1

I have recently watched an interview with a guy discussing how to drastically diminish your digital footprint. One of the points argues that VPNs should be used all the time:

DO NOT use a VPN when dealing with banking services or anything confidential, but do use it when publicly surfing the internet.

I do not remember the exact explanation surrounding this point, but it was something related to the fact that banking services (and similar services) typically store your IP and will trigger a second factor of authentication when the IP changes. This sounds more like a nuisance, rather than a real issue.

I am wondering if there is any security rationale for this piece of advice. Is there any security advantage of not using a VPN for such services?

2
  • 2
    I think you've answered your own question. If you use the same IP consistently when connecting with a service, then they can create more of a profile. But I'm not sure how it helps with a "digital footprint". And without the specific advice from the source, we're guessing at their motives for suggesting it. Can you provide the actual reasoning?
    – schroeder
    Jan 12 at 13:33
  • If you trust your VPN provider more than your ISP, sure. Else, no.
    – Maxime
    Jan 12 at 17:09

1 Answer 1

1

The answer to this question depends on the reason why you are using a VPN in the first place. From a privacy perspective, VPN's serve two purposes:

  1. VPN's hide from your ISP (or your local network admin) the sites that you are visiting. Your ISP only sees your connection to the VPN, and not the domains or the IP addresses of the sites that you visit.

  2. VPN's hide your 'real' IP address from the sites that you visit. The sites that you visit only see your VPN's IP address, not your real IP address.

If you are concerned about your ISP seeing that you are visiting your bank's site, then use a VPN.

But, I suspect that the advice that you are referencing has more to do with (2) above. Some sites attempt to fingerprint their visitors (for tracking and data collection purposes), and visitors' IP addresses can be used as part of a fingerprint. This is especially true nowadays, where even dynamically assigned residential IP addresses can remain the same for months or years. But, if it's a site that you login to (such as a banking website), then this is a moot point, because the site knows exactly who you are the moment login (regardless of your IP address).

Finally, with regard to a site triggering a second authentication factor when your IP address changes - I'm not sure how this relates to your underlying question about privacy. Yes, if the site is setup to require a second authentication factor - then using the site without a VPN, then with a VPN will trigger this. But, so would logging into your banking website from your home without a VPN, then from the wifi at your local coffee shop without a VPN later that same day.

1
  • 2
    Also, banks can be real paranoid. If they see you login from an ip address that's nowhere near you, they may decide to just lock your account. Or trigger some kind of fraud protection that prevents you from accessing your money. I don't know if they do this, but it wouldn't surprise me and I wouldn't want to risk it.
    – Blake
    Jan 13 at 18:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.