I live in a country that the government blocks most ways of accessing to the uncensored Internet (like blocking VPN pptp, l2tp), Luckily there are some very fast services still available like Kerio VPN.

But as I found out, It does not seem to be very safe as the person running the service could easily track your activity.

My question is, Is it possible for them to access to our information such as transferred data or passwords and such... ?

Is there anything you would suggest to prevent this?


Once you connect to a VPN service, they can record what they wish. A potential way around this is to VPN the VPN, if the service allows it (most do not). An alternate method is to connect to Tor from within the VPN connection, if the service allows it.

Secure connections, like https, should be encrypted, so passwords transmitted in that way would be recorded, but not in the clear. The goal is to keep as much control as you can so that you can make it difficult for your VPN provider to understand what is being passed through their network.

  • 1
    Tor endpoints can still sniff your data if it's not secure. You could also connect to Tor, then your VPN. Either way, if your data is insecure, you could be SOL. You could rent your own VM from a cheap provider like DigitalOcean starting at $5 USD / month, then install VPN software, but if DigitalOcean wants to sniff your data, they could. TLDR - Use HTTPS. – Mat Carlson Mar 21 '14 at 11:18

When you connect to a VPN, you are connecting to private network, but your network is only private from the greater network/Internet. Inside of the network, you have no additional protections - you are not private to the other members of the network.

You can still use HTTPS/TLS/SSL to encrypt your connection from your PC to the server you want to connect to, but this does not necessarily equate to privacy. Depending on the setup or other factors, you may be exposing yourself to more MitM attacks (ala BEAST) because the path is no longer your PC to your ISP to the interconnections - you have added another network in the middle. Even if they don't break the TLS, there is still metadata about the sites you are visiting and servers you are connecting to while on the VPN which the VPN owner can have (even if they tell you they are not, its hard to verify).

Where possible, you can use certificates to connect to an end point instead of passwords. This is more difficult to intercept. You could layer your VPNS, but most of the time people will turn to systems like TOR or other annonymizing networks. Networks such as tor are decetralized and where you exit the tor network is not always the same; however, if you control enough of the TOR nodes, privacy is not guaranteed.

  • Remember that you are still creating a trail of metadata, which might clearly identify your actions. – trognanders Mar 21 '14 at 0:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.