0

I thought I would be protected from sniffing if I use a VPN, even in a setting where my traffic is going through a «man-in-the-middle» either by ARP poisoning or an evil twin attack.

Now I was told, that when connecting to the VPN the initial exchange is done in an unprotected environment, and therefore the encryption details could be sniffed as well.

Meaning that my encryption is futile, because the attacker could decrypt the traffic.

I was assuming that encryption keys were exchanged when installing a VPN app, or that the encryption information is somehow protected. If that was true, would that mean, that if I set up a VPN app while already using an evil twin network, that in that case, my traffic would be unprotected?

Or are these assumptions wrong anyway?

10
  • "Now I was told" -- who said this?
    – schroeder
    Apr 19, 2023 at 12:42
  • If this was true, then all SSL/TLS encryption would be futile, too...
    – schroeder
    Apr 19, 2023 at 12:43
  • 1
    Please look up the term "secure key exchange": en.wikipedia.org/wiki/Key_exchange
    – schroeder
    Apr 19, 2023 at 12:46
  • @schroeder Somebody I know and discussed this matter with. Does it matter? I just want to verify his statement or (I would appreciate this more :)) get some counter-arguments. Thanks for the link. I will look it up.
    – Merc
    Apr 20, 2023 at 7:16
  • 1
    I just gave you counterarguments. If this was an online source, we would like the link so that we could review and determine if you misunderstood the statement. As it stands, the person you talked to has no idea what they are talking about.
    – schroeder
    Apr 20, 2023 at 7:55

0

Browse other questions tagged .