this post was submitted on 16 May 2024

36 points (100.0% liked)

Technology

37707 readers

264 users here now

A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.

Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.

Subcommunities on Beehaw:

This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.

founded 2 years ago

MODERATORS

[email protected]

Does a VPN used on a smartphone with Wi-Fi disabled (mobile data only enabled) provide any sort of protection? (beehaw.org)

submitted 5 months ago by [email protected] to c/[email protected]

65 comments fedilink hide all child comments

I've never completely understood this, but I think the answer would probably be "no," although I'm not sure. Usually when I leave the house I turn off wifi and just use mobile data (this is a habit from my pre-VPN days), although I guess I should probably just keep it on since using strange Wi-Fi with a VPN is ok (unless someone at Starbucks is using the evil twin router trick . . . ?). I was generally under the impression that mobile data is harder to interfere with than Wi-Fi, but I could well be wrong and my notions out of date. So, if need be, please set me straight. 🙂

top 50 comments

sorted by: hot top controversial new old

[–] [email protected] 28 points 5 months ago* (last edited 5 months ago) (3 children)

Commercial VPNs as a security measure are pretty much a scam, at least in the way they are marketed.

These days, basically any web traffic is encrypted through HTTPS. Even on an untrusted network, nobody will be able to see the actual content (passwords, personal data) of what you're doing. DNS spoofing isn't viable either as any fake site they would send you to would lack the right certificates to establish a convincing HTTPS connection. So all someone can see is what servers you're connecting to, either by logging your DNS requests (can be prevented by using some form of encrypted DNS like DNS over HTTPS) or the IP addresses you connect to. And honestly, how much value does one get out of knowing that there's someone on their network who browses beehaw.org, supergreatbank.com and bigtiddygothgfs.to with no information to connect that to an actual person?

Unless you routinely use shady open Wi-Fi networks - and I'm talking about something that may have been setup on purpose by a malicious actor, not your local supermarket - to do security-critical stuff, you don't need a VPN. Also, if you trust your mobile data provider less than a company that tricks people into thinking you absolutely need their product to secure your data, you should get a different mobile data provider.

Now, there are use cases for VPNs but those are more along the lines of accessing stuff that's not available in whatever region you're currently in.

See also Tom Scott's video on the topic. It's a few years old but still relevant.

Edit: there is of course also the use case of hiding illegal stuff. In that case, I will not give any advice. Put some onions on top of your router or something, that's probably cheaper and more reliable.

Edit 2: just to make this entirely clear, I'm talking about commercial VPNs like NordVPN, Surfshark and whoever else pays YouTubers to advertise for them. If you host your own VPN, some of the downsides may not be as relevant. Though I would assume that anyone who even considers hosting their own VPN has enough technical knowledge about how networking works to know about the pros and cons.

[–] [email protected] 15 points 5 months ago (1 children)

Do you want a random third party looking at all of your mail before you pick it up? Even if they can't open the envelope, having somebody else write down every message that comes in who it's from and who it's too and how frequent it is, that creep me out.

If you're uncomfortable with a third party looking at your mail, it's very reasonable to not one third party's looking at your internet traffic. It's the same thing.

[–] [email protected] 22 points 5 months ago (2 children)

A commercial VPN provider is just another random third party.

[–] [email protected] 18 points 5 months ago* (last edited 5 months ago) (1 children)

You get to choose them. You can research them. They don't have a geographic monopoly on your internet connection. That gives you more control, and then more incentives to do the right thing

If you pay for your VPN using crypto, then they can't tie it to your name, when they're reselling the traffic it's harder to tie it to an identity

https://www.privacyguides.org/en/basics/vpn-overview/

A VPN has many advantages, including:

Hiding your traffic from only your Internet Service Provider.
Hiding your downloads (such as torrents) from your ISP and anti-piracy organizations.
Hiding your IP from third-party websites and services, helping you blend in and preventing IP based tracking.
Allowing you to bypass geo-restrictions on certain content.

VPNs can provide some of the same benefits Tor provides, such as hiding your IP from the websites you visit and geographically shifting your network traffic, and good VPN providers will not cooperate with e.g. legal authorities from oppressive regimes, especially if you choose a VPN provider outside your own jurisdiction.

[–] [email protected] 3 points 5 months ago (1 children)

If you pay for your VPN using crypto, then they can't tie it to your name, when they're reselling the traffic it's harder to tie it to an identity

Surely that only works if you have personally mined the crypto yourself.
And if you only use that wallet for paying for the same VPN service.
Crypto isn't anonymous, the ledger of all transactions (IE the Blockchain) can be read by anyone.

load more comments (1 replies)

[–] [email protected] 6 points 5 months ago

That, unlike your ISP, isn’t obligated by law to log the connections you make (‘data retention’). Depending on the jurisdictions.

