Search Ask Leo!:

YouTube - Patron Perks - Books - Ask - About

Technology in terms you understand. Sign up for the Confident Computing newsletter for weekly solutions to make your life easier. Click here and get The Ask Leo! Guide to Staying Safe on the Internet — FREE Edition as my thank you for subscribing!

How Does a VPN Protect Me?

Hide from prying eyes.

by

VPN
(Image: canva.com)
A VPN, or Virtual Private Network, is a fully encrypted, private internet connection via a VPN provider. I'll look at what protection it offers.
The Best of Ask Leo!
So there’s a lot of talk about using a VPN to hide what we do from our ISPs, and you’ve mentioned using it when using open WiFi. So just how and what are the protections of this versus just connecting through my ISP? What limitations does this have? Can they “see” what I’m doing (like using a BitTorrent), and that it is coming from my account?

A VPN, or Virtual Private Network, is one approach to securely connect to a remote resource. Depending on the VPN, that privacy can extend from one end of the connection to the other, or it can protect you only for a certain portion.

I’ll describe the different scenarios, and how you are — and perhaps are not — protected by a VPN.

Become a Patron of Ask Leo! and go ad-free!

TL;DR:

VPNs encrypt and protect your connection throughout the entire path between your computer and the VPN provider’s server. Other forms of encrypted communication leave traces of your activity or don’t cover the entire distance. The WPA encryption used in Wi-Fi encrypts data only between your computer and the local access point. HTTPS connections encrypt data between your computer and the service to which you are connecting; your ISP can still see the service you’re connecting to. HTTPS over a VPN provides the most completely effective security.

No VPN at all

I’ll use this scenario as the base: you’re at an open WiFi hotspot, connecting to a remote resource like your email or your bank.

Open Wi-Fi Data Path
(Image: askleo.com)

All the connections are unencrypted. That includes:

  • The connection from your laptop to the wireless access point (aka hotspot).
  • The connection from the wireless access point to the ISP (Internet Service Provider) providing the internet connection.
  • The connection from that ISP to the rest of the internet.
  • The connection to the specific service you’re using.

The largest area of concern is the connection from your laptop to the WiFi access point. That open WiFi signal traveling through the air can be “sniffed” (or read) by anyone in range with a laptop and the required software.

Open Wi-Fi Vulnerability
(Image: askleo.com)

Lately, however, there’s been concern about the fact that your ISP can monitor what you’re doing. Specifically, they can see every remote site or service you connect to, and examine all unencrypted data you exchange with those servers.

WPA encryption

WPA Encrypted Wi-Fi Path
(Image: askleo.com)

The traditional approach to protect yourself from open WiFi sniffing is to use the WPA1 encryption built into WiFi.

This secures the path between your computer and the WiFi’s access point. Hopefully, it’s how your home WiFi is configured, so as to prevent nearby homes or others from connecting to your WiFi, and through it, to your network, without the appropriate encryption password.

There are problems with using WPA.

  • Most open hotspots at coffee shops, airports, and elsewhere don’t use encryption; the password requirement would confuse their customers more than it’s worth. That’s why these hotspots are called open.
  • When WPA is used, it protects only the connection between your computer and the WiFi access point. Everything past that point in the diagram above remains “in the clear”.

That last point is important, because all the traffic is visible to the hotspot’s owner, should he or she care to peek, and to the internet service provider to which that hotspot is connected.

A VPN service

To protect yourself further, a VPN is a common solution.

(Image: askleo.com)

A VPN securely encrypts the entire path from your computer to the VPN provider. No one along that path can see your data: not other WiFi users, not the people managing the hotspot, and not the hotspot’s ISP.

For open WiFi or other situations with questionable security (such as connecting to the internet at a hotel), a VPN can be a great solution.

But it’s not perfect.

Related

The most common way your information still leaks, even when using a VPN: How Does a Site Identify Me When I Am Using a VPN?

There are some things to note.

  • The connection is only secured up to the VPN’s servers; the connection from the VPN provider’s servers to the final destination is once again unencrypted. That means the VPN provider, as well as any other networking equipment along the rest of the way, may be able to see your data, and can at least see which servers you’re connecting to.
  • You’re adding steps between your computer and the server you’re accessing. The practical effect of this is that your connection becomes slower. How much slower varies based on the VPN service you use, their capacity, and the servers you attempt to access.
  • Not all VPN services support all protocols. For example, your web browsing might work, but your attempts to use BitTorrent might not.
  • Not all remote servers allow connections through VPNs. One non-security-related reason to use a VPN is that it can make you appear as if you’re located in another country. As a result, many services — such as streaming video services — block connections that use VPNs.
  • Not all governments allow VPN connections to services based in their countries, so as to effectively censor what their residents can view.

Using a VPN, the ISP you’re connecting through can’t see that you’re using BitTorrent (for example), but the VPN service can. Your ISP would still see that:

  • You’re using a VPN (and which VPN service you’re using).
  • You’re sending and receiving an awful lot of data.

End-to-end encryption

True privacy is achieved with end-to-end encryption. Unfortunately, that isn’t possible in many cases, since it must be supported by the service to which you are connecting.

HTTPS is end-to-end encryption

An https connection
(Image: askleo.com)

Connections you make via HTTPS are completely encrypted along the entire path from your machine to the remote server you’re accessing. That’s why banks (and other services that allow you to access sensitive data) should use HTTPS . Most web-based email providers also provide full HTTPS connectivity. In fact, more and more sites — including Ask Leo! — are switching to support HTTPS .

Similarly, when configuring a POP3, IMAP, or SMTP connection in your email program, if your email provider supports it, choose SSL or TLS. That’s the underlying encryption protocol used by secure connections like HTTPS. That way, your email uploads and downloads — as well as your log-in information — is completely encrypted along the entire path to your mail server.

Note, however, that even when using HTTPS, your ISP can still see which sites you connect to. Only a VPN can hide that information from them.

HTTPS over a VPN?

Just to complete the picture, if you’re using a VPN, and you connect to an HTTPS web site, your data is doubly encrypted for part of the trip.

Https on a VPN
(Image: askleo.com)
  • The VPN protects your data between your computer and the VPN service.
  • HTTPS protects your data between your computer and the service to which you’re connecting.

There’s really no practical harm. One benefit is that the VPN prevents your ISP from seeing which site you’re connecting to.

Related Questions

Does a VPN really protect you?

A VPN can protect you quite a bit, but there are no absolutes. A good VPN obscures everything you’re doing online and hides it from your ISP and any servers between you and the VPN service itself. By definition, it’s not protecting you from the VPN itself — and indeed some have been known to resell user data. Finally, it does not protect you from what happens between the VPN’s servers and the final sites and services to which you connect.

Will a VPN protect me from hackers?

A VPN protects you from some forms of hackers, but not others. A VPN only protects the connections you make with your computer to other services. Every other approach to hacking is unaffected, including data breaches, potential software vulnerabilities, and more. And a VPN cannot protect you from yourself: if you download malware, then the malware can do anything, including providing access to a hacker. Similarly, if you fall for a phishing attempt, your VPN will not help.

Does a VPN protect you on public WiFi?

Yes, a VPN is good protection when using public Wi-Fi. It conceals not only the data you’re exchanging with the sites and services you’re using — like log-in credentials or banking information — but it also conceals what sites and services you’re connecting to. The only thing someone monitoring your connection could see is that you’re using a VPN.

Can police track VPN?

It’s possible that police can track a VPN, but it would be extremely difficult and would require having used a low-quality VPN. A good VPN service will not respond to requests for information, and even if they do, they won’t have kept any logs of what was done when and by whom.

What are the disadvantages of using a VPN?

The main disadvantages of using a VPN include some reduction in speed and occasional blockages (meaning that a service, like a streaming service, may intentionally block connections from known VPNs). Particularly with free VPNs, you run the risk of logging and less-than-adequate security.

Is VPN safe for online banking?

VPNs are generally safe, and even recommended, for online banking, particularly if you don’t know the privacy and security of the internet connection you’re using. Banking over a good VPN while using an open Wi-Fi hotspot can, for example, be as safe as your dedicated internet connection at home.

Do this

Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.

I'll see you there!

Podcast audio

Play

Download (right-click, Save-As) (Duration: 7:20 — 7.9MB)

Subscribe: Apple Podcasts | RSS

Footnotes & references

1: Ideally, WPA2, but that’s a detail that doesn’t impact our conceptual discussion.

19 comments on “How Does a VPN Protect Me?”

  1. “That means that connections you make which use https are completely encrypted along the entire path from your machine to the remote server you’re accessing.” So is it safe to use a public wifi spot for internet banking?

    “Is it safe” is an absolute that I just can’t answer yes or no – there are too many variables. That being said, as long as I was using a trusted VPN provider and had all the appropriate additional security measures on my laptop (most notably a firewall) then I’d feel OK doing it myself.

    Leo
    04-Dec-2010

    Reply

  2. For the most part, yes. The data that is sent from your computer, through the hotspot and to the bank servers, and vice versa is secure. Beware however that someone else also connected to that hotspot is able to “see” you. It is possible for them to install software which allows them to see what you are typing. They could use that information to see your bank information.

    Reply

  3. Great article, with clear diagrams. I had previously thought VPN provided the same protection as HTTPS, but now realize the difference. Thanks!

    Reply

  4. Clarifying email security: What Leo said about SSL for email is true, but a bit misleading. This type of secure email is only secure between you and your email server(s). It is not end to end security.

    For example, when sending email with SMTPS it is only secure between you and your SMTP server. The transfer of your message to the POP/IMAP server of the recipient is not secure. The transfer of the email from the recipients POP/IMAP server to the recipient is also not secure (unless they use secure webmail).

    Reply

  5. To Michael Horowitz
 let’s say you use Hotmail with TLS for SMTP and send to a recipient that supports TLS (maybe another Hotmail user)
 we know you are on an encrypted port to the sever (different than truly encrypting the message btw,) but I believe you have a shot at the email making it ALL the way to the recipient “securely” if they support TLS. But I don’t know
 I don’t know if after the email reaches the server it doesn’t change from the encrypted port to 25 and then off to the recipient. I have written people about this (even web based email companies) but nobody ever answers


    I believe can answer that, given that I run my own mail servers. While there’s a *chance* that it’s encrypted, in general server-to-server email is not encrypted. At a minimum it’s only the connection that’s encrypted, meaning that when the email arrives at a mail server it is decrypted, stored on that server, and then if the next connection is encrypted the mail is only encrypted as it is sent. The email is always in its unencrypted form when stored on a mail server, even if only temporarily. (I’m explicitly talking about the encryption provided by the connection – if your message BODY is encrypted with something like mime or PGP, or you have a separately encrypted attachment then that remains throughout the transfer, and is in fact the only way to get end-to-end encryption guaranteed.)

    Leo
    08-Dec-2010

    Reply

  6. Thanks for your comment
 I was actually the one who posted the link below a few weeks back when you were talking about encryption
 I thought it might be misleading if it wasn’t revealed to the user/reader the “full” story regarding the difference between using an encrypted port (SSL/TLS) and encryption of the actual email (PGP, etc)


    http://luxsci.com/blog/the-case-for-email-security.html

    I only care about encryption over the network – that the email is protected during the sending process
 We know we can achieve that using SSL/TLS to the server – but from the server to the recipient is what is in question
 if they also have SSL/TLS enablement – I am hoping it is “encrypted” during the entire sending process – from server to server
 That is what I am trying to figure out


    Once again, thanks for taking the time


    “if they also have SSL/TLS enablement – I am hoping it is ‘encrypted’ during the entire sending process – from server to server” – it may NOT be. There may be intermediate mail servers through which the email is routed that may or may not use encrypted connections.

    Leo
    09-Dec-2010

    Reply

  7. Check out:
    https://www.eff.org/https-everywhere

    It provides a Firefox extension which aims to automatically use https encryption for every website that offers the functionality, but doesn’t turn it on by default (and there are a lot of webmail programs that do not).

    My own concerns were somewhat heightened a few weeks back when a different Firefox extension came out that was able to pick up any unencrypted login cookies from the network you were on – this includes both Hotmail and Facebook login information.

    That’s a very useful extention, and I do recommend it, but 
 it doesn’t live up to its name. It does not magically make https happen everywhere; it cannot. It only enables https access for those sites that actually support it. That’s an important distinction lost it it’s name. I wouldn’t want people to think they’re actually covered everywhere when they are not. (It also ONLY applies to web connections and not services like POP3/SMTP mail, or many others.)

    Leo
    09-Dec-2010

    Reply

  8. Maybe I should be more specific
 most credit card statements are done paperless now – if a thief or sniffer can get your username and password – see what credit card is being used – he/she could start pounding away and “guessing” the rest of the numbers and try to make fraudulent purchases. In the last 5 months I have had 2 credit cards taken by fraud even though I have never lost my wallet. This has led me to look further into email security like SSL/TLS.. doing what “I” can to ensure my incoming/outgoing is secure. Of course part of that is never using the first part of your email as a username and making sure your passwords are different. But even in doing ALL of this, hit twice in a year.

    Reply

    • I know I’m answering a 6 1/2 year old comment, so this is for the benefit of others. Although it is possible to sniff out credit card numbers, use of SSL (HTTPS) connections should in the extreme majority of cases protect the number from being sniffed. Credit card number theft is most often done in places where people take your credit card in their hands for processing. They can copy or memorize the number and security code on the back. I’ve had 2 fraudulent charges against my credit card. I believe one was from a restaurant and the other a gas station which used carbon paper receipts. After that, I scratched off the security codes and keep them encrypted on my computer.

      Reply

  10. I use Thunderbird to access my email accounts. I will be staying at a hotel with free wifi. Will my email account be vulnerable if I use it there? How can I find out if my Thunderbird installation is using encryption? Thanks!

    Reply

  11. A downside of VPN

    I was doing a Google search with the VPN enabled in Opera (while technically not a true VPN, but for this example the results are the same as with a real VPN, and I got the following warning along with a CAPTCHA:

    “Our systems have detected unusual traffic from your computer network. This page checks to see if it’s really you sending the requests, and not a robot. Why did this happen?”

    Websites can determine that they are being accessed by a VPN (usually because of a large number of visits from the same IP) or a VPN shows up as unusual activity from your account as it jumps from country to country, as in this example. This can be disconcerting for the casual user who simple wants to protect their privacy from their ISP or their location from the websites they visit. This isn’t to say, don’t usea a VPN, just be prepared that it’s not a simple plug and play that you install and don’t have to think about.

    Reply

    • In this annoyance (CAPTCHA test) also lays proof that we ARE VERY anonymous!!
      You see, VPN providers not only hide our real IPs and provide us with one of theirs, but through “shared IP technology” they share the masking IP amongst MANY of the customers at the same time. For example: if I use my VPN server in Atlanta Georgia, and it assigns me IP “123.222.333.444” that number is presumably unique to me.. but it is not. It gets assigned to multiple customers at the same time. So my first layer of security is that it will trace back to my VPN, and not me. And the 2nd layer of protection is if the VPN were forced to identify the user of 123.222.333.444, they would respond with: “here ya go, we had 50 clients using that IP simultaneously. We don’t know which one went where
”
      So when we 50 common IP users use Google 2 or 3 times each, that adds up to 150 queries. Google starts to suspect robotic activity from 123.222.333.444, so it throws a CAPTCHA at us. Part of the price of peace of mind!

      Reply

      • All of the VPN users may share an IP number which is visible to the websites they visit, but the the users connect to the VPN through their real IP number, so if they are forced to give up that IP number to authorities, they have it to give.

        Reply

Leave a reply:

Before commenting please:

  • Read the article.
  • Comment on the article.
  • No personal information.
  • No spam.

Comments violating those rules will be removed. Comments that don't add value will be removed, including off-topic or content-free comments, or comments that look even a little bit like spam. All comments containing links and certain keywords will be moderated before publication.

I want comments to be valuable for everyone, including those who come later and take the time to read.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Creative Commons License
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
Additional information is available at https://askleo.com/creative-commons-license/.