0

I searched for a specific answer to this question and although there are many answers about VPN encryption, I did not find this specific question answered. Setup as follows:

MyPC -> VPN -> RestaurantISP -> Internet

When I first connect to my VPN service using either the OpenVPN protocol or the app supplied by my VPN provider, does it send the username and password unencrypted or are the credentials sent encrypted?

More specifically, if the RestaurantISP installs a packet sniffer, could they see my login details, like username and password?

2

Technically, the answer to your question depends on the VPN software used and possibly on how it's configured - there are many different network authentication protocols out there, and many VPN programs support more than one - but in practice you can reasonably assume that your credentials are not sent in clear text. No VPN client worth the bytes used to store it would send plain-text credentials by default, and most aren't even configurable to do so.

Of course, not all non-plain-text authentication methods are equivalently secure. MS-CHAPv2, for example, is pretty easy to break. It'd still take more than just looking at the network traffic in a packet capture to extract the credentials, though.

1

You don't say who the VPN provider is but you mention using OpenVPN as one way of connecting. OpenVPN uses a TLS handshake, meaning the server and your PC will exchange public keys and authenticate each other. This allows you to send your login credentials to the VPN provider in an encrypted manner. This is in fact how most of the internet works to allow you to send your password securely when logging onto a web service.

I would imagine every VPN provider uses a similar process in its own proprietary software.

0

Express VPN uses a TLS handshake. Can’t find direct confirmation on their website but the below support about TLS problems indirectly confirms it.

https://www.expressvpn.com/support/troubleshooting/log-items/unable-to-connect-incorrect-system-date-and-time/

  • Did you know you could edit your answer instead of posting a new one? – Esa Jokinen Aug 11 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.