VPN virtual private network?

murphydavid

I just came across the expression virtual private network and realised it relates to those detective films you sometimes see where the FBI cant trace an internet user because they are bouncing their communications round the world. As you can tell I'm not a techie kind of person. However I just came across some software that you can download that says once installed it will do it all for you the advantage being that sales companies will not be able to find or target you and they will also provide encryption and filtering out of bad stuff in incoming etc.
My purpose for posting is that I would like to know if there are any con's to this sort of software and generally how many people use it and how they find it.
I was tempted to post in the "what security do you use - sticky" as it is a security issue.
P.S. I did do a forum search and was surprised that I could not find anything. If there is a relevant thread could someone direct me there please.
Oh I refer initially to the software called "spotflux"
Thanks

closed

cons it's slower, you're handing over all your traffic to a 3rd party, and usually you have to pay for the service, if not now, possibly at some point. The free version comes at a cost, see the privacy statement, they allow 3rd party's to serve up the ads and give away your geographic location, exactly what you are trying to avoid.

you can filter out the tracking/malware with other means, opendns, virus scanner, script/ad/tracker/cookie blocking, the only advantage to a vpn in this context is that your ip address will appear to come from a different geographic location.

they can trace everything.

Nick_C

VPN technology is essentially a powerful level of encryption that allows confidential data to be sent safely via the internet.

Its commonly used by major companies to make their IT systems available to remote users, for example people working from home or at remote locations (off the corporate network).

Its also known as "tunneling".

I used VPN to access my last employer's IT systems, and could work from home just as fast as working in the office.

Be extremely cautious about any security software that you download. Check out the company and the T&Cs.

esuhl

The main cons that I can think of is that, although your traffic is encrypted in a VPN tunnel to the VPN provider... they can decrypt it and see all of your traffic (except for stuff that is encrypted between you and the website -- SSL sites, for example, that show as [URL]HTTPS://.[/URL].. in the address bar).

Spotflux appears to be a US company, so via the VPN, you would "appear" to be accessing the web from the Spotflux offices... so sites will recognise you as being from the US. That might mean that you can view YouTube videos (etc.) that are restricted in the UK, but of course you won't be able to see ones restricted in the US (unless you bypass the VPN).

Presumably, that will also mean that the US government could be monitoring everything you do... as Snowdon has revealed...

VPN is used for its secure tunnelling to another location -- so it's useful for businesses who want remote workers to connect securely to their private office network. But, if you don't know whether you can trust the people on the other end (i.e. Spotflux), you might as well use a proxy server. A proxy works similarly, but isn't (always) encrypted.

The TOR Project might be of interest to you. There's a clever multiple-stage process where your data is encrypted, transmitted to a proxy (which can't decrypt the transmission). That proxy encrypts the traffic again and passes it onto a third proxy, which can then unencrypt the last transmission. Although the last proxy (or "node" in TOR-speak) can see everything you've sent, it has no idea where that traffic has come from... Only the first node knows who you are (but can't see your data), and the last node can see your data but doesn't know who you are.

The only way you can be identified with your data is if each of the nodes you use is owned by the same organisation, who can then track the route back to you... Also a lot of browser add-ons, Flash, Java, etc. can "leak" your identity, so there is a "TOR bundle" which includes everything you need (including a "clean" add-on free version of Firefox). TOR is also open source, so you can be fairly confident that there's no malicious/nefarious code doing things you don't know about. You can get it here:

https://www.torproject.org/

murphydavid

Thank you esuhl.
Sorry to be a complete novice and a bit off my original subject. Just to check what you are saying in laymans terms. If I am away from home and log my laptop in at say a cafe that has free internet access and open firefox then send information on a form on a page that starts https (as does yahoo mail). Does the fact that it ends in an "s" mean that the information will be encrypted before it leaves my computer. ie no matter what I am logged on to it can't be read by anyone other than the intended recipient? Also if I use a VPN they wont be able to read it either.
Thanks

securityguy

Nick_C wrote: »

VPN technology is essentially a powerful level of encryption that allows confidential data to be sent safely via the internet.

Assuming you trust the company at government at the other end of the tunnel more than you trust your ISP and your government. Whether you weigh up those risks on the back of a fag packet or with a full HMG IS1 risk assessment, I don't see how you have enough facts to make the judgement.

I'm relatively confident that there's judicial oversight of interception on my Internet connection, and I don't think that the recent revelations about NSA/GCHQ monitoring are of relevance unless you're involved in serious terrorism. However, I'm not sure why I should be confident that a random "VPN Provider" in the US, who would be able to see and log all my traffic, is any more trustworthy.

I'm fairly untrusting of my government and my ISP. But it's a long way from there to assuming that they are inherently less trustworthy than some random company in a random jurisdiction.

Nick_C

I was describing VPN in general terms for a layperson. Its trusted enough to be used by many major companies.

RobTang

Nick_C wrote: »

I was describing VPN in general terms for a layperson. Its trusted enough to be used by many major companies.

Well strictly speaking its not a form of encryption either.

You can happily run a vpn connection without encryption.
Which is five if you say just want to watch iPlayer from aboard.

Most VPN software will use some sort of encryption in its transport, it doesn't mean that's what it is.

Its exactly what it say on the tin really, virtual private network.
It allows you to Virtually (connect) to a Private Network, without actually being (physically) connected to it.

What services that private network provides is really independent of VPN technology itself.

victor2

murphydavid wrote: »

Sorry to be a complete novice and a bit off my original subject. Just to check what you are saying in laymans terms. If I am away from home and log my laptop in at say a cafe that has free internet access and open firefox then send information on a form on a page that starts https (as does yahoo mail). Does the fact that it ends in an "s" mean that the information will be encrypted before it leaves my computer. ie no matter what I am logged on to it can't be read by anyone other than the intended recipient? Also if I use a VPN they wont be able to read it either.

https sites involve the information that is broadcast over the internet being encrypted. It doesn't mean that there isn't something on the computer you are using (as in an internet cafe) that is logging all your keystrokes. If I am going to be away and using internet cafes, I will change the passwords on any services I am have used when I'm back. Bit of a pain, but I usually try to change them before I go so that I can put my original password back when I return.

Nick_C

RobTang wrote: »

Well strictly speaking its not a form of encryption either.

You can happily run a vpn connection without encryption.
Which is five if you say just want to watch iPlayer from aboard.

Most VPN software will use some sort of encryption in its transport, it doesn't mean that's what it is.

Its exactly what it say on the tin really, virtual private network.
It allows you to Virtually (connect) to a Private Network, without actually being (physically) connected to it.

What services that private network provides is really independent of VPN technology itself.

Thanks for the lecture, but it's not necessary as I have done the MCP Networking courses. To repeat, I was describing VPN in general terms for a layperson.

S0litaire

That's why the VPN service I use is "iPreditor"*.
If you can't trust the guys who created "The Pirate Bay" who can you trust... ^_~ lol

*slight problem is that PayPal (really Visa and Mastercard payment providers) put iPreditor on a Black list so it's not easy to pay for the service at the moment ^_^