0

I've got a doubt: I'm starting to work in random places (consulting) which means I switch from a network infrastructure to another one depending on the client. I'm really concerned about security and such since I must work with "confidential" files and stuff (that is, files they cannot see).

All around the net is the suggestion of using a VPN to access work (I've got one) and home PCs from public places such as cafes, airports and such. I'm taking a client's network as such (even if it's a company and it should be "safe") as I don't wanna take risks, or at least not a lot.

My question is: If I log in to a work/home VPN (by DD-WRT, a linux box, fortigate, cisco, SSH tunnel, etc) with some kind of authentication (CHAP? MSCHAPv2? SSL?) is it enough to keep my communication safe?

I mean, will the network staff (or script kiddies in case of a public network somewhere in a cafe with free WiFi, since I have a laptop) see the data I'm transmitting, or is it encrypted enough? What I'd like to know is to which level can my network VPN data be sniffed, such as -what- is going over the wire or if they only see IPs (internal/external) and ports and then encrypted gibberish? like, all in all, is VPN safe in terms of sniffing data and/or network-related stuff? as, if I connect to a development server at 192.168.100.10 will they see it as such somewhere in their tracer? (I'm thinking of Wireshark and such).

Improve this question
1
  • Sounds alright. Caveat: you cannot accept unknown server certificates to prevent a MITM attack. All expected server certificates must be retrieved from a known safe path and cached/saved.
    – Bob
    Aug 16, 2014 at 2:32

1 Answer 1

Reset to default
1

VPN's will protect you from sniffing attacks. Ensuring adequately trustworthy certificate management occurs should prevent any possibility of a MiTM attack.

It works just like HTTPS, in the sense that you use a client program that authenticates the server's key with a trusted certificate in order to initiate an encrypted session, over which all of the traffic is sent. The only known hole in the process lies in mistrusting a certificate.

Caveat: Make sure your VPN provider (and client) isn't using a version of OpenSSL that is vulnerable to Hearbleed, as it poses a catastrophic security hole to the whole process.

Improve this answer
2
  • Thanks a lot @0xDAFACADE, I've got a small question about the certificates though, if I'm using a self-signed certificate (generated through putty or something) would that be OK? I mean, I trust my own certificate, so it's all good, right?
    – DARKGuy
    Sep 1, 2014 at 16:01
  • Self signed certs are no less secure, but are worth keeping an eye on fingerprints with so you don't get hit by an mitm. No different than dealing with unsigned PGP keys.
    – 0xDAFACADE
    Sep 1, 2014 at 16:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .