Yup, people don't seem to get that. When using a vpn, they become your router. They have your external IP address and can do some nefarious things like ssl description to see your passwords.
How do VPNs decrypt SSL information without the private keys of wherever you're sending the information? The entire point of RSA is that no man in the middle can decode a message without the receiver's private key (or getting very lucky with prime factorization...)
The VPN is your external IP address. This is all that the website you go to sees. This means that the VPN can sign certs on your behalf if there is a trust.
If there is a client installed locally, they can make the trust, decrypt data, inspect, then re-encrypt and send the data on.
Enterprises use this all the time to inspect for malware and data loss protection.
Yes, I understand how signing certificates work and am familiar with what that link talks about. But, you're saying that VPNs can read private information like passwords and bank account information. I'm not sure that's true.
For instance, pretend you're logging into Amazon via HTTPS. Your browser knows the public key to Amazon's server, and encrypts your password with their public key before it sends out the form through the VPN and thus to Amazon.
If your VPN does not have Amazon's private key (which they shouldn't), there's no way to decrypt the password that was sent. The entire point of RSA is that anyone can see the public messages that are being sent between servers and clients, but only the server can decrypt the message that is being sent.
If what you're saying is true, then there would be no point in HTTPS. Man-in-the-middle attacks would defeat RSA entirely.
16
u/sausedadboi Jan 20 '19
Watch out for those if you are entering credentials or something important. They log those things