[–] [email protected] 6 points 5 months ago

HTTPS, sure. But your ISP can and will create a pretty comprehensive social graph about you using only metadata (server IPs or hostnames). Where I live, all home networks basically have a static IP. Also, besides a commercial incentive, ISPs are also mandated to log your connections. VPNs are not.

load more comments (1 replies)

[–] [email protected] 24 points 5 months ago (1 children)

Usually when I leave the house I turn off wifi and just use mobile data

I would stronly recommend that you set your wifi to only join trusted networks. That way you can also just leave the wifi on and not have it connect to every random network it encounters.

[–] [email protected] 6 points 5 months ago* (last edited 5 months ago)

I would still recommend turning wifi off when leaving home for privacy reasons (which can easily be automated). The process to identify if a network is trusted or not requires a handshake. So leaving wifi on makes you trackable by the wifi network operators and the apps on your phone with access to your wifi, wether you connect a network or not.

[–] [email protected] 22 points 5 months ago (3 children)

You’re hiding your traffic route from your mobile operator and giving it instead to your vpn company who swear they are honest

[–] [email protected] 20 points 5 months ago* (last edited 5 months ago) (2 children)

I run my own wireguard VPN at home and connect to it from my phone when I'm traveling.

Grants me privacy (but not anonymity) from my mobile carrier. Sure, my home ISP still sees my VPN's traffic, but that's still one less company able to monitor my web traffic when I'm mobile.

[–] [email protected] 5 points 5 months ago (1 children)

Running your own VPN in that situation is a good use-case agreed - assuming you trust yourself :)

[–] [email protected] 8 points 5 months ago (1 children)

I'm experienced enough to know that out of my mobile carrier and ISP, I am the least trustworthy operator.

[–] [email protected] 2 points 5 months ago

Thanks for the smile this morning 🙂

[–] [email protected] 3 points 5 months ago

Same. Also feels a bit safer connecting to public wifi.

load more comments (2 replies)

[–] [email protected] 14 points 5 months ago (2 children)

Your provider will just see encrypted traffic (mostly), so yes it will provide protection.

[–] [email protected] 8 points 5 months ago (2 children)

Your provider will just see encrypted traffic (mostly) anyway, so no it will not provide protection. The only thing that you're now hiding from your provider is which servers you're connecting to. Instead you're showing that info to a VPN company whose main business practice is scaring people into buying a product they probably don't need. Think about who you would trust more.

[–] [email protected] 6 points 5 months ago (1 children)

The provider and national TLAs will see all traffic that is in cleartext and meta traffic which is even more valuable. It can also actively tamper with that traffic. So you're technically incorrect and you assume your threat model is universal. It's not. And, of course, there are use cases for Tor, whether with or without VPN.

[–] [email protected] 3 points 5 months ago* (last edited 5 months ago) (3 children)

While my threat model is not universal, it comes close, at least for the average user which OP seems to be from their question. In practice, there is very little unencrypted traffic these days and in the case of that traffic you will have to ask yourself if your (commercial) VPN provider is more trustworthy than your ISP.

If you need to ask if you need a VPN there's a 99% chance that you don't. There are certainly a few use cases for both commercial VPNs and TOR (see my other comment) but to even be aware that those apply to you, you probably already have enough technical knowledge to approach the question from the direction "I want to do XYZ, how can I be more secure?" and not "I've heard of VPNs, do I need one?"

[–] [email protected] 8 points 5 months ago (1 children)

My national government has no business knowing which protocols I use to contact which endpoints and tamper with that traffic. Wrapping up that information in a tunnel is a good first protection layer.

[–] [email protected] 5 points 5 months ago (3 children)

If you're using a commercial VPN from a provider who can legally operate in your country, your national government can just as easily get that information from them as from your ISP.

[–] [email protected] 6 points 5 months ago

Correct. But that's no reason to make it easy for them. Burglars can break my windows and climb through and steal my stuff. I'm still going to lock my doors

[–] [email protected] 3 points 5 months ago

While ISPs are in many jurisdictions obligated to log your connections (data retentions laws), VPN providers are not.

[–] [email protected] 3 points 5 months ago

How would a national government (not TLAs) target particular individuals in a large number of users and what information can they gather given e.g. https://mullvad.net/en/help/no-logging-data-policy ? So perhaps not quite as easily as ordering a tap.

[–] [email protected] 3 points 5 months ago

Even though most data traffic is encrypted who you're talking to is not encrypted.

