Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Openvpn uses a type of encryption similar to ssl. This seems to suggest that even if I choose an incredibly shady VPN server, then my content will be secure. That is, the VPN server will be able to monitor what websites I patronize, but not the actual data I transfer.

That said, I am not an expert at this type of thing. I wanted, therefore, to make sure that I understand correctly. Is it true that if I use openvpn that my username/passwords are secure, even if the VPN is untrustworthy? If not, why? (And how, if at all, can it be fixed?)

Examples of things that I don't know much about that may (or may not! I honestly don't know much about this.) be related to my question are: DNS leakage, IPv6, tracking cookies, browser plugins and websites that don't support https.

share|improve this question
    
I remember a similar question being asked just a few days back. Edit: Found it: Can VPN see web browser usage? Also see If I log into with VPN to a remote server can they see my files? –  Karan Jun 28 '13 at 16:43
add comment

1 Answer

Yes.

You're just trading one chain of trust for another. Instead of trusting your current access point and their ISP, you're now trusting the VPN host and their ISP; It doesn't matter which VPN technology you're using.

HTTPS connections will keep your username/passwords/content safe (even if you are not using a VPN), but not block the person running the VPN from seeing your DNS queries or what servers you're connecting to. They can see anything sent over HTTP, including stuff sent by browser plugins.

share|improve this answer
    
Hi Darth. Isn't it true that https uses ssl, and that's why the ISP can't see the content? In that case, if openvpn uses an encryption similar to ssl for all content, wouldn't that mean that there is no plaintext? –  Duff Jun 28 '13 at 16:27
1  
@Duff Yes, but only between you and the VPN server. On the VPN server, the traffic is decrypted and then sent out onto the internet. This is why you need HTTPS on top of VPN (encryption inside of encryption) so that after the traffic leaves the VPN server, it is still encrypted all the way to its destination. –  Darth Android Jun 28 '13 at 16:30
    
I see. And do the plugins and cookies and so forth reveal my password and username? (In things like gmail, facebook, etc.) Also, is there some way to encrypt everything? Or must the website support https in order to understand encrypted data? –  Duff Jun 28 '13 at 16:33
    
Plugins could, though usually they don't. Up to you to trust them (or read and understand their source code). The only way to encrypt everything all the way to it's destination is to use HTTPS everywhere, all the time (or use a trusted VPN if the target is a network protected by the VPN, such as a work environment). Sadly, the internet doesn't support this yet. Try the HTTPS Everywhere plugin for Chrome if you want to get close, though. –  Darth Android Jun 28 '13 at 17:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.