Sign in with
Sign up | Sign in
Your question

Free vpn secure on insecure wifi networks?

Last response: in Networking
Share
March 5, 2013 5:56:45 AM

About vpn security.
There are free vpn services. When the vpn adds a pad lock to the network icon, is it then secure to use it on insecure networks like public wifi to get internet access? I mean, the password is given to you from the vpn provider's website. Can you explain this? Thanks.
March 5, 2013 11:10:18 AM

In most ways it is not any more secure using VPN as not when you mean internet access. If you are accessing a private network then the vpn does create a secure connection to that network.

When you talk internet all it does is move the point you enter the internet. With public wireless it is easier to attack since more people have access. BUT it really shouldn't matter. Anything that needs to be secure should use its own protection to prevent any access. It doesn't really matter if it is compromised at the wireless or as it enters the internet at the VPN provider. You never really know how competent the VPN provider is you have to assume it is possible to intercept your data either by a dishonest employee at the VPN provider or a hacker that found a exploit in the providers network.

When you use a public wireless you make sure anything that is sensitive has its own good security or you only do things you don't really care about. Does it really matter if people see what you read or post to say these forums.

March 5, 2013 3:35:49 PM

Thank you for your answer.
Now this is about, that if you do something and think it is secure, and it is not, that is irritating.
Maybe I should specify my question. If I connect to a wifi, and the connection is not encrypted, then everyone can listen. If the connection is encrypted, no one can. The question is, is a non encrypted wifi connection secure if you establish a pad lock vpn connection? It is only the wifi part that is in question, not beyond.
If it is secure, then why doesnt it matter that the password is to be seen on the free vpn provider's website? Thanks.




bill001g said:
In most ways it is not any more secure using VPN as not when you mean internet access. If you are accessing a private network then the vpn does create a secure connection to that network.

When you talk internet all it does is move the point you enter the internet. With public wireless it is easier to attack since more people have access. BUT it really shouldn't matter. Anything that needs to be secure should use its own protection to prevent any access. It doesn't really matter if it is compromised at the wireless or as it enters the internet at the VPN provider. You never really know how competent the VPN provider is you have to assume it is possible to intercept your data either by a dishonest employee at the VPN provider or a hacker that found a exploit in the providers network.

When you use a public wireless you make sure anything that is sensitive has its own good security or you only do things you don't really care about. Does it really matter if people see what you read or post to say these forums.

Related resources
March 5, 2013 4:31:55 PM

I see yes if the VPN provider is a fool you could intercept the login process and defeat the encryption.

How this is actually done gets very complex when done correctly. In almost all cases they do not send the password itself over the link. In the simplest case they use it to generate a hash that can only be generated if you know the password but is impossible to reverse engineer.

Most sites use HTTPS sessions to establish a secure connection and then pass credentials to open the VPN tunnel over that.
March 6, 2013 10:09:43 AM

I have one most trusted VPN installed on my system i.e "Hotspot Shield". It ensures me complete security, 100% online privacy and provides anonymous web browsing. I always use it on public wifi hotspots to secure my online identity and confidential data.
March 6, 2013 6:54:00 PM

bill001g said:
I see yes if the VPN provider is a fool you could intercept the login process and defeat the encryption.

How this is actually done gets very complex when done correctly. In almost all cases they do not send the password itself over the link. In the simplest case they use it to generate a hash that can only be generated if you know the password but is impossible to reverse engineer.

Most sites use HTTPS sessions to establish a secure connection and then pass credentials to open the VPN tunnel over that.

Can it be that is is like when you give a person the password for an encrypted wifi? He can use the password to use the wifi, but he cannot listen to your connection to the wifi.
Thank you.
March 6, 2013 6:56:14 PM

AnnaHowart said:
I have one most trusted VPN installed on my system i.e "Hotspot Shield". It ensures me complete security, 100% online privacy and provides anonymous web browsing. I always use it on public wifi hotspots to secure my online identity and confidential data.

Thank you for answering. But it seems that it does not support linux.
March 7, 2013 11:17:09 AM

okppko said:
Can it be that is is like when you give a person the password for an encrypted wifi? He can use the password to use the wifi, but he cannot listen to your connection to the wifi.
Thank you.


If each person has a unique password/key there is little exposure.

Wireless can run in 2 modes. preshared key and enterprise. VPN is normally implemented like enterprise but you would have to check.

With a preshared key everyone uses the same key to get started. Unique keys are generated per session and they actually change over time. Still someone that knows the key can intercept this initial exchange and figure out the session key.

Enterprise every person uses either a unique password or some form of certificate to identify himself. It then also uses this information to generate the session key. This is much secure especially the certificate based method.

Now if they were to implement the VPN using preshared keys and use the same preshared key for everyone then you could be exposed.

The best solution is to be sure you are using HTTPS for any site that needs securing and be very careful on normal http pages. HTTPS is a certificate based encryption so it is very secure.

Many VPN providers are moving to tls/ssl for tunnels which is what https uses.
June 3, 2013 9:39:55 AM

You can also use the free PPTP or OpenVPN service from http://www.vpnbook.com

As PPTP client is included in most operating systems and OpenVPN is an open source project, no propriety software is needed.
June 7, 2013 1:04:03 PM

I have config the service and made it work. Do you know if vpnbook alters the password and if the connection is time limited? Thanks.
June 7, 2013 2:44:58 PM

//With a preshared key everyone uses the same key to get started. Unique keys are generated per session and they actually change over time. Still someone that knows the key can intercept this initial exchange and figure out the session key.

Although the free vpn services say their services are safe on plublic routers, while a session begins and listened to until unique keys are made, they are not, because the usernames and passwords are public?
Thank you.
!