I've been trying to wrap my brain around VPNs for a while now, but can't find a good source that answers the questions I have.

In particular, I can't understand why browsing from a public access point is more secure while logged into a VPN than not. It's my understanding that a VPN encrypts and routes traffic from the computer to the access point, across the Internet, to the VPN server, where queries are then directed to the appropriate destinations; responses then follow the trail in the opposite direction (Please correct me if this is a misunderstanding.)

Where exactly is the danger in not doing this? That is, why are my packets less secure originating from the public access point than they are from home? They still travel to the same destinations across the same Internet, and are likely going to be locally routed by the same ISP.

(There's something that seems like a good answer to this question here, but if I'm understanding it correctly, then it seems that all the articles touting the inviolable security of public browsing while logged into a VPN are misinformed.)

  • 1
    The simple answer is that for a random dude with a laptop, tapping into people's traffic on a public wifi network is a lot easier than tapping into an ISP's data stream. – tlng05 Dec 21 '14 at 1:29

The thing about a VPN is that the connection between your computer and the VPN end point is encrypted.

If you go to Joe's Coffee House and use their public WiFi, depending on the configuration it is possible that anyone in the range of your WiFi radio can snoop on your traffic. Even if Joe has secured his WiFi properly, anyone with access to the physical equipment (not necessarily Joe, but anyone with access) can tap the connection at the transition from WiFi to wired, where the WiFi encryption no longer protects the signal.

If, instead of connecting directly to wherever you want to go, you connect to a VPN, and from the VPN's endpoint connect to your destination, then everything that passes through Joe's is encrypted. Your data could be sent in the clear from the VPN's endpoint to the destination, so you need trust in the VPN's endpoint. From the endpoint of the VPN, your packets travel exactly the same path they'd travel if your computer were physically located at the VPN endpoint. The VPN protects your egress from a network the trustworthiness of which is suspect.

Finally, most sensitive web sites these days, and many that are not, use TLS encryption. Give or take a POODLE attack, without the VPN, a snooper at Joe's could see where you connected, but not what you send. With a VPN, the snooper can only see that you connect to the VPN, and not that you then connect to Bob's Bank in the trailer on main street.

  • Thanks so much for the answer- it cleared up what's so far been an oversight in every article I've read on the matter. – JMTusk_16 Dec 21 '14 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.