Security – Does VPN secure web traffic? Or: will a home VPN prevent Firesheep attacks

Securityvpn

I use public Wifi constantly when I'm away from home/office. I'm contemplating setting up a home VPN, which my ipod touch and laptop could communicate with via VPN to protect my requests from prying eyes, whether it is through the owner of the public wifi or some script kiddie running firesheep.

Being somewhat ignorant of VPNs, Im wondering if they by default route all requests through the VPN?

I.e., If I connect to public wifi, connect to vpn, and visit a site in the browser, would I expect my request to be routed through the VPN tunnel, and then my home network makes the request and returns the result? Or does HTTP traffic go through the public Wifi, and only POP etc are secure?

Any recommendations for good/easy home VPN?

Thanks!

Best Answer

You can setup a VPN client to forward all traffic over the VPN. This is the default in some VPN clients.

Like @David, I'd recommend OpenVPN. Many low cost routers capable of running OpenWRT (or other flavors of embedded Linux like DD-WRT) can act as OpenVPN endpoints.

For your iPod Touch you'll be stuck jailbreaking to use OpenVPN, though. PPTP, L2PT, or IPSEC are your only choices there "out of the box". I believe that DD-WRT ships with a PPTP server, so that might be a good option, too.

"Firesheep" was about intercepting credentials on wifi networks. Encrypting your traffic when it's traversing an unsecure wifi network will help with that attack.

The fundamental problem, though, being credentials passed "in the clear" (or cookies standing-in-place of credentials) over the network isn't solved by a VPN. You're just pushing the unencrypted traffic to a path between the VPN server and the remote web site.

The unencrypted wifi network may be one of the easiest places to sniff traffic, so using a VPN isn't a completely worthless measure. It's not the only place where traffic can be sniffed, though.

The Real AnswerTM is to run all the traffic between the client and the web server over HTTPS. You can't control that, though. That's going to be up to website operators to wake up and do the right thing.

Related Topic