3

I want to use VPN provider (ProtonVPN), and don't want to use an app. They ask user to install their Root Ca. How safe is it? What type of info could they get from my laptop? If I have their certificate installed, does that means they can see and get all info from my browser, including passwords and https sites? And what about other non browser traffic? How safe is it? What are the risks?

3
  • The primary function of a VPN is specifically so that the VPN provider sees all your traffic, not your ISP (or public WiFi). If you don't trust the VPN more than your ISP then there's not much point using one.
    – OrangeDog
    May 30, 2020 at 8:30
  • The actual reason to use a VPN is to connect an external machine to a private corporate network. But it's recently being heavily marketed for "privacy" to the general public in order to make money.
    – OrangeDog
    May 30, 2020 at 8:33
  • If you don't trust the VPN more than your ISP then there's not much point using one Not exactly; there is another major difference: my ISP can easily match a name and an address with my navigation data; my VPN provider has to jump through more hoops to do that. May 30, 2020 at 10:32

1 Answer 1

9

Your question sounds too broad. It sounds like "trust this certificate for any possible purposes" including SSL/TLS, means also for accessing web sites in your browser via SSL/TLS. The most of users will answer a question asked in such broad form by "Of course, don't do that".

But pay attention to their instruction step 4:

... select Use Custom Settings and Always Trust only the IP Security (IPsec)

Suppose you are afraid that they want to be a man-in-the-middle and intercept your traffic to read or to modify it. If you trusted their certificate for SSL purposes, that would be possible. But you set the SSL usage policy to "Never Trust". And if they do that, then your browser will warn you, that the web site you are trying to open has an invalid certificate because it was issued by untrusted CA (by Proton CA).

But since you allow trust for IPsec only, other purposes are not affected at all.

TLDR: Yes, it is safe, if you follow the needed steps exactly.

2
  • I have not read the instructions, I will have a look.
    – Pedro
    May 31, 2020 at 6:34
  • 1
    I have no issues with your answer (in fact I voted it up) and I didn't issue an answer exactly because I wasn't able to adequately answer the OP's question. My comment was aimed at checking your opinion as to whether you agreed such request was suspicious. I haven't yet had the chance to get into the website to check the instructions, but at face value, it looks suspicious to me. I'll delete the comment since I don't want to cause confusion or give the wrong impression.
    – Pedro
    May 31, 2020 at 17:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .