There's also #3, connecting to a network so you can access its internal
resources. For example, OpenVPN can be installed on the router in an office
or a server in AWS, and then employees working from home can access the
machines in that office's LAN or AWS virtual network.

However, this is not a scenario relevant to the particular patron
described! I agree with the other comments that a VPN isn't necessary for
the use case of just paying bills. It would be more helpful for her to
learn how to check that a connection is secure with a valid certificate,
and how to check domain names to make sure she hasn't landed on a scammer's
webpage from an email she thought was a bill from her bank.

-Tamara

On Fri, Oct 6, 2023 at 9:13 AM Cary Gordon <[log in to unmask]> wrote:

> In regard to the description of use #2, *When you want the server that
> you’re connecting from to not be able to trace where you really are, or
> specifically think that you’re somewhere else*, there are actually a couple
> of sub-uses.
>
> If you are in a hotel in Paris and want to appear to be in Omaha so that
> you can get to Netflix, then a good VPN service will likely work fine.
>
> If you are at home, presuming that you don't live on campus, and you want
> to appear to be on campus so that you can get to a campus-only resource,
> you will need a machine on campus that you can reach and tunnel to your
> resource. This is one of the OG models of VPN.
>
> A systems administrator, nobody I know, might be able to access the
> resources they manage from their workstation, so they might want to set up
> a VPN on that workstation and tunnel through it when they are on their
> yacht in Izbiza (some systems administrators do well) or in their neighbors
> hot tub.
>
> Cary
>
> On Fri, Oct 6, 2023 at 6:42 AM Joe Hourclé <[log in to unmask]> wrote:
>
> > >
> > > On Oct 5, 2023, at 9:19 PM, charles meyer <[log in to unmask]>
> > wrote:
> > >
> > > My esteemed listmates,
> > >
> > > Patron on living on modest Social Security alone is exploring if
> there’s
> > any free to low cost ($5-10 a month) VPN for her once a month electronic
> > payment of her bank credit card from her checking account using a free
> > library hotspot.
> >
> > (tl;dr: VPNs may not do what you think; video link at the end)
> >
> > I think that it’s important to talk about what exactly VPNs do:
> >
> > They take your traffic, and send it out through a different endpoint.
> > Between you and the VPN’s endpoint, there is an extra layer of
> encryption,
> > but there isn’t anything extra between the VPN and final destination
> (like
> > the bank).
> >
> > There are two main uses for VPNs:
> > 1. When you’re starting out on an untrusted network
> > 2. When you want the server that you’re connecting from to not be able to
> > trace where you really are, or specifically think that you’re somewhere
> > else.
> >
> > Some of the issues with #1 were because some of the early wireless
> > standards were pretty bad, and there were issues with devices
> automatically
> > to ‘known’ wireless networks based solely on their name (so if someone
> set
> > up a network named ‘xfinitywifi’, your device might connect to it if you
> > had ever used a network named ‘xfinitywifi’).  Then the network owner
> could
> > see all of your traffic.
> >
> > As most websites have converted over to use encrypted protocols, as have
> > many other services such as mail, this is less of a problem now, although
> > someone who controls the network can see what servers you’re connecting
> to
> > (at least the IP address, which might have multiple names associated with
> > it).  They shouldn’t be able to see what messages you’re actually sending
> > to that server, at least not in real time.
> >
> > (But that’s not to say that they couldn’t capture all of the packets
> > specifically going to an IP address of a bank, and then take the time to
> > decrypt those specific packets)
> >
> > #2 I was originally used for stuff like ‘everything now looks to the
> > servers that I connect to like I’m inside my company’s network’ and the
> > academic community used it a lot for when buying access to databases that
> > were restricted to the company’s IP range, so someone from home could
> > effectively ‘connect from work’.
> >
> > Today, people use it a lot for pretending to be coming from a different
> > country so they can watch streaming movies that aren’t available in their
> > area.
> >
> > …
> >
> > So, why do I mention this?
> >
> > The main thing is that some of the problems that VPNs ‘solved’ have now
> > been fixed with other mitigations (like encrypting most traffic
> end-to-end).
> >
> > You then get the question as to whom you trust more—- the network that
> > you’re currently attached to, or the VPN owner.  In some cases, networks
> > did crazy things (like some wireless and cable providers inserting extra
> > info to make it easier for websites to track people), but do we know
> enough
> > about these VPN operators to trust them?
> >
> > Could they be just sitting around watching for specific types of traffic
> > (connections to known banks or crypto exchanges), and then attempting to
> > decrypt it?  Obviously, if they did and it was known, they would lose all
> > credibility immediately… but what do they have to gain by doing it for
> free?
> >
> > TOR (the onion router) was specifically developed so that journalists and
> > people in repressed countries could communicate without being traced,
> and I
> > think it even switches endpoints so no one person can easily recombine
> all
> > of your packets… but there were concerns that if one group ran enough of
> > the servers, they might still be able to get enough packets to undo the
> > security.
> >
> > …
> >
> > So, unless your patron is trying to hide from the servers they’re
> > connecting to (which usually isn’t the case for banking), and their hope
> is
> > to just encrypt their local traffic, they might just be shifting their
> > risk, not actually mitigating it.
> >
> > They might just be trying to bypass some filtering on your network (my
> > local branch has blocked my ISP, so I can’t connect to their webmail
> server
> > to pull down files to print), and it will work for that
> >
> > … but much of the hype about VPNs doesn’t quite hold true any more.
> >
> > Even Tom Scott, who for many years received funding for his YouTube
> > channel from a VPN company created a video saying that the hype is
> > overblown:
> >
> > https://m.youtube.com/watch?v=WVDQEoe6ZWY
> >
> > -Joe
> >
>
>
> --
> Cary Gordon
> The Cherry Hill Company
> http://chillco.com
>


-- 

Tamara Marnell
Program Manager, Systems
Orbis Cascade Alliance (orbiscascade.org <https://www.orbiscascade.org/>)
Pronouns: she/her/hers