# Why Is a VPN Secure? **URL:** \ **Category:** Factual Questions\ **Created:** [February 14, 2020, 10:32pm UTC](https://boards.straightdope.com/t/why-is-a-vpn-secure/847958 "2020-02-14T22:32:06Z")\ **Posts on this page:** 8\ **Page:** 2
**Author:** ![Sage\_Rat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sage_rat/32/399_2.png) [@Sage\_Rat](https://boards.straightdope.com/u/Sage_Rat)\ **Post date:** [February 18, 2020, 9:08pm UTC](https://boards.straightdope.com/t/why-is-a-vpn-secure/847958/22 "2020-02-18T21:08:48Z")
As to the title question, and trying to answer that in a non-technical way: Imagine that the way you sent messages to people was to tell a young lad your message, send him out in the street, with him shouting the message on repeat loudly, for everyone to hear, until he finds some other lad who will take the message and continue on with it, doing the exact same thing. Eventually, after eight or ten shouting lads have retransmitted the message it will get to your recipient. You would probably like for your recipient to be able to reply to you. So we should note that one part of your message was your own name and address. So your message, overall, might have looked like: Sally Milligan of 123 4th Ave E in New York City would like to buy a personal massage device! And, again, this would have been transmitted through eight to ten shouting lads who are repeating the message continually over the length of the run. If part of your message is a secret password for how to get into your safe, then it’s pretty clear how none of this is a great and wonderful way to do things from a security standpoint. The internet was, fundamentally, designed by some bored college students and professors to be able to share programmer jokes across universities, not as a medium for secure transmission of financial information. They just went with something that was easy to make and had a lot of redundancy to ensure successful transmission. Now, nearly everything wrong with the Internet, in terms of security, is solved through the use of something called TLS. It’s what your browser uses to decide whether to show a little padlock next to the URL. We’re currently trying to get the internet 100% on TLS so that the padlock symbol becomes redundant. But there are two things that aren’t solved by TLS. 1. The lads still carry your address around, shouting it the whole way. 2. Similarly, they shout the address of the place that they’re sending the message to. So, if Sally is buying a personal massage device, that will remain secret. People will simply know that she’s exchanging messages with [Amazon.com](http://Amazon.com), but won’t be able to find out anything else. They can mug the lad and he’ll just have a document written in jibberish. If, on the other hand, Sally is exchanging messages with [personalMassageDevices.com](http://personalMassageDevices.com), however, then TLS might still largely blow some information. VPN, essentially, solves this last little bit of privacy violation. Sort of. Basically, you sign a deal with a secret network. You’ll send shouty lads to the secret network, and they’ll be shouting, “I’m from Sally, at 123 4th Ave E! I’m going to the shadowy secret organization who lives in yonder warehouse!” Everyone will know that, but if they mug the shouty lads, they’ll just find a piece of paper on him that’s written in jibberish. The shadowy organization has stealth submarines that can’t be traced that route messages arround to their various warehouses around the world. From the warehouses, shouty lads will emerge, saying “I’m from the secret organization! I’m going to [personalMassageDevices.com](http://personalMassageDevices.com)!” But there will be no mention of Sally nor where she lives. The shadow organization knows that information, but anyone not in the organization is out of luck. Some time later, Sally will get a jibberish letter that she knows how to decode from the secret network. Now if the secret network only connects to personal massage devices once per day and they only start doing that when Sally starts operating through them, they stop when she stops being a customer, and that only ever connect when Sally is actively interacting with them, then it may be possible to infer what she’s doing. But you’re basically relying on statistics, not definitive proof. And anything short of that scenario and you’re not going to have any idea what’s going on, by watching Sally and the secret network. That is, unless the secret network is corrupt, poorly managed, was a front for the people you wanted to avoid, or have been compromised. ---
**Author:** ![Atamasama](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/atamasama/32/12961_2.png) [@Atamasama](https://boards.straightdope.com/u/Atamasama)\ **Post date:** [February 18, 2020, 9:15pm UTC](https://boards.straightdope.com/t/why-is-a-vpn-secure/847958/23 "2020-02-18T21:15:41Z")
> [@BigT](#): > > They likely do. And they know by using a list of VPN IP addresses, which are compiled in various ways. The most obvious is just to use the VPN yourself and see which IPs it uses. > > That said, my experience is that most sites don’t block everything. There’s nothing bad about being anonymous and merely reading information. The problem is in logging in using a VPN. And, even then, they may be more concerned with creating new accounts via VPN, rather than someone just using a VPN. > > I honestly can’t think of a good reason to block read access to a site if you use a VPN, other than just lazily blocking everything to stop logins/sign ups. Wikipedia is an example. You can’t edit pages if they detect you have a VPN. From their perspective that’s the equivalent of walking into a bank with a ski mask and long trench coat on. Sure, maybe it’s cold outside and you are bundled up for the weather but you sure look like a robber. But you can still view pages as much as you want. ---
