Using a VPN abroad when paying online?

The_stingemeister

Thinking of a bit of travelling next year, would be convenient to use WiFi out there to book online the next accommodation. Wouldn't contemplate public WiFi for entering credit card details. But would a VPN (or something similar) make it secure? I have Avast free a/virus, and see for $19.99 pa you can add a VPN. I imagine a decent and safe one will need to be paid for, which I'd be prepared to do. Maybe I'm paranoid but I wouldn't totally feel safe on a hotel's WiFi entering card details, either. I'm not interested in being able to view blocked foreign TV channels through it or anything like that (which it seems is a selling point). Also I'd be taking a smartphone and a tablet, whether that makes a difference?
Thanks.

NiftyDigits

If you are in just one or two countries, buy local data SIMs.I never depend on WiFi and happily so. Most of the time, it's a let-down. The mention of the countries in question would bring more relevant advice.

grumbler

The_stingemeister wrote: »

...Wouldn't contemplate public WiFi for entering credit card details. But would a VPN (or something similar) make it secure?

I am no expert, but I don't see how connecting to a VPN via a public WiFi can make it more secure.

The same if it's a local VPN connected to the internet via a public WiFi.

AndyPix

grumbler wrote: »

I am no expert, but I don't see how connecting to a VPN via a public WiFi can make it more secure.

The same if it's a local VPN connected to the internet via a public WiFi.

A VPN connection encrypts the data between your device and the server

andyfr_2

I use a VPN on all our devices for exactly the same reason.

abibee

You could try Zenmate, it's a free VPN browser plugin, that's for your PC.

On a smartphone or tablet, you can also try Zenmate on them, there's a data limit in the free version (500Mb if I recall). Another is Tunnelbear, also 500Mb in the free version. A third one is Ghostery, yet again 500Mb in the free version.

Those are Android, if you're an Iphone/Ipad user... I dunno. The above may have versions for them.

poppy10_2

Tunnelbear is very simple to use, and has enough free data allowance to use for online banking etc

alderpoint

AndyPix wrote: »

A VPN connection encrypts the data between your device and the server

Well, no, not really. A VPN may add an encryption layer, but most (free ones) don't as this costs CPU cycles and therefore money. As long as the end-to-end connection is encrypted, i.e. it is using https, then adding a VPN (even if encryted) does nothing for security.

wacko911

alderpoint wrote: »

Well, no, not really. A VPN may add an encryption layer, but most (free ones) don't as this costs CPU cycles and therefore money. As long as the end-to-end connection is encrypted, i.e. it is using https, then adding a VPN (even if encryted) does nothing for security.

I'm guessing you have never heard of 'Man in the middle' attacks. Quite simple really, there is even an android one click app that lets you do it from your phone...it's as simple as connect to free wifi, click MITM - specifiy a client or all clients, and watch the HTTPS usernames and passwords roll in. (From your private test network of course!)

Then there is browser session hijacking in the same app not to mention script injection and browser pwning.

Anyhow, yes an end to end VPN would be my recommendation. Not sure how much I would trust a free VPN. Again if I wanted to streal creds and I was a blackhat, I could just offer a free VPN and then sniff, inject, MITM all the traffic running though my free VPN.

buglawton

I thought that even with a MITM attack, the username and password would still be encrypted. The only way the https traffic can be decrypted is if the victims browser can be tricked into accepting a fake SSL certificate. With modern browsers and up to date software, doesn't the user have to manually accept such a certificate so has a chance to detect something's wrong?

poppy10_2

buglawton wrote: »

I thought that even with a MITM attack, the username and password would still be encrypted. The only way the https traffic can be decrypted is if the victims browser can be tricked into accepting a fake SSL certificate. With modern browsers and up to date software, doesn't the user have to manually accept such a certificate so has a chance to detect something's wrong?

All correct.