I keep hearing on VPN ads that you have to use a VPN to not have your login information stolen. So far I have been using Cloudflare WARP to be safe enough. However, if I am using an HTTPS website, do I really need a VPN or WARP? Will an attacker on the same network as me be able to access passwords transmitted over HTTPS?
You must log in or register to comment.
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
- 0 users online
- 57 users / day
- 383 users / week
- 1.5K users / month
- 5.7K users / 6 months
- 1 subscriber
- 2.43K Posts
- 57.3K Comments
- Modlog
If I’m on the same network, it is possible to have a MITM attack and resolve the content of the SSL cert.
That’s not really the case unless you add cert authorities to your device.
Resolve the content of the SSL cert? Sounds like something the CSI writers would say…
No, SSL is actually very good in preventing MITM attacks. That’s what alle the CAs are for you trust on your device.
https://github.com/moxie0/sslstrip
https://github.com/moxie0/sslsniff
You can ARP spoof a network and also serve spoofed certs resulting in the ability to resolve them. But I can see, if your not an expert, it’s hard to see the difference between reality and Navy CIS
Sorry, but no. Resolve certs? Seriously?
I don’t care anyway if you wanna start the not an expert argument. What you linked doesn’t work either in the modern web so… No, I am out.
This is pretty misleading due to its brevity, an attacker on the same network can determine what website you’re going to but not the content being exchanged. A VPN moves the threat of having your browsing destination determined to the VPN provider from the local network.
That said, modern WiFi encryption does prevent other devices on the network from eavesdropping, so the attacker would have to employ a more involved attack (e.g. ARP spoofing) in order to even see the destinations.