**Author:** ![Sage\_Rat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sage_rat/32/399_2.png) [@Sage\_Rat](https://boards.straightdope.com/u/Sage_Rat)\ **Post date:** [February 18, 2020, 9:43pm UTC](https://boards.straightdope.com/t/why-is-a-vpn-secure/847958/24 "2020-02-18T21:43:15Z")
> [@Great\_Antibob](#): > > No need to bring criminality into it. It’s difficult to envision a sane reason to use onion routing through multiple VPNs, unless you have a criminal intention. If you aren’t doing anything illegal, then that’s your protection against warrants, not onion routing, so a single VPN is sufficient. ---
**Author:** ![EdelweissPirate](https://avatars.discourse-cdn.com/v4/letter/e/8491ac/32.png) [@EdelweissPirate](https://boards.straightdope.com/u/EdelweissPirate)\ **Post date:** [February 18, 2020, 9:49pm UTC](https://boards.straightdope.com/t/why-is-a-vpn-secure/847958/25 "2020-02-18T21:49:07Z")
> [@Great\_Antibob](#): > > Several companies (mine included) require the use of a VPN to help protect company information and the information of our clients. Any company that doesn’t require a VPN for remote access to their internal network is grossly negligent. Heck, a company like that doesn’t even have an internal network—when the entire internet can access your network, the internet _is_ your network. I’ve never even heard of a company that did this—and I worked in network security at the turn of the century, when many companies were still coming up to to speed on network security. ETA: I’m not trying to come down hard on The Great Antibob for that…I just wanted to address what was probably an inadvertent implication that some companies have their internal networks completely exposed to the internet. ---
**Author:** ![Kevbo](https://avatars.discourse-cdn.com/v4/letter/k/e47774/32.png) [@Kevbo](https://boards.straightdope.com/u/Kevbo)\ **Post date:** [February 18, 2020, 10:07pm UTC](https://boards.straightdope.com/t/why-is-a-vpn-secure/847958/26 "2020-02-18T22:07:12Z")
> [@Great\_Antibob](#): > > No need to bring criminality into it. > > Several companies (mine included) require the use of a VPN to help protect company information and the information of our clients. In some cases, use of the VPN or something similar may actually be a legal _requirement_. HIPPA compliance for healthcare workers accessing patient data from remote sites is one case I am familiar with. ---
**Author:** ![echoreply](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/echoreply/32/3641_2.png) [@echoreply](https://boards.straightdope.com/u/echoreply)\ **Post date:** [February 18, 2020, 10:40pm UTC](https://boards.straightdope.com/t/why-is-a-vpn-secure/847958/27 "2020-02-18T22:40:49Z")
> [@Sage\_Rat](#): > > It’s difficult to envision a sane reason to use onion routing through multiple VPNs, unless you have a criminal intention. If you aren’t doing anything illegal, then that’s your protection against warrants, not onion routing, so a single VPN is sufficient. Now you’re getting into repressive regime territory, or other privacy sensitive areas. Onion routing is useful when it is undesirable to show any connection between two endpoints. There are both legitimate and illegitimate reasons for doing that. ---
**Author:** ![EdelweissPirate](https://avatars.discourse-cdn.com/v4/letter/e/8491ac/32.png) [@EdelweissPirate](https://boards.straightdope.com/u/EdelweissPirate)\ **Post date:** [February 19, 2020, 1:55am UTC](https://boards.straightdope.com/t/why-is-a-vpn-secure/847958/28 "2020-02-19T01:55:49Z")
> [@Kevbo](#): > > In some cases, use of the VPN or something similar may actually be a legal _requirement_. HIPPA compliance for healthcare workers accessing patient data from remote sites is one case I am familiar with. See my post immediately above yours. Any company that opened their network to the internet would leak confidential information all over the internet within a matter of hours. And opening your network to the internet is exactly what you’re doing if you allow remote workers to connect without an encrypted tunnel. I’ve never encountered a company that does this—not a single one. I’m not a compliance guy, but in general, regs like HIPAA and ITAR tend to specify the end result—no disclosures of confidential data—and allow those governed by the regulations to meet the requirements by whatever reasonable means they like. If HIPAA specified a particular kind of VPN or encryption algorithm and a big exploit came along (like Heartbleed) then health care IT would be obligated to use the specified-but-broken encryption, which is a situation no one wants. I’m generalizing a lot here, but the upshot is that the number of companies not using encrypted tunnels is infinitesimal. It’s not that some industries require VPNs; all industries use them, including ones not subject to the demanding regulations of HIPAA or similar laws. ---
**Author:** ![Sage\_Rat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sage_rat/32/399_2.png) [@Sage\_Rat](https://boards.straightdope.com/u/Sage_Rat)\ **Post date:** [February 19, 2020, 4:22am UTC](https://boards.straightdope.com/t/why-is-a-vpn-secure/847958/29 "2020-02-19T04:22:56Z")
> [@echoreply](#): > > Now you’re getting into repressive regime territory, or other privacy sensitive areas. Onion routing is useful when it is undesirable to show any connection between two endpoints. There are both legitimate and illegitimate reasons for doing that. Under a repressive regime, yes. I was talking more about Americans. Though, under a repressive regime, we’re still talking criminal activity, even if the criminal activity is things like “saving the lives of the repressed”. ¯\_(ツ)\_/¯ [Previous page](https://boards.straightdope.com/t/why-is-a-vpn-secure/847958.md?page=1)