0

Let's say my device is already compromised without my knowledge by my ISP, it has a malicious root certificate installed which allows my ISP to view all of my HTTPS traffic as plain text.

now if I use a secure paid VPN like OpenVPN or WireGuard, from a trusted VPN provider, that uses a non-malicious public trusted SSL certificate to encrypt data from my device and send it to the remote server, will that prevent my ISP from viewing my data as plain text? or can my ISP still decrypt packets going through the VPN tunnel?

per a comment's suggestion, I've read this question but since there are important details different in my question, it doesn't answer it.

Improve this question
3
  • 1
    What if your ISP simply refuses to connect you to your VPN provider? In an "either go through us or not at all" fashion
    – Karen Baudesson
    Nov 6, 2022 at 20:12
  • @KarenBaudesson then I change my VPN provider, but the focus isn't on the provider :)
    – user285140
    Nov 6, 2022 at 20:24
  • Consider my question for all VPN providers
    – Karen Baudesson
    Nov 6, 2022 at 20:32

1 Answer 1

Reset to default
1

The encryption done by the VPN encapsulates the inner HTTPS traffic. If the ISP wants to MITM this inner HTTPS using a trusted certificate it must first break the outer VPN encryption.

Breaking the VPN encryption requires to MITM the VPN, similar how done with HTTPS. To MITM the VPN is impossible for a secure VPN which is not also controlled by the ISP - as long as the authentication to the VPN server can be trusted. How this authentication is done depends on the kind of VPN in use - so no general statement can be made. In the worst case the authentication is done using certificates and using the systems trust store, which you consider compromised by the ISP. If the VPN client is instead expecting a specific certificate or key, then a compromised trust store should not be the problem.

... from a trusted VPN provider, that uses a non-malicious public trusted SSL certificate ...

It does not matter if the VPN provider has a trusted certificate, what matters instead is that this is actually the certificate seen on your system and not one replaced by the ISP. If certificate validation in the VPN relies on the (potentially compromised) trust store, then the ISP might MITM the authentication and thus the VPN.

Improve this answer
2
  • Thank you for your answer, so if I never installed any certificate on my system in order to connect to the VPN server, does that mean the VPN provider is using any of the public certificates already pre-installed on Windows machine? or does that mean my VPN provider uses other kinds of authentication? and if the former is the case, can a compromised local cert store still be an issue? doesn't that cause the VPN client to show some errors about a bad certificate upon connecting to the VPN server?
    – user285140
    Nov 6, 2022 at 20:55
  • @zerogainer: It can mean that the VPN uses the trust store from the local machine. It can mean that the VPN uses its own trust store or trusts only specific certificates- shipped with the VPN client. It can mean that it does not use certificates at all for authentication, but for example key pairs, passwords ... - there is not statement possible about what some third party closed VPN client does. If you run your own based on open source solutions (like OpenVPN, Wireguard) then you are more in control of what it does.
    – Steffen Ullrich
    Nov 7, 2022 at 6:06

You must log in to answer this question.