4

Please don't promote any company here, just leave an answer regarding the overall concept.

Because of COVID-19, I had to leave city and working from village. The problem in village is that, the Internet I am using it has lots of problem. Like I can't browse most of the sites even though those sites are not banned or blocked by government. But when I connect using a VPN, I can browse those sites. Even sometimes I can browse without VPN.

I learned about the issue, it's a telecom company caching issue. In remote area, they don’t cache all the sites except some popular websites. Is it true?

For example, I can’t browse Slack.com from village smoothly but when I connect VPN, I can use Slack.com.

I am now thinking of getting paid VPN and install on my Linux PC.

But I am very worried if the VPN is secure or not. Will they steal my data? Because I use it to purchase items online, I enter my card info, also lots of my personal sensitive info and some intellectual property.

Can anyone confirm, if it is safe connecting VPN on my Linux machine and working? Is there any chance of stealing my data by VPN provider even though I am going to get paid VPN?

2

Security is fine with most any VPN. Privacy? Be careful which VPN provider you decide to use; research their history and their ownership.

Encryption via HTTPS even through an VPN connection won’t protect your privacy as far as logs showing how you us the VPN go if that service logs activity and shares it with others.

You ask this:

“But I am very worried if the VPN is secure or not.”

Gronostaj states this in his answer:

“All data you send, such as banking details, passwords etc. are encrypted by HTTPS if the website is using it.”

Both of you are 100% correct in each of your points of view. You are right to be concerned about security on VPNs and Gronostaj is correct to say that HTTPS is secure.

But VPNs aren’t magic. And the safety and security of a VPN depends completely on who owns and runs a VPN and of you trust them. This is regardless of HTTPS being used or not and — sadly but not surprisingly — not all VPNs are run by trustworthy people.

This Lifehacker article from 2013 states it very clearly:

“To a certain extent, you're right. You do have to trust that your VPN service provider has your best interests at heart, because you're relying on them to secure your connection, keep everything encrypted, and to protect your activity from prying eyes. You're connected to their network and their servers, and you have to trust that when they say your exit IP is in Sweden, for example, it really is and they're not just obfuscating something else. It's true—when you sign up for a VPN, you put a lot of trust in the company you sign up with.”

So what does this all mean to you when you are stating basic trust in things like credit card information and such and know that HTTPS will protect you. Easy:

What does the VPN provider log and who might the VPN company share that information with.

For example, you briefly mention government restrictions, right? What if you use a VPN to go to sites your country’s government doesn’t want you to go to via a VPN.

Your VPN provider won’t know any credentials or credit card information you pass along. But if they log your access to a site the government doesn’t like and — if push comes to shove — the government requests data on you from that VPN provider, you could be at risk of the government seeing that you (via your paid account) went to that site they don’t like and can use that as an excuse to harass you, arrest you or even worse.

So before you commit to using a specific VPN provider, do some basic research on them online to see if you trust them. Without naming names a few of the major discount VPN providers have sketchy investors/leadership and some even have a history with malware that they claim they denounce nowadays… But I personally would not trust a place that “cleaned up their act” that way.

7

VPN doesn't affect the security of websites that use HTTPS. Nowadays most of the websites do use it. You can check this by clicking the padlock icon next to the address bar and reading the message that will appear. It should say something like "Connection secure" (exact message and visuals depend on the browser you're using).

HTTPS offers full protection of data transferred between your computer and the server you're connecting to. VPN doesn't cancel this encryption - it only routes all your traffic through VPN provider's servers with an additional layer of encryption between your PC and the VPN server.

HTTPS doesn't encrypt the IP and domain name of visited website, though. For example right now I'm answering your question on a HTTPS-protected page https://superuser.com/questions/1641753/is-paid-vpn-safe-to-browse-and-do-online-banking and all parties involved in providing the connection from my computer to that website know that I'm visiting superuser.com (not the exact URL though). That's the case both with VPN and without it.

The additional layer of encryption that VPN adds makes it impossible to get this information for 3rd parties between your computer and VPN provider's servers, but owners of the infrastructure between that server and the target server can still see that somebody is visiting superuser.com. They can't associate it with you though, just with the VPN provider. On the other hand, your VPN provider also has this knowledge now, whereas without you using the VPN they wouldn't have it.

All data you send, such as banking details, passwords etc. are encrypted by HTTPS if the website is using it.

1
  • 2
    Also I'd like to add ECH (ESNI's successor) plans to help encrypt the SNI (eg. superuser.com) too, which would make only the IP address of the server visible, given that many websites tend to use popular CDNs (eg. cloudflare). It would make it much harder to censor/figure out the websites users visit. – Anunay Apr 14 at 22:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.