Is it safe to register on an HTTP webpage when I am using VPN?

Your company VPN will NOT encrypt data from your computer to the website you want to register yourself, only the data from your computer to your company's VPN-server.

HTTPS (if used correctly) makes sure data from your machine to the website is safe and that you are not the victim of a man-in-the-middle attack.

So. Is it safe? "Maybe" (but has nothing to do with your VPN), you could always get your account / password information stolen on the way from your VPN-server to the website.


I guess you're worried about the details you enter onto the page being sent unencrypted.

The company VPN will secure the connection between you and the VPN server. The VPN server will still have to open an unencrypted connection between itself and the HTTP page/server, instead of your computer opening the connection itself.

Maybe it's ever so slightly safer, since a corporate Internet connection is secured better than a consumer one, but your information is still bring sent unencrypted and is still subject to man-in-the-middle'ing.


Seeing as my comments on other answers are getting pretty long I figured I'd separate it out:

It is impossible to answer if a corporate VPN connection offers equivalent security compared to SSL to a web server without knowing the exact specifics of the connection in question, which the OP hasn't specified.

However as a general reference there are two main scenarios to look at:

1) IF a user is using a VPN connection to a corporate network in order to connect to unencrypted public websites outside the corporate network, then the security offered is equivalent to directly accessing the same unencrypted website from the corporate network.

It will prevent interception of communications between your device and your corporate network but will not protect against interception between your corporate network and the public webserver. How secure it is depends on how much you trust your corporate network's connection to the public webserver.

In any case it will be less secure than a properly configured HTTPS connection direct to the public webserver from your client device.

However this mechanism will protect against eavesdropping on your local connection if for example you are using an unencrypted public hotspot or other untrusted ISP.

2) IF a user is using a VPN connection to a corporate network in order to connect to unencrypted resources on the corporate network behind the VPN server, or on the VPN server itself, then it is protecting the connection all the way to the target network itself.

This offers protection is roughly equivalent to HTTPS to the webserver in question.

ysdx's answer illustrates the first point well, except it misses out everything after the HTTP server.

A fully encrypted HTTPS connection to a webserver does not guarantee a completely secure to the source of the web page any more than a corporate VPN would in scenario 2.

HTTPS provides a security guarantee between two TCP endpoints. VPN provides a security guarantee between two TCP endpoints. In both cases, the endpoints are your PC, and a server at the edge of the other server's corporate/internal network. What happens after that edge is NOT secured by either method.

Many people forget that the HTTPS webserver you connect to during an HTTPS session is, in the case of many large websites, NOT the server the web page you are viewing comes from. The many reasons this happens include:

1) Load balancers, which will often have unencrypted network connection via a corporate LAN to various content servers that actually serve the content on the webpage.

2) Reverse proxies, NATs, and so forth that forward your connection - again, unencrypted, to arbitrary servers on the corporate LAN or even other public websites.

3) Caching servers or DDoS protection services such as CloudFlare, some of which operate on the public internet but forward your connection to a different company's server to actually serve the content - usually via a second encrypted connection or VPN.

4) Databases or NAS/SAN backends, where the web server uses an unencrypted connection to another server over the corporate LNA to retrieve the content for the website.

In all of these cases, the security of your web session relies on the security of the corporate LAN behind the HTTPS "gateway", in exactly the same way connecting to a corporate server behind a corporate VPN does.

Tags:

Http

Https

Vpn