this post was submitted on 16 May 2024
36 points (100.0% liked)
Technology
37519 readers
122 users here now
A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.
Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.
Subcommunities on Beehaw:
This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Your replies all make a very big assumption that the only connections being made, by people who are advocating VPNs, are over https (or possibly ssh) and thus VPN isn’t necessary. There exists more services than that some of which aren’t end-to-end encrypted (many messaging apps, for example).
Also, I agree that at the end of the day, a user is trusting someone not to snoop. But given that ISPs have been proven to snoop (for various reasons), I personally will put my trust in a VPN provider that I have researched and one that has shown a considerable resilience against outside forces. Mullvad comes to mind here.
Yes, a VPN is probably overkill if all the user is doing is using a web browser, nowadays. But it is useful beyond just setting up a tunnel for access.
Although it is possible that some messaging apps send completely unencrypted messages, most (reputable) non-E2E apps are probably still using HTTPS. It just means that when the message arrives at the messaging app's servers, they can decrypt the message and store it in plaintext.
That’s true, thank you.
Some other possible unencrypted services people use today… email over non-SSL (which still does exist). Bittorrent. Non-SSL NNTP, which is also still supported. And DNS.
Of course much of that has options of securing, but the point is that a VPN shifts the trust of them not being secure over to an entity that may be more trustworthy.
And sometimes that becomes the path of least resistance for people.
I use a VPN for access to my house (inbound), but also to prevent my ISP from ever snooping on anything for certain services (inbound and outbound) — content, headers, metadata of any kind. I trust Mullvad right now much more than I trust my ISP.
Not everyone’s use case is the same. But that doesn’t mean it is somehow invalid as some posts here have alluded to. Though, I do agree with some posts here that the commercialization of VPNs is playing on people’s possibly-unfounded fear (NordVPN and the like, putting ads seemingly everywhere acting like everyone is watching).
A VPN doesn’t do much to protect HTTP connections.
Explain?
Your data still travels across the internet unencrypted. It only protects you on the LAN level.
Wouldn't the lan level be the most important part to protect when accessing http website? How likely are your connections to be hijacked once you are outside of your VPN tunnel?
I don’t know how likely that is. But I was a bit too quick in my judgement, on public networks a VPN does ass significant protection to HTTP connections. Not really on home networks, mobile networks or well-secured public/office networks though.
I honestly don’t know how much risk your data is at after leaving the tunnel. Luckily most things are HTTPS now.