NordVPN rapped by ad watchdog over insecure public Wi-Fi claims

Re: Train WiFi was actually that bad for a while

Before now I have been sitting on a train whilst some bozo decides to hand out a whole range of personal information via telephone banking. I think they were opening an account or something. Spelling their surname, speaking their whole name, giving their address, setting up a security password, date of birth... I mean, utter lunacy. At least my bank ran me through some basic security checks before that - Are you in your own home? Is there anyone else present in the room? Are your windows open? Can you be overheard? Are you sure that the information you are about to give me over the phone cannot be heard by anyone else, known to you or unknown?

So really... Nord... I mean, VPN is a good idea, and I know that you're not wanting to bog your adverts down with technical stuff... but I'm connecting to YOUR VPN, and that's going to be over public WiFi possibly, and so the technologies that make THAT secure... how can I be any more sure that that's more secure than the technologies that my bank are using to encrypt and secure the connection with me? I'm still connecting, and VPN is really only a tunnel - it's only ONE straw out of a bunch of straws.

Re: Train WiFi was actually that bad for a while

Current train WiFi on LNER does something strange with HTTPS certificates - Google Photos always complains about this.

Re: And to think:

Given the ASA's other rulings, that would be likely resulted in Nord being told to stop until the government legislation comes into force.

I always double check the settings, before I join. If in any doubt, I'll pass.

The last couple of times I was in a hotel, I either got "email" speeds (sub 100Kbps) or no security at all. In the end, I just activated the hotspot on my phone and used that.

At the holiday home we rented, I logged on to the wifi, it was secured, did a quick IP scan and checked the certificates on some known sites, before deciding it was safe.

Most people won't be able to know whether the wifi access point they are connecting to is safe.

If in doubt, don't use it or use a VPN.

Exactly!

Their arguement that shared wifi (with a shared passcode handed out to everyone and his dog without wifi isolation (and even with it) IS insecure. But this has nothing to do with https and secure sites.

if I can connect to wifi, and then connect to another device on the same wifi, it doesn't matter if they're going to a https site or not, if they're running outdated windows/osx/whatever then I can get in.

Yeah, they're either talking about the site that you're ultimately connecting to, eg the bank, social media etc, in which case doing it over a VPN doesn't magically help you if the site is dodgy, or I guess they could be talking about the portal site for accessing the public wifi in the first place, but again a VPN still wouldn't help with that since you'd need to connect to the wifi before starting the VPN.

Would have loved to see the ASA respond simply by saying "That's nice, but what the hell has that to do with what we're discussing here right now?!?" :)

True. But NOTHING will make it 100% safe. Using a decent VPN does however reduce the risk by a few magnitudes.

Re: Public wifi

The problem with this is the definition of public wifi - while the more professional operators will have protections in-place to ensure

But do you know if you are connected to one of these more professional operators, or someone spoofing the same SSID and authentication mechanism?

Re: Public wifi

Any network that you don't control should be considered hostile. That said, a VPN is not a magic talisman that will make a hostile network safe.

I've come across public WiFi hot spots that have tried very hard to block VPN connections. One hotel chain I've stayed in seems to aggressively throttle VPN traffic; the data rate becomes almost unusably slow when connected, even though this VPN performs very well from other public and private networks. Disconnect from the VPN and speeds increase dramatically.

Perhaps there are legitimate, innocent reasons why an operator would attempt to block VPN connections or throttle them into oblivion to discourage their use. But since user traffic data is worth cash money, suspect that has more to do with it.

"organisations supposed to be protecting the public"

The ASA is the advertising industry's self-policing (stop laughing at the back) body. Who do you think their paymasters suppose them to be protecting.

Maybe I should clarify: an internet-connected computer is not inherently insecure (or secure).

Viruses are only one of a whole range of security threats. When I think WiFi (whether open or not), the first threat that comes to mind isn't viruses -- it's a MITM attack that allows others who are in the broadcast range of the hotspot to insert themselves into my datastream. Even a properly set up WiFi AP does not provide good enough protection against this sort of thing.

What really opened my eyes about this is when I did pentesting of my own network. I had a properly set up and encrypted WiFi AP, and was still able MITM any device connected to it without having to know the WPA2 credentials.

That's when I started using a VPN with all WiFi APs.

Re: In all fairness

> I do not use WiFi anywhere (including in my own home) without using a VPN.

The purpose of a VPN is to connect two separate private networks using only a public network in between, while preserving the private nature of traffic between them. Hence the "VP" in VPN. What most casual users today call a VPN is not doing this; instead, it's simply a tunnel connecting a host to the public Internet in a way that masks the point of origin as seen by remote peers. This is useful if you want to obscure the origin of your traffic but has no bearing on the privacy of its contents. It is equivalent to using a fake return address on your outgoing letters and dropping them in a random postbox in some town up the road a ways. The amount of effort required to observe the *contents* of your letter (or your packets) doesn't change; someone who possesses it can still steam open your envelope and read the letter, or view the contents of your packets as they traverse their networks.

If you're using a protocol that doesn't provide privacy and/or authentication, you're still vulnerable to interception and/or impersonation just as you are without the "VPN", because once it comes out of the endpoint and enters the public Internet it is going to traverse numerous other links that provide no particular security. Exactly as it would if you just sent it out over the local wifi network in the first place. So this is nothing but false security, which is exactly why NordVPN lost this case. If you are really concerned about interception, you need something (either a true VPN or a properly designed protocol such as TLS) that does end-to-end encryption. That will protect your traffic from interception and, if properly configured, impersonation regardless of the networks it traverses. If it's not end-to-end, it's not safe. Of course, as pointed out above, it still won't prevent the site you connect to from storing your data at rest insecurely or deliberately selling or giving it away. As it was before the Internet, the way to keep a secret is not to tell anyone.

Re: In all fairness

WPA3 isn't publicly released and security researchers have spanked the standards body's arse, pointing out some serious shortcomings in WPA3 on the first wave of hardware and sending them back to the drawingboard.

Re: They aren't completely wrong

Well... and how does using NordVPN make an issue like WiFi separation go away? You will need to hook up your machine to the public network to then access the VPN.