0

I seek protection against MITM & snooping of VPN or Tor proxy traffic on public WiFi.

So, what are the different security impacts of each of these 2 solutions:

  • Using a VPN (like Proton VPN) to connect to the internet while using public WiFi (I use NetGuard VPN as my firewall).
  • Using a Tor Socks proxy (Orbot) to connect to the Tor network and use that for my internet needs while on public WiFi.

I am interested in what an attacker could do if they have access to the public wifi access point.

Improve this question
6
  • Both solutions would prevent the operator of the public wifi access point from knowing the IP addresses of domain names of the sites that you are accessing. However, with the first solution, assuming you are connecting to sites using a modern version of TLS - the VPN provider would be able to see the IP addresses of the sites that you are accessing, and possibly the domain names of these sites, but would not be able to see content sent between you and the site.
    – mti2935
    Aug 21 at 18:59
  • @mti2935 Thank you! :) VPN seeing domains is not problem, my concern before question got edited was whether routing traffic through Orbot is safe since I'm planning on using public WiFi and didn't want to turn off Netguard VPN to use ProtonVPN rather than Orbot proxy since VPNs use secure "tunnel" while proxy is just another hop as far as I know.
    – John
    Aug 21 at 19:04
  • yeah, I edited your mess to something that is an actual question. I hope I retained your intent (I did my best at least). however, you seem to be unclear on what a VPN is and what a proxy is... for your use case, they both are just wrapping your traffic into a encrypted layer. (e.a. tunnel). 1 uses Tor, the other uses a VPN. there is essentially no difference as I see.
    – LvB
    Aug 22 at 9:45
  • @LvB Yeah, I'm not clear on difference in VPN and proxy and Tor proxy ...so if I understand correctly, it is not necessary to use VPN for public WiFi since Orbot secures traffic as well? I thought proxies are just for changing IP, not securing connection. Is it because of Tor or all proxies do that?
    – John
    Aug 22 at 11:47
  • your proxy (orbot) is not just a proxy though, it uses the TOR network as well proxies act as a "middle man" in this case it is running on your phone, and captures all traffic send to it, and than passes it on through the tor network. a VPN would also do this, but use there own systems and doesn't use the Tor network. depending on your thread model which you are protecting against informs you which option is better. they both have pro's and con's... using both is not really worth it in nearly all cases though.
    – LvB
    Aug 22 at 12:02

1 Answer 1

Reset to default
0

A VPN encrypts your traffic and relies on a single server. A Tor Socks proxy goes through multiple nodes with each node providing a new layer of encryption, offers higher anonymity while accessing a website, with the disadvantage of being slower.

I am interested in what an attacker could do if they have access to the public wifi access point.

Assuming someone can read all traffic between you and the router, a variety of things can be seen:

  1. Without VPN or Tor

Your mac address, if not spoofed. What Website you are accessing (and what exact data you are submitting (username, passwords etc.) when the Website doesnt use any encryption like HTTPS (very unlikely nowadays)).

  1. With VPN

Your mac address, if not spoofed. Except that, it can only be seen that you are accessing the VPN. All communication between you and the VPN is encrypted. The encryption is practically Impossible to crack, assuming it's configured properly.

  1. With Tor

Same as with VPN, only with the difference that all data is encrypted multiple times, 1 more time by each node it goes through.

Please keep in mind that both the Tor exit node and VPN can see the same data a mitm attacker would be able to see when not using a VPN or Tor (What website you are accessing etc., see 1)).

Blocking VPN and Tor

As a counter measure, the attacker could try blocking your VPN or Tor by dropping all connections to it and so forcing you to access the website without extra protection.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .