Will using public VPNs expose my user information to the VPN owners?

Question

I am accessing the Google Play Store from a VPN software which will supposedly mask my IP to make it appear that I'm in the US (for country restrictions). My question is, will logging in to Google, or any website for that matter, while connected via VPN will expose my user information (email and password) to the VPN owners in some way or another? If so, are there any steps that I can do to prevent that while still use the VPN?

Answer 1

That depends on the connection type.

• Any information sent encrypted cannot be read by any computer in the trace route, except – of course – the endpoint. It makes no difference which type of internet connection you use. That includes VPNs.

  So, if the website you're visiting uses HTTPS, the VPN provider will have no access to your personal information.

• However, if the website requires information sent in plaintext, the VPN provider has to send that information unencrypted and – therefore – has to have access to it.

  If the website you're visiting uses HTTP, the VPN provider has access to your personal information.

There's nothing special about VPNs in this regard. Every non-encrypted connection allows every computer in the trace route to sniff it. Your connection to the VPN should always be encrypted, but that doesn't matter if the connection between the VPN and the website isn't.

Answer 2

Many websites (and non-HTTP-based services such as games) that require some form of authentication, do not require or even allow encryption to be used. Common examples where no encryption is used for authentication:

• IRC (some networks support SSL, but a very small minority of networks/users actually avail themselves of it)
• Multiplayer Game servers over UDP, for example MMORPGs, first person shooters, etc.
• Most "forum" websites that do not collect credit card information do not use any form of encryption (you can tell by the http rather than https in the address bar)
• Superuser and the stack exchange websites in general

Even if a compromised account on one of these services isn't particularly harmful to you, you should still be really careful: if your email address and/or password used are similar to or identical to passwords you use at valuable websites (Amazon, your bank, your email, etc), then sending those valuable passwords in the clear is a huge risk.

Personally, I use a unique password and often a different email address for every service I use that is in any way tied to my finances, business, or personally identifiable information (social security number, date of birth, etc). For less meaningful websites such as forums, I sometimes do use the same password, but I only overlap passwords between equally-meaningless accounts, not between valuable and non-valuable ones.

Google Play in particular should use SSL, because Google has adopted a policy that SSL is enabled by default whenever you are connecting to Google with a service that involves your Google Account. That's a pretty obvious and justifiable decision: basically, the way people are tied into Google these days, access to a Google Account means you gain access to their email, their documents, their purchased applications, their shopping history, and you can even do things like buy apps and use them, or buy things through Google Checkout and have them shipped to you. So the stakes are high enough that you have to try pretty hard to access any Google-authenticated service over regular HTTP these days.

If you're sticking to the plain old web (everything over http or https and no online games or custom apps that don't use a web browser interface), you can very easily tell whether the connection is "snoopable", provided that you aren't being subjected to a certificate authority man in the middle attack: just ask your browser for more information about the https encrypted connection, and make sure that the certificate chain is one that you trust (it should consist of publicly-verifiable root CAs who you can verify by googling their names). The way to get more information about your https connection is web browser-dependent, but it generally involves clicking on a lock icon or clicking on the address bar.