So a third party can observe, who you're talking to, how much data you're sending to them, how frequently you talk to them....

The classic example is if you start visiting a suicide prevention website, even though they don't know the content that you're being served, they can guess oh you're having mental issues. We should revoke your security clearance... Etc

load more comments (1 replies)

[–] [email protected] 6 points 5 months ago (2 children)

Your replies all make a very big assumption that the only connections being made, by people who are advocating VPNs, are over https (or possibly ssh) and thus VPN isn’t necessary. There exists more services than that some of which aren’t end-to-end encrypted (many messaging apps, for example).

Also, I agree that at the end of the day, a user is trusting someone not to snoop. But given that ISPs have been proven to snoop (for various reasons), I personally will put my trust in a VPN provider that I have researched and one that has shown a considerable resilience against outside forces. Mullvad comes to mind here.

Yes, a VPN is probably overkill if all the user is doing is using a web browser, nowadays. But it is useful beyond just setting up a tunnel for access.

[–] [email protected] 5 points 5 months ago (1 children)

Although it is possible that some messaging apps send completely unencrypted messages, most (reputable) non-E2E apps are probably still using HTTPS. It just means that when the message arrives at the messaging app's servers, they can decrypt the message and store it in plaintext.

[–] [email protected] 4 points 5 months ago

That’s true, thank you.

Some other possible unencrypted services people use today… email over non-SSL (which still does exist). Bittorrent. Non-SSL NNTP, which is also still supported. And DNS.

Of course much of that has options of securing, but the point is that a VPN shifts the trust of them not being secure over to an entity that may be more trustworthy.

And sometimes that becomes the path of least resistance for people.

I use a VPN for access to my house (inbound), but also to prevent my ISP from ever snooping on anything for certain services (inbound and outbound) — content, headers, metadata of any kind. I trust Mullvad right now much more than I trust my ISP.

Not everyone’s use case is the same. But that doesn’t mean it is somehow invalid as some posts here have alluded to. Though, I do agree with some posts here that the commercialization of VPNs is playing on people’s possibly-unfounded fear (NordVPN and the like, putting ads seemingly everywhere acting like everyone is watching).

[–] [email protected] 3 points 5 months ago (4 children)

A VPN doesn’t do much to protect HTTP connections.

load more comments (4 replies)

[–] [email protected] 8 points 5 months ago (1 children)

Only if you trust your VPN service more than your mobile Internet provider.

[–] [email protected] 6 points 5 months ago

You forget that nation-states control your ISP. And of course you can choose your VPN provider or run your own.

[–] [email protected] 13 points 5 months ago* (last edited 5 months ago)

Using a VPN for your mobile traffic protects your mobile traffic from Flow analysis from your mobile operator. So that is a strict net benefit.

[–] [email protected] 8 points 5 months ago

Protection from what?

If it’s your phone leaking your location, then yes and also disable location services and Bluetooth as well.

You mention interference. Mobile data can be interfered from miles away at the phone company. Same for your home internet.

[–] [email protected] 7 points 5 months ago

Only if you live in a country like russia, china, iran, north korea or south arabia

[–] [email protected] 7 points 5 months ago* (last edited 5 months ago) (1 children)

Any public data exchange has an element of risk, but the management/priority of that risk relates to your relevant risk matrix/profile.

Any exposed data transverses via a provider, be it mobile or Wi-Fi is pertinent, if you are concerned about provider vulnerabilities and exposure, be it Wi-Fi or mobile, use a VPN and related encryption.

[–] [email protected] 3 points 5 months ago

Or don't. Unless you know that your provider is working against your best interests, a VPN provider is just as likely to be compromised as your cable or mobile ISP.

[–] [email protected] 6 points 5 months ago (16 children)

What sort of protection are you after? Your VPN should encrypt your data to make it more difficult to snoop on your activity. I wouldn't trust any random WiFi hot-spot just because you got a VPN encrypting your traffic though.

[–] [email protected] 8 points 5 months ago

Note that VPN is just trusting a different network.

If you trust your VPN provider not to misuse your unencrypted traffic / inject exploits, but not your mobile phone provider (or any other network provider you might roam onto), then a VPN provider could help.

If you trust your VPN provider less than the mobile phone provider, the situation is reversed - you would be better not to use a VPN.

If you trust them equally, there is probably no point using a VPN (except for the roaming situation, which could be forced in certain circumstances).

load more comments (15 replies)

[–] [email protected] 3 points 5 months ago (2 children)

The spyware in your radio firmwarr always has direct internet access and it won't use your vpn

load more comments (2 replies)

load more comments