Security on public wifi

Sohan Ray a VPN doesn’t protect against anything from that. If you use https connections, keep your system and hardware up2date then everything is fine. Using a more secured DNS service like NextDNS or Quad9 „only“ increase your protection. Same for encrypted vs non-encrypted DNS. 
 

if you also don’t trust public wifi networks, just avoid it and use mobile network only. 

Sohan Ray Yes. For example direct IP connections exists.

If you own an iPhone you can verify app behavior with internal app privacy report.

Sohan Ray about VPNs, read https://madaidans-insecurities.github.io/vpns.html

Sohan Ray for the Surfshark deal, about 3 days before acquisition WeVPN asked them on Twitter if they had any involvement with Nord since NordVPN started following them on Tiwtter, they declined and 3 days later the merger was announced. There was also another lie about their email compromising checks in the same time period so in less than a week, there were two lies that they admitted to when it was proven / done.

So them merging isn't a lie but they lied about the merger and how their compromise check works, pretty sure it was something known and free that they claimed was their own technology.

For the login pages, any website you go through your browser, Chrome, Firefox etc shows when it's not encrypted and Chrome warns you with a page that you have to manually accept the risks and go to the website. So you'll know when the site isn't properly secured.

In terms of Public WiFis and if the site is compromised aka internal, there are two layers of protection one verifying the websites legitimacy and another setting that blocks internal IPs as far as I know. So you should be protected but I'd still use Mobile data for Banking and generally cortical sites / apps.

For the last two questions, apps wouldn't let you know if they are coded badly hut any proper banking app should make sure that they are secure but if they don't again NextDNS has two layers to protect you.

Overall, you should be protected for the most part, at worst you can also use your Mobile data for the important apps/sites.

Sohan Ray A VPN doesn't provide additional security ontop of your existing security provided by the program developers and general security measures by the browsers.

If the website was fake a VPN wouldn't help as it would be decrypted when it reaches the destination.

A VPN only helps if the WiFi point isn't using a password and there is someone intercepting the connection but even then, any critical app and websites use HTTPS/TLS so it's encrypted already.

The only time where it would help would be that you're using a none encrypted website on a WiFi that doesn't have a password. 

NextDNS does block internal IPs by its DNS Rebinding Protection for the most part and it uses DNSSEC to verify the legitimacy ontop of that.

Sohan Ray Yeah the solution that they were using to check their users email/password and generally if they are compromised was told to be their own and later on showed that it was something that was already available for free and nothing special.

For how they can't tell about the merger, they didn't have to lie and deny it. They could have given a vague answer or simply didn't answer at all, denying it shows ill intent in my opinion.

Overall, there are only a few VPNs I would trust but even then, I don't use any as the benefits really are marginal, if you're planning on using it to bypass firewalls and restrictions based on your country it's useful, but if you're going to use it for security the benefits aren't much.

To answer both your questions.

https://www.cloudflare.com/dns/dnssec/how-dnssec-works/

NextDNS would still block a fake HTTP site since DNSSEC is about the website you are looking for matching the domain that's returned, doesn't matter what sort of connection it is.

Secondly, if the website was using HTTP you would have encryption added by the VPN, but any known and critical website/app will use HTTPS. But if it wasn't used and you still connected to that website, and you were connected to a WiFi without a password with someone actively trying to snoop in, that would be the only case where a VPN would actually change the end result.

But even then, it wouldn't help you from connecting to a fake website, so the likelihood of it being useful would be about 1% or less.

The site wouldn't use HTTPS and wouldn't stop or warn you, most apps even have protection against apps inside your device that try to bypass HTTPS let alone allowing a none secure connection to be made. So a poorly coded app, or not caring about the warnings would be the only way to be in danger.

Sohan Ray I'd like to add that this is exactly why I don't like most VPN providers, they use scare tactics to make the user feel as they are not secured properly and that if they aren't paying the company they will be in danger. You would be paying just inacse of a 0.01% chance of everything going badly where the devs mess up, the connection isn't encrypted, the WiFi isn't protected and you can't use your mobile data.

Even then, you always have a choice of simy not going onto the cortical website if all of these situations are met.

I'd like to say again, it's useful to bypass restrictions and firewalls but in terms of pure security, unless your govemrent is using DPI and other techniques to intercept your connection, it won't help.

Sohan Ray if the website is a fake / an internal website spoofing as your bank for example, it wouldn't help in any way.

If your actual bank or critical all was using HTTP to connect to its own servers on a none protected WiFi (without a password) with someone snooping the connection it would help. But again, the website / app devs would have to be crazy to let that happen in the first place.

So if the snooper made their own fake/forged wsbsite they would see your details yeah. Even if you had a VPN.

Sohan Ray So to put all of what I said in a single sentence, it wouldn't help much if at all, but if you still want it for other reasons where it's valid, I'd say get a good VPN service that you can actually rely with your private data.

Sohan Ray That I can't comment on, pretty sure there is at least a few more types of connections but I don't know enough to comment concretely.

Sohan Ray smtp, ftp, telnet, icmp, snmp, just a few off the top of my head, there are likely several others