Hacker News Reader

Comment by s1rech | Hacker News Reader

If you are using the network of a hotel or a train station, for instance. Assumption is that you trust that VPN provider of course.

View on HN

Well https takes care of that.

The hotel might be able to see that you visited a certain website but thats about it.

Asssuming they don't MITM your connection.

Which you would notice immediately because of the big, scary warnings.

Right, but how do you respond to that? Using a VPN seems like a reasonable approach in this situation.

It's a hotel right? I would respond by closing my laptop, then my eyelids, then checking out the next morning.

You respond primarily with non technical means, making a giant stink that a hotel that generally lives and dies on corporate money is man in the middling their WiFi.

Assume my hotel has some MITM running with the right (broken) certificates and so on.

Which is not that trivial to begin with.

How hard would it be to take over the dns and simulate a fake VPN too?

Or just constantly disconnect the vpn and hope the user stops using it for a while.

Presumably, you exchanged certs with the actual VPN over a known secure network prior.

And how would they do that? Your browser should warn you the certs aren’t trusted.

And if your browser does warn you: what do you do? You use a VPN.

You have now shifted your trust from your VPN provider to certificate authorities.

And, I guess, just ignore anything thats not https.

Or just be okay if your hotel blocks certain ports or destinations, which I've had happen multiple times.

> You have now shifted your trust from your VPN provider to certificate authorities.

Don't you have to trust the CAs in any case?

There are 168 root certificates in macOS and 255 in Windows.

My point was that you have to trust them in any case, even with a VPN. The number of certificates is irrelevant.

Well, http(s) isn’t the only traffic going through network.

Wouldn't you be better served by your own VPN server?

Not everyone can setup their own web/mail/vpn/whatever server.

Then you're the only person coming from that IP; a commercial service lets you hide in the crowd.

exactly. I have at least some trust in Mulvad, but I'll be damned if I'm getting on the hotel WiFi in a US hotel chain without VPN. Let alone while travelling in foreign countries.

I frequently access my bank info etc. on such trips. With a VPN at least I have fewer random threat vectors to consider on a network.

but every site nowadays use https. Doesn't it prevent issue with public wifi ?

Not all traffic is http.

What ‘bank info etc.’ are you accessing that isn’t TLS encrypted already? Adding IPSEC on top of that isn’t helping much, if at all…

I've frequently (especially outside the US, but even in a major hospital system here in San Francisco) come across WiFi networks that force access web through a MITM proxy. Yes, HTTPS will help me detect it, but if I need to actually get through, a VPN is helpful.

"bank info" in this case being anything from logging in to check my balance, pay bills or even contact them via their secure messaging because I'm disputing a transaction.

It doesn't eliminate all threats, but I'm not a secret agent ninja that needs 100% hardened communications. I just need a modicum of assurance.

Reply on news.ycombinator.com