk there to access your traffic which is no longer protected by the VPN. But yes, the attacker sees the VPN endpoint as source IP. There might be still information at the application level which will provide your real IP, i.e. a VPN does not necessarily provide full anonymity. – Steffen Ullrich Jun 21 '19 at 16:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.