2

I need to encrypt all my traffic, because I often work in unsecure network environments.

My questions is this:

if I buy my server from VPS providers (amazon ec2, digitalocean, etc) - how secure will be my traffic if I often work with http/ftp protocols (unencrypted protocols) ?

Can other clients from the same network (amazon ec2, digitalocean) sniff my traffic ?

I will use openvpn/ssh tunnels for routing my traffic.

|improve this question
  • I've played around with a PPTP VPN (insecure) through a Linode server. Regardless, there are several VPS providers that charge hourly. The downside is you have to rebuild the server every time you want to use it, on the other hand, they have stackscripts. – Nathan Goings Jul 31 '15 at 20:25
3

In regards to your first question:

The protocols you use will matter when leaving the VPN and going to the servers that you are trying to contact, so anyone sniffing traffic to those servers will be able to see what's being sent.

In regards to your second question:

If another person using EC2/Digital Ocean were able to sniff your traffic through that provider's network, it would be a MAJOR security flaw on the part of the provider, and I sincerely doubt that it would happen (unless you piss off the government and they get a warrant to force the provider to do it, but if you do that, they could also probably force the provider to identify you).

The main comment I have, though, is that you might not want to set up a VPN yourself, for multiple reasons:

  1. You're leaving a paper trail of who owns the VPN server with the cloud provider, who (as I mentioned) will be perfectly happy to identify you to the government. If you don't care about the government knowing what you're doing, you should be fine.

  2. The companies that provide VPN services will be able to host more than one VPN client on a single box, which provides:

    • More protection (as an attacker will not be able to distinguish traffic that is yours from traffic that belongs to other clients)
    • Lower costs, as they only require one instance for multiple VPN clients
  3. They're probably more optimized for what they're doing than something you set up will be, and they'll hopefully be less likely to make mistakes like allowing weak encryptions to be used.
|improve this answer
  • 1
    One disadvantage of doing this is that some sites have lists of VPN IP addresses and block them. This is less likely to happen if you are running your own provider. – Neil Smithline Jul 27 '15 at 19:45
  • Very true, though if I were using a site and they did this, I would write them explaining why this is a bad thing to do. IMO, any site that tries to prevent you from using secure practices doesn't deserve my business, but I guess I'm lucky enough that I don't have any sites that I absolutely have to use. – childofsoong Jul 27 '15 at 19:47
  • 2
    Some sites do this to ensure they are not violating licensing agreements that restrict access to specific countries. – Neil Smithline Jul 27 '15 at 19:51
  • That's true, but if you're getting into that territory, you may well run into other VPN blocking things, like deep packet inspections that attempt to block VPN connections in general. Especially with certain oppressive regimes like China, there's a bit a race between VPN providers and censors. – childofsoong Jul 27 '15 at 19:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.