Should you use VPN if the website uses HTTPS?

Some VPNs actually establish their connection via SSL. SSL really is a sort of VPN between you and the server, so as long as you don't mind people knowing that you are talking to that server and you don't mind the site knowing your IP, then you are fine to just access it directly.

If you want to avoid letting anyone know what system you are talking to or you want to have a VPN act as a proxy to protect your identity (from the site you are visiting) then you would still need a VPN.


A VPN would provide another layer of security. Someone local who is eaves dropping on your HTTPS session would be able to capture the metadata (e.g. what website you are going to). If you are tunneling through a VPN, they would not be able to obtain this metadata as the whole packet gets encapsulated, thus hiding the target website.

Going through a VPN would also protect against some local attacks on TLS / SSL, such as the recently disclosed BREACH attack on your HTTPS session: Reference: http://breachattack.com/ As well as other local attacks such as hijacking your initial SSL handshake negotiation, and replace your list of available ciphers with one that is weak, thus downgrading the security of the session.

For additional reading on this, I suggest checking out the following link http://en.wikipedia.org/wiki/Transport_Layer_Security#Security

Tags:

Vpn

Tls