3

I am a privacy-conscious user currently living in Russia where the Internet is censored and monitored by the Russian state. Russian ISPs are legally required to log and store all users’ Internet traffic (even though in practice they seem to only log metadata if the traffic is encrypted with TLS, and many smaller ISPs violate the law by not maintaining logs at all) and provide it to law enforcement upon request. Russia blocks many popular VPNs, and Tor is only accessible through non-public bridges unknown to the Russian censorship authorities (they block the bridges they discover).

In this kind of an environment, it seems that using just about any VPN is better than using no VPN, even if the VPN in question is a “honey trap” controlled by the Chinese and logging users’ traffic in violation of its own privacy policy, as a recent leak has shown. Thus, in order to remain more private on my iPad, I further route much of my web traffic through the Onion Browser, using a User → VPN → Tor → Internet tunnel.

However, due to iPadOS limitations, the Onion Browser leaks information about the traffic through OCSP requests that are handled on the operating system level and are not routed through Tor, but only through the system-wide VPN I’m connected to. Given that an OCSP request contains the serial number of the website’s certificate which can be easily used to look up the domain (for example, at crt.sh), OCSP leaks somewhat defeat the purpose of using Tor in a situation where I don’t need to conceal my identity from the website I’m visiting, but want to hide my traffic from Russian ISPs, the Russian state, and a potentially nosy VPN.

So my question is the following:

How much of a privacy concern should be the fact that a VPN has access to my OCSP requests? Is there any information (official or leaked) about whether VPNs that log users’ traffic (openly or covertly) only log the traffic’s metadata or also its content? Has a logged OCSP request ever been used to unmask a user’s traffic?

P.S.: I can (and occasionally do) connect directly to Tor through a bridge that the Russian state seems not to know about, but am concerned that it increases the likelihood of the bridge being discovered and blocked (Russian ISPs are known to be using DPI), so I want to keep Tor bridges as a fallback option.

3
  • 1
    If there are fishy VPNs around (obviously, there are) and they look at this post they'll maybe start doing that. Or they already do it. It all depends on if you trust the VPN. Do you? If it is under control of Russia or Russia has access to clear text data in some way then they'll also have access to the requests. Are you worried about the nature of the requests? If yes, then you should change that. Potential solution would be to use one device for Tor/VPN access which does not have this issue and use it as a router for the iPad.
    – secfren
    Commented May 27, 2023 at 11:23
  • Simply put: A VPN is just like yet another internet access, but it is not physical and the other endpoint can be somewhere else instead of the nearest WiFi acces point / mobile hotspot / ethernet router for your non-virtual access. Apart from that, there is no difference: If you are worried about an attacker who can read your traffic e.g. at the access point provided by your ISP, then the same holds if you are worried that the attacker can coerce the VPN provider into granting access to your traffic when it arrives at their "end of the line", i.e., at the other end of the VPN tunnel Commented May 28, 2023 at 8:51
  • @secfren, I wouldn’t say that I fully trust the VPNs I connect to, but none of them seems to be controlled by Russia. If they were, they would have to adhere to Russian laws and block access to censored resources (Facebook, Instagram, and many others) including Tor, which would defeat the purpose of using them to begin with. Having said that, I wouldn’t exclude that the Russian state can in some way get access to their logs.
    – Gilgamesh
    Commented May 28, 2023 at 9:10

1 Answer 1

0

I don't know if there's any VPN providers that are intercepting OCSP requests, but yes the VPN providers can in theory intercept OCSP requests because OCSP requests are unencrypted. And if this can be a threat to your safety, then you should assume that they actively intercept and log them, even if they say they're not logging anything. If your safety is concerned, always assume that all VPN operators are liars that worked closely with Russian government, no matter how trustworthy they might seem. Only trust independently verifiable technical measures, and don't trust things that are just promises.

Realistically, whether this is something you need to be worried about depends on who's operating your VPN and where their servers are located. If you have a fairly trustworthy no-log VPN service that don't operate anything out of Russia, it is quite unlikely that they'll actually honour Russian warrants. But if you're using a VPN service that operates in Russia or have servers in Russia, then the Russian government would likely be able to force them to log your OCSP/internet traffic.

Note that OCSP leaks only leaks the website the you're visiting, but not the content of the traffic. If this is a concern to you, maybe you can see if you can just disable OCSP (not possible in iOS).

Also note that nowadays a lot of websites does OCSP stapling. If the website you're visiting staples, then your browser doesn't make OCSP requests. Consider if you can ask the operator of the website that you're visiting to set up OCSP stapling if they haven't already done so.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .