6

I only register (make an account/login stuff) on HTTPS webpages. However, a webpage I wanted to register right now doesn't use HTTPS. I am wondering if I am connected to my company VPN, is it safe to register on a webpage that uses just HTTP?

  • 2
    I wouln't trust a page, that hasn't set up https for login/register-procedures... – Mathias Vonende Jun 11 '15 at 9:41
  • 6
    Define "safe".. – Lightness Races in Orbit Jun 11 '15 at 10:27
  • 2
    you will be safe against man-in-the-middle attacks between your network and the network of your VPN-provider – TaXXoR Jun 11 '15 at 13:26
  • 3
    Others have already mentioned that you're still vulnerable between the remote host and your VPN provider. But there's more: HTTPS guarantees end-to-end encryption between two hosts. Without HTTPS, your VPN provider can see your plaintext traffic (including account info, etc.) - so you also have to ask if you trust your VPN provider. – Bob Jun 11 '15 at 18:41
  • 1
    Psst, The website you are using right this moment does not use HTTPS for login! But it's secure because it offloads that risk to OAuth services like Google. – SnakeDoc Jun 11 '15 at 21:50
20

Your company VPN will NOT encrypt data from your computer to the website you want to register yourself, only the data from your computer to your company's VPN-server.

HTTPS (if used correctly) makes sure data from your machine to the website is safe and that you are not the victim of a man-in-the-middle attack.

So. Is it safe? "Maybe" (but has nothing to do with your VPN), you could always get your account / password information stolen on the way from your VPN-server to the website.

  • Whether safety is related to his VPN cannot be determined because you do not know where the server is. It could well be securely linked to the VPN server or even the VPN server itself. Many corporations use such a setup. – qasdfdsaq Jun 11 '15 at 22:03
  • @qasdfdsaq Nevertheless, as long as the website doesn't use https, all data from the VPN-endpoint to the webserver will be unencrypted. – Lenniey Jun 12 '15 at 6:52
  • But if it's the same machine or on a secure corporate network that's equivalent to HTTPS, and completely different to sending the data over the public network. SSL does NOT guarantee end-to-end encryption to the actual data source so if he uses HTTPS, all data from the HTTPS endpoint to the webserver will be unencrypted. The HTTPS web front-end can (and often does) forward the connection to a different server that actually serves the web page via unencrypted channels (e.g. most load balancers) or public cloud frontends such CloudFlare or even just use unencrypted SQL lookups – qasdfdsaq Jun 12 '15 at 12:00
7

I guess you're worried about the details you enter onto the page being sent unencrypted.

The company VPN will secure the connection between you and the VPN server. The VPN server will still have to open an unencrypted connection between itself and the HTTP page/server, instead of your computer opening the connection itself.

Maybe it's ever so slightly safer, since a corporate Internet connection is secured better than a consumer one, but your information is still bring sent unencrypted and is still subject to man-in-the-middle'ing.

3

Seeing as my comments on other answers are getting pretty long I figured I'd separate it out:

It is impossible to answer if a corporate VPN connection offers equivalent security compared to SSL to a web server without knowing the exact specifics of the connection in question, which the OP hasn't specified.

However as a general reference there are two main scenarios to look at:

1) IF a user is using a VPN connection to a corporate network in order to connect to unencrypted public websites outside the corporate network, then the security offered is equivalent to directly accessing the same unencrypted website from the corporate network.

It will prevent interception of communications between your device and your corporate network but will not protect against interception between your corporate network and the public webserver. How secure it is depends on how much you trust your corporate network's connection to the public webserver.

In any case it will be less secure than a properly configured HTTPS connection direct to the public webserver from your client device.

However this mechanism will protect against eavesdropping on your local connection if for example you are using an unencrypted public hotspot or other untrusted ISP.

2) IF a user is using a VPN connection to a corporate network in order to connect to unencrypted resources on the corporate network behind the VPN server, or on the VPN server itself, then it is protecting the connection all the way to the target network itself.

This offers protection is roughly equivalent to HTTPS to the webserver in question.

ysdx's answer illustrates the first point well, except it misses out everything after the HTTP server.

A fully encrypted HTTPS connection to a webserver does not guarantee a completely secure to the source of the web page any more than a corporate VPN would in scenario 2.

HTTPS provides a security guarantee between two TCP endpoints. VPN provides a security guarantee between two TCP endpoints. In both cases, the endpoints are your PC, and a server at the edge of the other server's corporate/internal network. What happens after that edge is NOT secured by either method.

Many people forget that the HTTPS webserver you connect to during an HTTPS session is, in the case of many large websites, NOT the server the web page you are viewing comes from. The many reasons this happens include:

1) Load balancers, which will often have unencrypted network connection via a corporate LAN to various content servers that actually serve the content on the webpage.

2) Reverse proxies, NATs, and so forth that forward your connection - again, unencrypted, to arbitrary servers on the corporate LAN or even other public websites.

3) Caching servers or DDoS protection services such as CloudFlare, some of which operate on the public internet but forward your connection to a different company's server to actually serve the content - usually via a second encrypted connection or VPN.

4) Databases or NAS/SAN backends, where the web server uses an unencrypted connection to another server over the corporate LNA to retrieve the content for the website.

In all of these cases, the security of your web session relies on the security of the corporate LAN behind the HTTPS "gateway", in exactly the same way connecting to a corporate server behind a corporate VPN does.

1

No, using a VPN does not make VPN traffic safe. When going out of the VPN tunnel (between the VPN server and the HTTP server) the traffic is (in general) not encrypted:

                 Unencrypted HTTP here
                          |
                          v
[ HTTP    ]<--------------->[ HTTP ]
[ TCP     ]<--------------->[ TCP  ]
[ IP      ]<->[ IP      ]<->[ IP   ]
[ OpenVPN ]<->[ OpenVPN ]
[ TCP     ]<->[ TCP     ]
[ IP      ]<->[ IP      ]
 Client       VPN server    HTTP server

So it's only safe, if you assume that the path between the VPN server and the HTTP server is "safe" for some reason (it is the same host, it uses a VPN…).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.