VPNs – Are they Really “Secure”?

September 26, 2024 Leave a comment

If you follow just about any content creator on YouTube these days, you’re probably going to see an ad for a VPN service. Every one of those ads say that they will keep your browsing secure. But is that really the case? Well, kinda. Like any security tool, VPNs are just a single piece of an overall security strategy. Let me explain. No, there is too much. Let me sum up (Princess Bride FTW). Aaaaaanyway…

My Name is VPN, You Killed My Security, Prepare to Die!

Last Princess Bride quote, I promise. Maybe. We’ll see. Get ready for parenthetical insertions ya’ll (If you’ve read the actual Princess Bride book, there’s a lot of them. Just like this article)! I’ll go over a little history first, then go into the different kinds of VPNs, and finally I’ll explain the real deal about what kind of security you’re getting with all those VPN services advertised on YouTube.

Some quick history: VPN, if you aren’t aware, stands for “Virtual Private Network.” The first VPN protocol was SwIPe (Software IP Encryption. No, I don’t know why the w and e are lower case). But SwIPe was really just a demonstration that it was possible to encrypt data transmitted between two separate networks. SwIPe was, however, the precursor to IPSec, which is still one of the most common VPN protocols in use today. IPSec, despite being a very effective VPN protocol, significantly increases the amount of data that needs to be transmitted between networks as well as the amount of processing time needed to encrypt and decrypt data. It’s also more difficult to implement than other VPN protocols. In the age of low bandwidth and limited processing time (This was the 90s, after all), IPSec was just too expensive to use in most environments. Why? Because IPSec performs an authentication check and then encrypts each “packet” of data before sending, then does the reverse at the other end. Enter PPTP (What do you call a Native American Urinal? Ok, that joke is a little problematic these days, but it still pops into my head every time I think of that acronym.)

PPTP (Point-to-point tunneling protocol) was developed under the leadership of Microsoft to address the bandwidth and processing overhead issues that were inherent in creating a VPN with IPSec. Rather than doing all the work required to authenticate and encrypt each packet, PPTP just created an encrypted “tunnel” between two networks and, like a really strong toddler with a shape sorter, shoves all the data through any way it can.

PPTP, while very light weight, was also not great (Yay! Rhymes!). It was also patented by Microsoft, so anyone who wanted to use it had to pay MS to do so. So Cisco, being Cisco (and this being when Microsoft was at its peak 1990s evil monopoly point), developed its own protocol called L2F (Layer 2 Forwarding, don’t ask what Layer 2 means if you aren’t an IT guy/gal. It’s a whole thing). It kinda did the same thing as PPTP, but with a few more chunks thrown it for better security and so it could work from router to router. Because Cisco. A few more protocols were created, but because I’m summing up here, I’ll just tell you what they are:

  • SSL (Secure Socket Layer) – Used to encrypt Web traffic
  • TLS (Transport Layer Security) – A modern version of SSL
  • SSTP (Secure Socket Tunneling Protocol) – Uses SSL/TLS to create a network-level VPN.
  • PPP (Point-to-Point Protocol) – More or less the same as PPTP, but developed through an industry partnership and available for use without licensing
  • L2TP (Layer 2 Transport Protocol) – Creates an unencrypted connection between networks. It was designed to be used with IPSec, but can be used without it

There are some subtle differences between those protocols, but they all do pretty much the same thing. The ones in heavy use today are TLS, SSTP, and IPSec (L2TP is still in limited use).

How it Works

VPNs work by setting up a direct communication channel between two computers or networks that are not on the same network (or subnet, if you’re an IT guy/gal). There are three types of VPN connection, host-to-host and point-to-point, and a hybrid of the two.

Host-to-Host VPNs

A host-to-host VPN is always just two computers on different networks talking to one another. The two computers can, as a result, communicate with each other even if they are on networks that aren’t directly connected. The computers that aren’t part of the host-to-host VPN can’t communicate over the VPN or read any of the data in VPN. Looks like this (I are good at diagrams):Host-to-host VPN

Host-to-host VPNs mostly use software on each computer to establish the connection. Your computer downloaded this webpage through a host-to-host VPN connection that was established when you opened the page, then immediately turned off after the download completed. This is a technicality, and we don’t consider it a true VPN in the IT industry when implemented like this. It’s not true VPN because the server is accessible on the Internet. TLS does encrypt traffic, though, and a lot of modern VPN solutions use TLS to establish a true VPN by just keeping that connection open and using a second encrypted channel (usually with IPSec) to route traffic between one computer and another. Host-to-host provides the most complete data transmission security because it prevents computers from any network from reading the data that is transmitted between the two systems. It’s also the VPN technology with the least flexibility. If you want to talk to a different computer on a different network, you have to shut down the connection to the first computer and establish a new connection with the other remote system (unless the first remote system is configured to share the VPN with its network, but that’s not really a host-to-host VPN).

In this setup, each computer will have two IP addresses associated with them if the VPN is configured to allow access to the local network while the VPN is running. One IP will be associated with the local network and one will be associated with the VPN connection. If the VPN connection is configured to use the same IP address scheme (192.168.5.x for example) for either network and one of the VPN connected computers, there can be some serious connectivity issues unless the VPN prevents access to the local network while the VPN is runnning.

