VPNs are accessed by the user with credentials so that the information is encrypted. There are credentials that you download to allow this. Since you don't physically, in person get the credentials from the VPN provider they have to be downloaded which means using the internet. Now I know HTTPS is used but HTTPS is weak at best. Government organizations can look at HTTPS data and they don't have to immediately either. Your ISP is logging your web traffic anyway even if it's encrypted, they might break it in the future. How can you secure the actual security key/certificate which you are receiving from your VPN....

I realize this might not be possible without an in person physical exchange but isn't this a security killer for VPNs? This will protect you from rogue unsecured public WiFis and such but your ISP and government agencies will be able to get the VPN credentials which you downloaded through HTTPS.

Is there a way around this? Are there other techniques that combat this?

closed as unclear what you're asking by Xander, schroeder, TildalWave, Eric G, Rory Alsop Aug 28 '14 at 15:58

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    I am a little unsure of your question. Are you worried about a third party decrypting your VPN session, or are you worried about a third party stealing your VPN credentials and using it? – David Houde Aug 28 '14 at 8:34

First of all, HTTPS, if implemented correctly is not weak. Second of all if you are on the radar of a government, your last worry should be that they start decrypting your HTTPS traffic using a MiTM. If they are really interested in you, strong crypto won't be able to protect you from getting wrenched to the knee.

Most secure VPNs solutions use strong symmetric crypto to secure the communication for which the encryption key is exchanged between client and server using the same SSL/TLS protocol as used for HTTPS. So if you are worried that they can brake SSL/TLS in the future then you should equally be worried that they can break the SSL handshake your VPN uses to set up a secure connection, regardless if they were able to get your credentials or not.


Your question is fundamentally misguided. In some cases, the government may have been given access to private keys voluntarily by the organization that controls the keys, but if this is the case, they could just as easily share the contents of what is sent over the VPN as well.

The government could potentially use a complicit CA to sign something artificially so that your system would trust it, however you could verify the thumbprint matches the VPN provider (you do need some previously established trust in that case though, establishing initial trust is a hard problem and requires a securely shared secret.)

As for the ISP, yes, they could log your web traffic for your VPN just as much as HTTPS though, in fact, many VPNs are effectively just an HTTPS connection that streams non-HTTP data (SSL VPNs). It is not a reasonable objection to say they "might crack it in the future". Currently, it would take from now until the heat death of the universe to crack most good encryption systems if you put all the processing power in the world in to cracking it.

Fundamentally, you have to begin your basis of trust somewhere. For the vast majority of people, it is a reasonable risk to check that the initial connection is trusted if they can provide a signed cert and you can then compare the cert in the future to the one previously used to make sure the provider has not changed. If you want to be truely paranoid, verify with the provider offline or in person to ensure you have an accurate certificate for them. Alternately, if it is a VPN for remote access where you have access to the main resource, you can pre-share a symmetric key and bypass the asymmetric portion entirely.

Not the answer you're looking for? Browse other questions tagged or ask your own question.