New answers tagged

0

To my understanding: Some websites at Your company networks are blocked You access VPN which belongs to one of Your customers If above is correct, Your company's IT staff might not see websites You visit. The "might" in previous sentence relates to how do You access this VPN. If the VPN is not fully tunneled (e.g. You can see hosts in customer's network, ...


1

It really depends on what you really mean. Can they see what is in the packets? Probably not. Can they see that the traffic is encrypted and you are using a VPN? More than likely. Can they see your browser history? I would say it is safe to assume they would be able to. So in short, yes but not at the network level.


1

A Virtual Private Network VPN works at the network layer, and you could use it to route any network traffic, while a proxy could be many things. E.g. a SOCKS proxy proxies TCP connections and an SSH tunnel could be used for similar purposes than a VPN, but you are more likely referring to a HTTP proxy, that forward HTTP request. Nevertheless, proxy with an ...


1

The Trusted Computing Group (TCG) has defined a set of standards that allow VPN gateways (and other endpoints) to do that in a secure way called Trusted Network Communications (TNC). Many of them have also been released as RFCs by the nea IETF working group and some related ones by the sacm working group. The following image provides an overview of these ...


0

Express VPN uses a TLS handshake. Can’t find direct confirmation on their website but the below support about TLS problems indirectly confirms it. https://www.expressvpn.com/support/troubleshooting/log-items/unable-to-connect-incorrect-system-date-and-time/


1

You don't say who the VPN provider is but you mention using OpenVPN as one way of connecting. OpenVPN uses a TLS handshake, meaning the server and your PC will exchange public keys and authenticate each other. This allows you to send your login credentials to the VPN provider in an encrypted manner. This is in fact how most of the internet works to allow you ...


2

Technically, the answer to your question depends on the VPN software used and possibly on how it's configured - there are many different network authentication protocols out there, and many VPN programs support more than one - but in practice you can reasonably assume that your credentials are not sent in clear text. No VPN client worth the bytes used to ...


5

I doubt that they explicitly block VPN. But it is not uncommon that free networks and sometimes even paid networks in hotels restrict access to only allow web (HTTP/HTTPS) and mail in order to reduce possible misuse of their networks. This can have the side effect of implicitly blocking less common services like VPN as collateral damage. Specifically for ...


1

I don’t think you provided enough information to assign blame to an anti-VPN “security” measure yet. Many things may have gone wrong when attempting to establish the VPN connection. They could have had a captive portal interfering with the connection. They could have had any number of network interference problems going on (a DOS attack, ransomware, etc.). ...


0

@MechMK1 is absolutely correct. You are looking for a technical solution to a problem of policy, which is rarely something you want even if you can make it happen. I'd also think long and hard about why you feel that policy is necessary; there are a lot of bad reasons I can think of, and only a few good ones. After all, a VPN is a layer-3 solution, best ...


0

You can’t. As long as your VPN needs to be usable there is no feasible way to constrain it like that. As long as the profile or data exists on a disk that can be read and decrypted externally or in between boot stages no method will protect you. The closest you might get is a firmware-to-OS level of MDM on company hardware, but that is basically exclusive ...


3

HTTPS encrypts the content but: Anyone watching the stream, including your ISP, can easily see that you are going to www.bluebuggybumpers.com, or my.aids.results.com, or what have you. A VPN blinds your local ISP to where you go, although the VPN is capable of the same monitoring. The site you visit directly see's your IP address and can generally ...


0

@gowenfawr's answer is correct, but I'd also like to chime in with a couple interesting ideas. Cloud providers are coming out with instances that do just what you need. https://azure.microsoft.com/en-us/solutions/confidential-compute/ https://aws.amazon.com/cloudhsm/ These platforms leverage HSMs to safeguard data in-memory in hardware that encrypts its ...


2

What's the best method/solution for protecting the integrity and identity of end-user certs? Install an HSM on their devices and use keys stored within it for VPN. Expensive and difficult to set up. I want to make sure that users only able to use VPN with company provided devices. Then instead of trying to control the keys, which is difficult, use VPN ...


3

By asking your browser for the current time zone offset, e.g. var d = new Date(); console.log(d.getTimezoneOffset()) Since I'm in the US/Pacific time zone and it's currently summertime, this returns 420 (7 x 60) for me. With a bit of additional clever code, it's possible to estimate the exact time zone, rather than just the current offset.


1

There are many practical and legal gotchas with having an employee of a US-based company working remotely from outside the US, most of which are outlined at https://workplace.stackexchange.com/questions/132796/why-do-remote-us-companies-require-working-in-the-us/. In keeping with the Information Security theme, there are also physical security issues with ...


0

If your employer uses Office 365 or Azure, they may be subscribed to Enterprise Mobility + Security which includes detection for anomalous sign in behavior from users. If a domestic user suddenly starts signing in from an unfamiliar/overseas IP address, it triggers alarms. https://www.microsoft.com/en-us/microsoft-365/enterprise-mobility-security https://...


4

Only your company can know the answer to that question. However, I would suggest that there is still a firm answer here. Europe may be blacklisted If someone at your company wanted to track people connecting internationally, then they certainly can. However, that wouldn't be my concern. My concern would be that I would show up and find myself blocked ...


1

Approach the same concept as cloud servers, all server nodes are in private subnets and just build a NAT/VPN gateway to expose your services. It's complicated to messing around with VPN and dockers just because you have to manually control the iptables rules on each node.


Top 50 recent answers are included