0

I'm learning about networking. And I feel a donkey.

Background

We connect to the internet by first connecting to a Wifi Access Point, or a switch.

Then when we open up a browser, or use any transfer protocol to ask for a file, and information is sent across a huge network.

If I get this correctly, when using a VPN the information is first send to a VPN server, and it makes the request to, let's say, the Web server.

Question

But my question is: How private is our data before reaching the VPN? Isn't it going to the ISP-servers first? What's the real privacy benefit then?

I've got a related question but if it's too much for one post, we can leave it out. Isn't it possible to de-encrypt HTTPS data if we have access to the target server? As I am supposing there should be a de-encryption formula in the server.

3

For sake of simplicity, lets assume you do all of your web browsing using HTTPS.

Now, first consider the case where you aren't using a VPN. So, your traffic is routed through the ISP, then on to its final destination. Then, suppose you browse to https://www.somewebsite.com/. Your ISP can not see the information that you exchange back and forth between https://www.somewebsite.com/, because it's encrypted using HTTPS. But, your ISP can see that you are visiting https://www.somewebsite.com/, because it can see the packets being sent back and forth over its network between your connection and https://www.somewebsite.com/'s server.

Now consider the case where you are using a VPN. Because you're using VPN, all of your traffic is routed first through your ISP, then through the VPN, then to the final destination. If you browse to https://www.somewebsite.com/, your ISP has no way of knowing this, because all they see is packets going back and forth between you and the VPN. And, neither the ISP nor the VPN can see the information that you exchange back and forth between https://www.somewebsite.com/, because it's encrypted using HTTPS.

With regard to your final question about whether or not the target server can decrypt HTTPS data, the answer is yes. With HTTPS, the sender encrypts the data, and the receiver decrypts it. If this weren't the case, then the two sides would not be able to communicate.

| improve this answer | |
3

The first part was already described quite detailed by mti2935: with an vpn you add a step of going to the vpn which is encrypted.

With no VPN:

  • For encrypted traffic (like HTTPS) the ISP can view to which domain you are connecting to
  • For plaintext traffic (like HTTP) the ISP can view to which domain you are connecting to, as well as the whole contents sent and received.

With an VPN, you add a prior step of sending the information encrypted to the vpn, so:

  • The ISP can view that you are connecting to the vpn service
  • For encrypted traffic (like HTTPS) the VPN provider can view to which domain you are connecting to
  • For plaintext traffic (like HTTP) the VPN provider can view to which domain you are connecting to, as well as the whole contents sent and received.

Since the communication with the vpn is encrypted (and assuming you connected with the real vpn site when setting it up), there's no privacy risk regarding the ISP.

However, you should be aware that you are replacing that the ISP can view certain things with the vpn service being able to view them.

Either using a VPN or not, you should strive to connect using encrypted protocols, for web pages that means using HTTPS if that's available.

Isn't it possible to de-encrypt HTTPS data if we have access to the target server? As I am supposing there should be a de-encryption formula in the server.

AS for this second question, I slightly disagree with mti2935, depending on what you meant to ask.

Obviously, the party that owns the server is able to view what you send it in https. But, if we are talking about an ISP getting the traffic today, and then two months later decrypting that old data they stored, we need to differentiate between two types of ciphers.

Traditionally, what I just described could be done. Anyone having a copy of the server private key could decrypt what was being sent. Intelligence agencies around the world copied huge amounts of data that was transitting, hoping they might be able to decrypt it in the future by getting hold of the private key used.

As a way to make the process more robust, a number of ciphers were added, with the property that they offer what is being called "Perfect Forward Security" (PFS). What they provide is that an attacker which followed the above steps would still not be able to decrypt it.

They manage to do this by encrypting the actual performing a Diffie-Hellman key exchange which lets both client and server derive the same session key, without it actually being explicitly said, or be guessable by an attacker that was viewing everything they exchanged.

The actual cipher you are using when communicating will depend on what is supported by the server and the client. They will negotiate which cipher to use. You can expect that most servers (and clients) do support PFS nowadays, and that it will generally be preferred to non-PFS ciphers.

| improve this answer | |
  • 1
    "However, you should be aware that you are replacing that the ISP can view certain things with the vpn service being able to view them." This exactly. You have to consider who you trust more in this case. – multithr3at3d Sep 5 at 12:31
  • Excellent point by @multithr3at3d. If you want to make it difficult for any party to be able to monitor the sites that you connect to, consider using TOR. – mti2935 Sep 5 at 14:54
  • @mti2935, multithr3at3d was quoting my answer... – Ángel Sep 6 at 0:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.