Point-to-point VPNs

Point-to-point (or P2P) VPNs are used to connect two networks together. When a P2P VPN is set up, the computers on each side of the network are able to communicate with one another regardless of whether there is another network between them. P2P typically has to be set up on a router, firewall, or a dedicated VPN device (not as common today). It’s also possible to use servers to create a P2P VPN, but all traffic between networks will go through the servers when talking to a computer on the other network. Looks like this:
Point-to-Point VPNP2P VPNs are always available and don’t require users to do anything for the connection to work. A network administrator configures the VPN connection on two routers/firewalls/servers, starts it, and the networks will communicate. Hopefully. In this situation, computers in each network will communicate with one another as if they were on the same network and systems located between the P2P connections will be unable to read any of the data transmitted between the two networks. There’s also some additional configuration required if the systems on each side want to use the Internet (this is called split tunneling) as well as computers on the other network.

The P2P setup is extremely flexible when it comes to access between networks because each network sees the full remote network (unless the VPN is configured to limit that access). However, the VPN does not encrypt any traffic between computers on the same network, so it’s possible for someone in the same network as either computer to read the data between the two systems. Less secure, more flexible (the ever constant security balance).

In this setup, the computers have their normal IP addresses. However, if the two networks use the same IP address scheme (each network uses 192.168.5.x, for instance) the computers on the remote network won’t be accessible to client computers. This is an extremely common problem and is one of the chief reasons to avoid using a router’s default network addressing setup or the common network subnets (192.168.1.x, 192.168.0.x, and 10.0.0.x are the most common).

Hybrid VPN

A hybrid VPN allows a single client to communicate with all of the systems on the remote network (with limits, if configured). It uses a piece of software on a client computer to connect to a VPN Host in a second network. The VPN host will then route traffic from the client to the second network. Like-a-dis:
This is currently the most common method for running VPNs because it provides a greater level of security than a P2P setup, while being more flexible than a host-to-host setup. If the VPN allows it, the client computer can talk to any computer in the remote network and its local network, but computers on the local network will not be able to read any traffic between the client and the remote network. It may still be possible to read traffic from the client to the remote network from a system located in the remote network.

When a hybrid VPN is configured, the client computer will be given a second IP address, but that IP address will be different than the IP addresses of the remote network The interesting thing about this setup is that the VPN host device can “mask” the IP address of the client computer. This means the client computer will use the VPN host’s IP address when talking to remote systems. When this happens, the remote systems won’t know what the client’s actual IP address is. The big problem with that setup, however, is that the VPN host can be configured to decrypt the data in transit, then re-encrypt it to send to the remote network (AKA a man-in-the-middle). If the VPN is configured to show the actual client IP address to remote systems, it’s not possible for the VPN host itself to read data in the transmission. This is important to remember when you consider using a VPN service.

Are VPN Services Secure?

Now we get to the original question. Let me explain the “Kinda” answer to this question. There are definite security benefits to using a VPN to connect to the Internet. But understand that the purpose of a VPN is to let computers on separate networks talk to each other over the Internet. Any security benefits from using them are side effects of how VPNs are implemented, not the VPN itself.

Most VPN services use the Hybrid VPN model outlined above where a computer connects to a VPN host system, which then routes data to the remote network (In this case, the Internet is the remote network). This lets you protect your traffic to and from the Internet from being read by a different computer on your home network or any device between the client and the VPN host. When a VPN service says it will prevent others from viewing your data, the only “others” are computers on your network and your ISP (Internet Service Provider).

Now, if you don’t trust your ISP (We’re looking at you, Comcast), a VPN service will absolutely prevent them from reading any part of your network traffic. Since it’s possible for an ISP to develop a traffic pattern database that includes which websites you visit and when you visit them (which they can then sell to marketing companies), that may be very attractive to you. Just be aware that your ISP is not the only one who can develop traffic pattern databases. The company that manages DNS, the company that makes your web browser, the company that makes your computer’s Operating System, any application on your computer, and the company that you use for web searches can all do the same thing even if you have a VPN in place. That’s why I say it’s just a part of a good security setup.

Here’s the biggest issue with VPN services, though. The company that provides the VPN service can also keep track of where you go because they usually mask your IP address. When a VPN service advertises the ability to change where you are located to, for instance, watch Netflix shows that are available in England but not the US and vice versa, the VPN service itself is able to keep track of where you go because it is acting as a man-in-the-middle. If you are using a “free” VPN service, that service is most likely building a traffic pattern database to fund itself! Services that say they don’t log traffic data, this doesn’t usually happen, but regardless of whether they log data or not, If you use any VPN service, you are trusting their word that they aren’t keeping track of you. So you are basically deciding whether you trust your ISP or the VPN service more. That’s entirely up to you. But there are other things to consider.

When using a VPN service:

  • You can still get malware. Make sure you have good Anti-virus installed and keep it updated. If you use a VPN on a compromised computer, any traffic the malware sends will just get sent through the VPN.
  • Your web browser will still keep cookies and other browsing information (Even in “private” mode) unless you configure it not to. Browser developers can use that browsing data for marketing purposes. (Enable “Do not track” to prevent this…buuut you’re still trusting the browser developer that “do not track” is implemented correctly)
  • Your operating system (including Android and iOS) can still keep track of your browsing habits unless configured not to (All of the most common OSes are configured to do this by default. I’m not posting how to disable this as part of this article…maybe in another one)
  • The websites you visit can use tracking cookies to keep track of your use habits as well.
  • Websites you have an account with (Google, Amazon, etc) can keep track of what you search for with them (If you’re logged in to Google and do a Google search, that data gets tracked and a VPN won’t stop it.
  • The Gub’ment can still see what you’re doing with whatever back-doors they have demanded and gotten (and there’s no real way of knowing whether your government has done this…unless you live in certain highly populated nations in Asia *cough* China *cough*.)

So, in the end, be careful with who you trust your data with and know who has access to it, how they have access to it, and then implement whatever controls you feel you need to. Just understand that there is no single solution out there that will completely prevent someone else from getting some level of access to your internet traffic.

Leave a Reply