When you are connecting to VPN-Server couldn’t the government act as a man in the middle between you and the VPN server and see the traffic between you and it with Deep Packet Inspection? Like what sites you are on and what data you are transmitting. If not, why not?
No, because the protocol prevent MITM by having the public key of the server already available before connecting, anyone trying to MITM won’t have the private key for the server and thus can’t decrypt the traffic nor send a valid packets.
The government can’t MITM because of public key cryptography. Basically, your computer has the public key of the server it wants to trust, while the server has the private key. The data sent through the VPN tunnel is encrypted so that only someone with the corresponding private key can decrypt it.
Deep packet inspection refers more to analysis of protocol features of encrypted tunnels to identify what type of information they are carrying. So the government could use DPI to identify that you are using a VPN, but they cannot see your traffic.
From what I understand. If you have a large enough population and can see most of the picture like some large companies can let alone the U.S. Government. You can track it all and there is no real privacy. But its only to the few entities that have access to the traffic data. I wish I could remember the podcast or post with all the technical details I heard the argument in. I think I found it about someone discussing TOR limitations.
The idea is you can see incoming and outgoing traffic to servers, and with enough data you basically can decode what income request is related to what outgoing send.
Not through Deep Packet Inspection. They’re not breaking encryption yet. If the VPN is not set up properly there can be a DNS leak. There could also be browser leaks, they could implant spyware into routers and your computer. Considering how much control of everything these governments have, retaining privacy would become non-trivial, and that would mean the vast majority of users of VPNs would be vulnerable.
If someone can inject explosives into a the supply chain of a highly paranoid terrorist organisation, with years of setup and planning, then a motivated government could inject spyware into regular users communications.
You should just assume they can.
ISP will know you are trying to connect to VPN. You can use new stealth proxy protocols like vless + grpc + tls or v2ray, xray, etc; in this way, the ISP won’t even know you are using a VPN, and the connection will look like normal https traffic. And it’s quite secured.
Understanding VPN vs. Stealth Protocols
- VPN (Virtual Private Network):
- A VPN encrypts your internet connection and routes it through a secure server, hiding your IP address and making your activity private.
- Pros: It’s widely used and supported by most devices, and it’s good for general privacy and bypassing geo-restrictions.
- Cons: VPN traffic can often be detected by firewalls because it has a distinct pattern, and some countries or networks block VPNs outright.
- Stealth Protocols (VLESS, V2Ray, TrojanGFW, XRay):
- These are more sophisticated protocols designed to hide the fact that you’re using a VPN or proxy. They aim to avoid detection by firewalls and deep packet inspection (DPI).
- Pros: They are more difficult for firewalls to block because they look like normal web traffic (especially with gRPC, TLS, etc.). This stealth characteristic is useful in restrictive environments.
- Cons: Not much English knowledge to setup, but you can search on youtube for tutorials.
And why would you think the guv is looking at your internet traffic? Doing something really really bad?
Eventually, yes but not through DPI. Once quantum computing advances they can use Shore’s Algorithm to defeat public key cryptography. If they store all VPN communication en masse they could retroactively decrypt it.
I have no idea because I’m honestly ignorant about it and I don’t think my chemo brain would understand anymore. I was getting more curious about things like this though when users of TOR were being unmasked by police.
I’ve also read articles about the NSA putting folks on lists if they’re known for using anything for privacy online.
Where the truth is…
Does the public key change with every connection? Because why wouldn’t MITM be able to make a list with VPN-Servers and receive their certificates when making VPN connections on own beforehand?
ISP could still see someone is trying to make a connection to a VPN server at least and see the protocol being jused right?
Agreed, the government has sponsored the production of backdoored encryption in the past for just this reason.
Hey now, we don’t need to deep think their motives, respect the hypothetical.
This is the opposite on how you should be thinking when it comes to privacy & security. The “what if” is enough.
They can’t MTM (unless you’re really bad at your key/config distribution) but they can easily detect and block most VPN protocols using DPI. For example Egypt currently blocks VPNs this way.
In these cases you can sometimes bypass those blocks using more obfuscated protocols (like shadowsocks), but for the great firewall of China, it takes more obscure methods.
Only the server hold the private key, without it there’s no way to decrypt nor spoof. As a wildly simplified example, a public key is like a padlock for senders while the actual key, private key, never leave the recipient.
Initial connection can be inspected and as per example inspected in dictatorships (active probing), but SSL traffic - kinda, they couldn’t get what you send (trust me, it is pure math problem), but they can see some abstract patterns of traffic, imagine it as looking at human shadow. You can’t tell who dropping the shadow, but you can tell it is human to some extent. Same with packets, they can’t tell the content but can tell it is HTTP to some extent. There is ways to obscure those vision, for example using xray-reality, it mimics traffic to some extent, it’s like wearing parrot costume for shadow example.
- Security through obscurity is not really security.
- You must assume the worst-case not “lol hysterical”
- OP said “theoretically” and I gave them a theoretically valid response not a pragmatic one.
I realize a lot of folks simply make up stories in their own minds but the TOR thing did make me think twice. I now see however that there are several new articles that explain a bit more about it.
Appreciate your reply.
Down my rabbit hole 