2

I use public Wifi constantly when I'm away from home/office. I'm contemplating setting up a home VPN, which my ipod touch and laptop could communicate with via VPN to protect my requests from prying eyes, whether it is through the owner of the public wifi or some script kiddie running firesheep.

Being somewhat ignorant of VPNs, Im wondering if they by default route all requests through the VPN?

I.e., If I connect to public wifi, connect to vpn, and visit a site in the browser, would I expect my request to be routed through the VPN tunnel, and then my home network makes the request and returns the result? Or does HTTP traffic go through the public Wifi, and only POP etc are secure?

Any recommendations for good/easy home VPN?

Thanks!

Improve this question
1
  • BTW, I did google around, but nothing I read about vpn+firesheep sounded authoritative enough to be trust worthy
    – Justin
    Feb 6, 2011 at 0:02

3 Answers 3

Reset to default
7

You can setup a VPN client to forward all traffic over the VPN. This is the default in some VPN clients.

Like @David, I'd recommend OpenVPN. Many low cost routers capable of running OpenWRT (or other flavors of embedded Linux like DD-WRT) can act as OpenVPN endpoints.

For your iPod Touch you'll be stuck jailbreaking to use OpenVPN, though. PPTP, L2PT, or IPSEC are your only choices there "out of the box". I believe that DD-WRT ships with a PPTP server, so that might be a good option, too.

"Firesheep" was about intercepting credentials on wifi networks. Encrypting your traffic when it's traversing an unsecure wifi network will help with that attack.

The fundamental problem, though, being credentials passed "in the clear" (or cookies standing-in-place of credentials) over the network isn't solved by a VPN. You're just pushing the unencrypted traffic to a path between the VPN server and the remote web site.

The unencrypted wifi network may be one of the easiest places to sniff traffic, so using a VPN isn't a completely worthless measure. It's not the only place where traffic can be sniffed, though.

The Real AnswerTM is to run all the traffic between the client and the web server over HTTPS. You can't control that, though. That's going to be up to website operators to wake up and do the right thing.

Improve this answer
3
  • wait, isn't VPN traffic encrypted? So therefore http cookies are no longer passed "in the clear", they are encrypted over the VPN along with all other network traffic that travels across the VPN.
    – Jeff Atwood
    Feb 7, 2011 at 9:57
  • @Jeff: Assuming the VPN isn't terminating at the remote web server (which, per the OP's question isn't the case) there is still a "leg" of the client-to-server communication that is unencrypted. Using a VPN to access HTTP just means you've pushed the unencrypted portion of the conversation to between the VPN gateway and the remote web server. That will make your client computer's VPN traffic immune to snooping and spoofing, but once the traffic is decapsulated by the VPN device and put back on the network "in the clear" there the traffic is, again, vulnerable-- just to different attackers.
    – Evan Anderson
    Feb 7, 2011 at 13:32
  • In the context of preventing snooping on the end Wifi network a VPN does a fine job. I just don't want people to get the idea that it somehow makes the traffic encrypted all the way to the remote web server, because that most certainly isn't the case. There can be evil anywhere along the path from your VPN gateway to the remote web server, too. End-to-end encryption is The Real Answer (and, unfortunately, HTTPS is the only practical protocol, which means application-layer changes, since IPSEC over the 'IPv4 net with the proliferation of NAT is a joke).
    – Evan Anderson
    Feb 7, 2011 at 13:37
1

VPNs encrypt EVERYTHING, if properly implemented. I highly recommend OpenVPN -- it goes over NAT routers well and encrypts everything using standard OpenSSL encryption.

Improve this answer
1

There are cheap VPN Services that probably provide a server in your country.

Like everyone else use OpenVPN and this will protect against firesheep as it cannot read the encrypted information.

places like vpnsecure.me

Will work like a charm.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .