15

I understand that end-to-end VPNs (such as SurfShark and NordVPN) hide the domains I visit whereas HTTPS does not

However, are they any attacks that an HTTPS website would be subject to, that could be avoided if I used an end-to-end VPN?

The main kind of attack I am concerned about is having any secure information (such as passwords, bank details, mobile number etc...) I send to a website being intercepted by a "middle-man"

The question in essence is are there any security benefits from using a paid-for VPN such as Surfshark given I currently enforce HTTPS on my browser (meaning I block all HTTP websites) and all my banking websites use HTTPS.

  • By security, I mean can any personal data be obtained
  • Privacy is not as important an issue (e.g: can people see domains I visit)
  • Do you want to compare end-to-end VPN with end-to-end HTTPS? Or do you mean a common VPN where the connection between VPN exit and the real target site is no longer protected by VPN? And what kind of VPN you are talking about? And do you consider common issues when deploying VPN (i.e. IPv6 leaks or DNS leaks) a problem of VPN in general or of the specific setup? And what do you want to be secure from anyway, i.e. what are the threats you care about? Too much question to provide a good answer. Please edit your question too provide more details. – Steffen Ullrich Nov 23 '20 at 23:48
  • 2
    "I understand that end-to-end VPNs (such as SurfShark and NordVPN) hide the domains I visit whereas HTTPS does not" - they may hide it from your ISP, but not from the VPN provider itself or anyone between them and the destination website. But this is irrelevant if your concern is security rather than privacy. – multithr3at3d Nov 23 '20 at 23:59
  • 7
    I have the feeling that you don't really understand what a VPN is and/or what end-to-end actually means. While you specifically ask for an end-to-end VPN you then mention products which are not end-to-end VPN as example (Surfshark). Also you ask about "attacks that an HTTPS website would be subject to" (i.e. attacks against one endpoint) while you seem otherwise concerned about attacks about protecting the communication to the server, which is something different. And in the title you want to compare VPN and HTTPS while later you ask if VPN in addition to HTTPS is useful. – Steffen Ullrich Nov 24 '20 at 6:54
  • 20
    Which is safer: a car or a tunnel? – MonkeyZeus Nov 24 '20 at 15:34
  • 7
    @SteffenUllrich: It's not EML's fault. VPN advertisements are incredibly misleading. EML, I suggest watching Tom Scott's video for a non-technical explanation of what VPNs offer, in the context of what VPN advertisements claim to offer. – Brian Nov 24 '20 at 15:57
26

What does TLS do?

From wikipedia/HTTPS:

The principal motivations for HTTPS are authentication of the accessed website, and protection of the privacy and integrity of the exchanged data while in transit. It protects against man-in-the-middle attacks, and the bidirectional encryption of communications between a client and server protects the communications against eavesdropping and tampering.

So the primary purpose of HTTPS is to protect your personal data.

What does a VPN do?

From wikipedia/VPN:

A virtual private network (VPN) extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network.

...

VPN technology was developed to provide access to corporate applications and resources to remote or mobile users, and to branch offices.

...

Internet users may secure their connections with a VPN to circumvent geo-blocking and censorship or to connect to proxy servers to protect personal identity and location to stay anonymous on the Internet.

So the primary purpose of a VPN is to connect to your company's network when you're out of the building. There is a secondary usage of VPNs to protect your anonymity (specifically your IP address) when accessing public websites.


Your questions:

The main kind of attack I am concerned about is having any secure information (such as passwords, bank details, mobile number etc...) I send to a website being intercepted by a "middle-man". Privacy is not as important an issue (e.g: can people see domains I visit).

You want the thing that HTTPS is good at. You are not interested in the thing that VPNs are good at. Sounds like there's no reason for you to use a VPN :)

  • 4
    Another usage for a VPN is to access region-locked content, like BBC UK in another country, or a Youtube video you can't watch in some country or something similar. I believe it doesn't fall in the "protect your anonymity" part. – Ismael Miguel Nov 24 '20 at 11:12
  • 3
    @IsmaelMiguel I would argue it still does fall in that category, because it's still about making sure your private data doesn't leak. In this case, the affected private information is the country you're in and you're trying to hide it from the website. – TooTea Nov 24 '20 at 12:45
  • 7
    Another use of a non-end-to-end VPN such as NordVPN is to improve defences against local MITM attacks such as DNS poisoning, DNS typo squatting, misleading host certificates and rogue WifFi hotspots. – Qsigma Nov 24 '20 at 12:52
  • @TooTea You're right. According to the European Commission's Data Protection (ec.europa.eu/info/law/law-topic/data-protection/reform/…), the Public IP address is "personal data" (as refered in the document). A VPN will hide that, so, yes, it falls under the "protect your anonymity" part. – Ismael Miguel Nov 24 '20 at 14:13
  • 2
    I'll note that https also protects against MITM attacks, including rogue wifi hotspots. Of course, there are a ton of caveats. – Brian Nov 24 '20 at 15:46
15

This question is based on a wrong premise.

VPN’s do NOT protect you end-to-end. A VPN is basically a second encryption layer to wrap your normal traffic in, it is encrypted until the VPN endpoint (or exit node). This will “Protect the traffic from being readable” by any intermediate (your ISP mainly). They will see traffic is going from you to the VPN but nothing more.

HTTPS (HTTP with TLS) protects almost all data end-to-end. The data not encrypted are:

  • Source IP
  • Target IP
  • the Hostname connecting to (through the SNI extension allowing for tls with virtual hosting, as an example the URL “HTTPS://site.example.com/page/1” would have the following in clear text in the header for SNI “host: site.example.com”)

In order to do a MiTM attack (Man in The Middle), you need a certificate that your browser will accept as valid. (E.a. Issued by an authorized Certificate Authority). This is the same with a VPN.

In short. A VPN only gives a limited form of privacy by having many people using the same (set) of IP addresses. (Hiding in the crowd). HTTPS is about integrity, authenticity and identity (especially with client side certificates) Or in other words HTTPS ensures the data is not tampered with, is from the original source. And is known from who it came.

  • 2
    "They will see traffic is going from you to the VPN but nothing more." – This kind of makes it sound like you're saying that nobody will see the traffic between the VPN endpoint and the website you're connecting to. – Tanner Swett Nov 24 '20 at 12:20
  • 1
    They as in the ISP will indeed not see anything but traffic between you and vpn provider. It is scoped as Bering an intermediate between you and the vpn provider. – LvB Nov 24 '20 at 14:45
  • 1
    However, the ISP of the VPN endpoint will see the traffic going from the VPN to the website. Basically, the MITM needs to be somewhere else. And if they're close to the website, they can intercept both connections. – Barmar Nov 24 '20 at 16:35
  • You could also mitm the vpn .... – LvB Nov 24 '20 at 18:53
  • 1
    @user000001 in that case it is still not the VPN protecting it end-to-end. End-to-end means nothing in between can read the data, the VPN can read the data, it’s not E2E protected. – LvB Nov 25 '20 at 8:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.