Does Unencrypted VPN Provide Protection?

[chinook9]

I am going to Europe at the end of this week and I decided at the last minute that using a VPN on the wireless networks over there could provide some protection in the event I need to do a financial transaction.

I am taking my Asus Transformer tablet and I have SecurityKISS working on it. SecurityKISS website indicates that due to a problem with the Android operating system I cannot have an encrypted connection.

Does the VPN provide protection with the encrypted connection? Also, is it beneficial to use an L2TP connection. SecurityKISS has a lot more servers for the L2TP connection.

Any information to help me understand where I stand from a security perspective with this VPN connection would be appreciated.



NOTE: I have Avast anti-virus on it and will use KeePass to protect my passwords.

[mirimir]

I doubt that an unencrypted VPN connection would do much good. What sort of VPN connection are you considering (that's unencrypted)? I don't know Android, but it seems odd that it can't handle encrypted VPNs. I vaguely recall reading that it doesn't do OpenVPN, but does do IPsec. Maybe you need to find a provider that uses IPsec.

[chinook9]

Originally Posted by mirimir

I doubt that an unencrypted VPN connection would do much good. What sort of VPN connection are you considering (that's unencrypted)? I don't know Android, but it seems odd that it can't handle encrypted VPNs. I vaguely recall reading that it doesn't do OpenVPN, but does do IPsec. Maybe you need to find a provider that uses IPsec.

The SecurityKISS website indicates that there is a bug in the Android operating system that prevents the encryption from working adequately. I am presently doing PPTP with encryption turned off.

SecurityKISS does do L2TP/IPsec but I haven't had any luck connecting.

I will continue to try L2TP/IPsec on SecurityKISS and look for other providers that I might also use.

Thanks for the information.

[Palancar]

An unencrypted connection wouldn't help you address your concerns. All that VPN (unencrypted) would do is provide their IP to your destination sites. Your transmitted packets inside of the cafe would still be open and quite an easy hijack.

Since you are talking about a bank (financial transaction) the connection to them is almost certainly https (SSL) so that would help alot.

Android can be connected to VPN with the proper tunneling. I don't have Android but lots of folks are using it safely.

Is your Android device rooted?

[chinook9]

Originally Posted by Palancar

An unencrypted connection wouldn't help you address your concerns. All that VPN (unencrypted) would do is provide their IP to your destination sites. Your transmitted packets inside of the cafe would still be open and quite an easy hijack.

Since you are talking about a bank (financial transaction) the connection to them is almost certainly https (SSL) so that would help alot.

Android can be connected to VPN with the proper tunneling. I don't have Android but lots of folks are using it safely.

Is your Android device rooted?

My Transformer is not rooted.

I have spent quite a bit of time researching the possibilities but still no luck in finding one that will work at a reasonable price. I hardly ever use the Transformer for browsing so I have to keep it pretty cheap.

I guess if I have to do financial transactions I may have to rely on the HTTPS, but I'll still keep looking.

[PaulyDefran]

Check out FEAT VPN in the Play store. One guy on the AirVPN forums tested it out and it seemed to work, *non-rooted*, for connecting to their OpenVPN servers. It's free for like an hour a day, or it's $4 for unlimited.

http://www.featvpn.com/

No affiliation.

PD

[chinook9]

Originally Posted by PaulyDefran

Check out FEAT VPN in the Play store. One guy on the AirVPN forums tested it out and it seemed to work, *non-rooted*, for connecting to their OpenVPN servers. It's free for like an hour a day, or it's $4 for unlimited.

http://www.featvpn.com/

No affiliation.

PD

Thank you for the recommendation. I will try it today.

EDIT: I checked it out for a few minutes but it did not show up when I searched the Play Store on my tablet. I searched the Play Store on my PC and it showed up.

I will continue to work on it but it also appears that FEAT VPN may require more knowledge of OpenVPN than I have.....which is none. We'll see, I do like a challenge, but we're leaving the country in a few days and I am really busy right now.

[PaulyDefran]

Make sure you read all the documentation on their site. I seem to recall slightly different 'steps' when using a tablet .vs a phone.

PD

[Victek123]

Originally Posted by PaulyDefran

Make sure you read all the documentation on their site. I seem to recall slightly different 'steps' when using a tablet .vs a phone.

PD

Is it correct that Feat VPN is not actually a VPN service, meaning they don't provide a server? It appears to be only a front-end for configuring OpenVPN to connect to someone else' service.

[chinook9]

I can't download FEAT VPN because its not compatible with ICS which I am running.

I'll keep on looking.

[PaulyDefran]

Originally Posted by Victek123

Is it correct that Feat VPN is not actually a VPN service, meaning they don't provide a server? It appears to be only a front-end for configuring OpenVPN to connect to someone else' service.

That is correct. Section 01 explains it. I also saw where 4.0 wasn't supported...sorry 'bout that.

FEAT VPN brings OpenVPN to Android versions before Android 4.0, no root required. It is the first layer-3 VPN app that works on any off-the-shelf device with an Android version between 2.1 and 3.2.

Android 4.0 and later break the underlying technology of FEAT VPN. Thus, unfortunately, FEAT VPN cannot be made to work on these Android versions. However, Android 4.0 is also the first release to offer official support for VPN apps. Somebody else will probably come up with a version of OpenVPN for Android 4.0+.

The Underlying Technology

You are probably aware of the built-in Android VPN client. On most devices it is accessible via Settings > Wireless & networks > VPN settings. Its supported VPN protocols are PPTP, L2TP, and L2TP/IPsec. Normally, you would use the built-in client to connect to, say, a remote L2TP server. The fundamental idea behind FEAT VPN is to not connect the built-in client to a remote server, but, instead, to connect it locally to the FEAT VPN app on the device. The FEAT VPN app then sits between the built-in L2TP client and the remote OpenVPN server and provides VPN protocol translation:

Outbound. FEAT VPN receives IP packets from the built-in client via an L2TP connection and forwards these IP packets to OpenVPN, which forwards them via an OpenVPN tunnel to a remote OpenVPN server.

Inbound. OpenVPN receives IP packets from the remote OpenVPN server via an OpenVPN tunnel and forwards these IP packets to FEAT VPN, which forwards them via an L2TP connection to the built-in client.

Note that the security of L2TP is not relevant here. The L2TP connection is established between two apps on the same device: the built-in L2TP client app and the FEAT VPN app. L2TP packets never traverse a network, because they never leave the device. Security issues of L2TP thus do not apply to FEAT VPN.

PD