I can't really understand the concept of VPNs, since we already have various secure transmission protocols.

Isn't the point of VPNs that people using its 'channels' can send encrypted data to each other? At the end, isn't it just one client and one server trying to exchange data securely? We have SSL/TLS for that and many other secure data transfer methods, don't we?

What s the point of using a distinct client software, server software, etc... to access the private network? What am I missing?


A private netowrk is a network consisting of cables and computers which are physically separated from the rest of the World. This makes for good security, and, furthermore, convincingly good security (having security is part of the goal, but you also want to know it).

A VPN is the cheap emulation of a private network: the wires are still linked with the Internet; the isolation is done with mathematics (cryptography) instead of physics.

Compared to "secure transmission protocols" (which work), the good point of a VPN is that it works at the OS level: as the system administrator, you configure the VPN once, and it protects the data transfer from all the applications, regardless of how poorly these applications were designed. Doing a proper SSL/TLS is not easy; for instance, many applications don't check for certificate revocation. Even if applications do the work correctly, going through the configuration of all of them is tiresome. A VPN saves time, so the sysadmin can more easily concentrate on ongoing attacks or other crucial tasks like resetting users' passwords or "continuous Internet-based training" (aka Websurfing).

  • "OS level". that opened my eyes a bit, thank you!
    – whage
    Jan 27 '14 at 12:55

In a perfect world, every software we are using to communicate via network would always communicate using strong encryption. We would also have access to 100% trustworthy and reliable keyservers and certifacate authorities. But unfortunately we aren't living in a perfect world.

In the real world, we have to deal with lots of software which doesn't support encryption, doesn't support sufficiently strong encryption, doesn't support encryption in a sufficiently user-friendly or practicable way, or has faults which cause it to inadvertedly communicate unencrypted.

A VPN software usually provides a virtual network interface which, from the perspective of software, works like any other network interface. Applications can use it without being aware that it encrypts their communication. That means they no longer need to implement encryption on their own because the VPN software takes care of it automatically.

But keep in mind that this only applies to communication which doesn't leave the VPN. When you use a proxy server on the VPN to communicate with the public internet, you have to make sure that either the proxy encrypts properly, or that your software does.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.