I am accessing the Google Play Store from a VPN software which will supposedly mask my IP to make it appear that I'm in the US (for country restrictions). My question is, will logging in to Google, or any website for that matter, while connected via VPN will expose my user information (email and password) to the VPN owners in some way or another? If so, are there any steps that I can do to prevent that while still use the VPN?
That depends on the connection type.
There's nothing special about VPNs in this regard. Every non-encrypted connection allows every computer in the trace route to sniff it. Your connection to the VPN should always be encrypted, but that doesn't matter if the connection between the VPN and the website isn't.
|show 2 more comments|
Many websites (and non-HTTP-based services such as games) that require some form of authentication, do not require or even allow encryption to be used. Common examples where no encryption is used for authentication:
Even if a compromised account on one of these services isn't particularly harmful to you, you should still be really careful: if your email address and/or password used are similar to or identical to passwords you use at valuable websites (Amazon, your bank, your email, etc), then sending those valuable passwords in the clear is a huge risk.
Personally, I use a unique password and often a different email address for every service I use that is in any way tied to my finances, business, or personally identifiable information (social security number, date of birth, etc). For less meaningful websites such as forums, I sometimes do use the same password, but I only overlap passwords between equally-meaningless accounts, not between valuable and non-valuable ones.
Google Play in particular should use SSL, because Google has adopted a policy that SSL is enabled by default whenever you are connecting to Google with a service that involves your Google Account. That's a pretty obvious and justifiable decision: basically, the way people are tied into Google these days, access to a Google Account means you gain access to their email, their documents, their purchased applications, their shopping history, and you can even do things like buy apps and use them, or buy things through Google Checkout and have them shipped to you. So the stakes are high enough that you have to try pretty hard to access any Google-authenticated service over regular HTTP these days.
If you're sticking to the plain old web (everything over