Why trust Google with your gmail? Why trust your doctor with your medical records? Why trust the IRS with your tax return? We live in a world of constant tradeoffs - I think the risk of a rogue player on the WiFi is greater than a reputable VPN company.
-
-
Replying to @KimZetter
I totally agree about the tradeoffs and what's a bigger risk probably depends both on the WiFi's location and on your VPN provider. But I think it's mostly irrelevant. Just about all our important network traffic is encrypted. I worry this gives people a false sense of security.
2 replies 0 retweets 1 like -
Replying to @martijn_grooten
How is it a false sense of security if it's actually securing their traffic? Or do you mean it risks getting people to trust an entity that might not be worthy of their trust? I'd say that risk already exists with the hotel WiFi.
1 reply 0 retweets 0 likes -
Replying to @KimZetter
1. there's a lot that VPNs typically don't protect against: malware, phishing, etc. That's obvious to you and me but not always clear to the average user. The article linked in the tweet you quoted somehow mentions data breaches as a reason for using VPNs.
2 replies 0 retweets 1 like -
Replying to @martijn_grooten @KimZetter
2. I think people have a limited willingness to do thing to make themselves more secure. By making them do one thing that barely makes a difference, they may not do the things that really do make a difference. Like using 2FA.
2 replies 0 retweets 1 like -
Replying to @martijn_grooten
Fair point. I do think that critical infrastructure engineers and sysadmins remoting into their control stations should be using 2-factor and a VPN.
2 replies 0 retweets 0 likes -
Replying to @KimZetter @martijn_grooten
What's the attack you're imagining that's mitigated with VPN?
6 replies 0 retweets 4 likes -
Replying to @taviso @martijn_grooten
Sniffing, MITM. I used to have to file news stories over unsecured hotel connections (because news organizations are the last to secure their communication channels and don't want to pay for mobile hotspot usage).
2 replies 0 retweets 2 likes -
If your traffic can be sniffed or MiTM'd in 2018, you've already lost. Things that count need HSTS, certificate pinning and sensible TLS implementations and in my experience, most do. Very little unencrypted or vulnerable traffic that matters.
1 reply 0 retweets 3 likes -
This was in 2013 and prior. There was no meaningful security for filing stories. Not even two-factor was being used.
1 reply 0 retweets 1 like
Sure, but in 2018 the vast majority of users can work entirely over TLS. When I'm travelling, I drop packets to anything other than 443/22/53, etc. I don't use a VPN.
-
-
Ok, fair point. I don't know what the state is for people where the infrastructure is owned/controlled by a repressive government but the vast majority of mainstream traffic these days is protected, as you point out.
1 reply 0 retweets 1 like -
FWIW, there are countries where for security and/or convenience reasons I'd recommend people use a VPN at all times, both at home and at Starbucks.
0 replies 0 retweets 0 likes
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.