No. They are an insecure transport, like most of the internet. The majority of high profile sites, services, and apps will now use TLS by default, but this is one of the few edge cases where a reputable VPN provider would help protect end users from poorly secured apps and services. I would trust the VPN folks vetted by Mozilla, but I am biased because I worked at Mozilla for years and have a great deal of trust for the folks there, or for the technical audience at HN I would recommend using one of the cloud service provider templates for standing up your own VPN server.

My understanding is a MITM attack can happen between your VPN provider and the service, just like it may work on the wifi point.

Without digging into too much detail, or providing a whack of data because I am not writing long form about this and I spent too much time writing comments on HN this morning :P, but my observation has been that the majority of unsecured apps have service endpoints that are deployed in cloud service provider environments, so if you have a VPN end point that terminates inside the same region, then it is highly unlikely that your traffic will hit the Internet before arriving at it's destination. That said, it's TCP/IP, so all it takes is a routing change and all of those assumptions go out the window...

Beyond that, MITM and traffic monitoring is happening all of the time in many network service providers, not all of it's nefarious -- alot of traffic analysis is just sampling to make sure that the network is working well and to understand whats happening. That said, there are many service providers and jurisdictions that opportunistically capture data or modify traffic in flight for purposes other than quality of service (e.g. ISPs injecting advertisements into HTTP traffic, surveillance, etc)

Using a VPN in this way doesn't protect you against those kinds of threats - the value in using a VPN here is about preventing local eavesdroppers from monitoring network metadata that can be used to classify your traffic and track you.

There are many examples, but one clear one is for marginalized people, such as folks from the LGBT community using specific apps (e.g. gay dating apps such Grindr or Growlr) that could out them to a monitoring service while in a jurisdiction or community hostile to them. Having that traffic tunneled safely to a "known safe" destination, e.g. an AWS or GCP instance in a safer region, would provide a measure of protection.

I had a discussion with a colleague about this about a year ago, but I think it would be very awesome to build an open source VPN service that leveraged AWS & GCP VPCs and inter region peering so that it would egress in the same cloud provider regions as destination IP blocks to prevent as much traffic as possible from flowing over the public internet, but I haven't had the time to put into it.

It's not a hard experiment to run, and "mainstream" has different meanings in different locations. Get a femto cell or other remote access point set up an open wireless network in a high traffic area, especially in a place where there is a transit hub, and hang out for several hours.

You could also grab the Alexa top 1 million or Cisco Umbrella top 1 million, and scan them for http endpoints, and work backward from there for sites that don't bounce you to a TLS endpoint.

Does mozilla have a list of "vetted" VPNs? I'm interested in seeing that list.

I disagree with the comment "go out of your way to fall victim to any MITM attack". If you're trusting employer provided or controlled equipment and haven't personally verified the certificate lists, they totally could MITM your connections without your knowledge if they've already added the exceptions. I know some employers do this, and I know network equipment vendor sales staff have used the ability to MITM employees as an explicit product feature and sales tactic including boasting about the ease with which they can procure faked certs for Google, Microsoft, et al, for this purpose.

So y'all and I don't see a risk, but a malicious actor sees a valid strategy.

There are risks, and fortunately they are reducing.

A VPN is still a good idea.

No, they are not. They will never be. They might be secure, but not completely. It is true that we are getting safer, but you should not stop thinking about the risks that will never go away.

Do you really need to check you email on a public wifi? If it's not necessary, then just don't do it. It's the small things. Sure you can take this into the extreme (which is never a bad thing in this case), but even if we don't, then we should not teach people that every public wifi is perfectly fine. Please remain thoughtful.

Likewise, your threat of being preyed upon on an open AP is dependent on what you're doing on that AP. Surfing HN? Who cares. But if I'm checking my bank account balance or touching sensitive info, I'm absolutely going to fire up a vpn first.

    > No, they are not. They will never be. They might be secure, but not completely...

But we take risks ALL THE TIME. In a primitive sense, risk assessment can be thought of as a product...

    risk = severity_of_outcome x probability_of_occurence

A lot of these things are unclear-- even for "experts" on HN.

In the absence of actual credible stories about the bad things that happen on public wifi, people will DISMISS the risk. Some may choose a more paranoid approach and never use public wifi, but I think that's just about as unreasonable as the opposite.

“You typo an address” — well, then, sure. But how did you manage to typo an address that’s exactly where the attacker put their stuff, and the bank didn’t catch them?

Now, if you meant “type”, then NO. Unless the browser includes a certificate authority that gave out a certificate to the attacker for that domain, the browser will flag this “valid” SSL cert.

Besides, it's not like we should ever trust a search engine as an authority on anything but the results that bring the host company more money.

It's undoubtedly less secure and it's upside is...what exactly?

You seem to be suggesting that if I intend to visit mywebsite.com, that typing "myw", seeing "mywebsite.com", and hitting enter is somehow less deliberate than typing "mywebsit.com" and going to a site that was not my intent.

Given that only the first one of these things reflects my intent, describing the second as deliberate and the first as not-deliberate requires some odd twisting of definitions.

Your fear, it seems to be, is that tools we use might influence how we act. This is nothing new. Stories started to rhyme less when we figured out how to write things instead of memorizing them. That was still probably undoubtedly an improvement. So can you perhaps clarify what specific influences that our tools have might be bad? For example, my browser suggesting "mywatertower.com" instead of "mywebsite.com" because the first paid for a higher position.

That seems a reasonable end state to fear, but I have no reason to believe we're heading that direction. Do you? Is inconveniencing (literally) billions of people and forcing them to take less secure paths to do what they want worth avoiding a possibility that certainly doesn't seem imminent?

Then again, when users stopped having to specify protocol for every server, that was probably the beginning of the end of deliberate browsing. My fear is really that people take the Web and the Internet as a whole for granted; and I want to see procedures put in place to demand that all users be aware of their actions, what data they share with servers, and all of what's being downloaded to their computer.

I don't like having to remind people that there is no "Cloud", only someone else's computer. And you're saying you trust that other person's machine and security more than your own by storing critical data there. Or pointing out what having one CDN for so much of the Web did last month.

Should you be unable to drive unless you can, IDK, build an automatic transmission? This point of view reduces, as far as I can tell, to the idea that good user interfaces should only be extended to those privileged with enough expertise to build them themselves.

This requires a level of literacy that most users will never be able to meet, by virtue of most people not having time to learn a programming language since they have other responsibilities.

It's also not clear why you aren't extending this backwards: why is it okay to use a browser I didn't write myself (or at least compile from source)? What about my OS? Do you really expect every user to have full knowledge of their entire system? That puts severe limits on the potential tooling we can use, and goes counter to one of the core ideas of software engineering: abstraction.

> And you're saying you trust that other person's machine and security more than your own by storing critical data there.

Yes, I trust security teams and engineers whose job is security and reliability more so than I trust myself, in much the same way that I'd trust a surgeon to do surgery better than myself. I realize that there's certification/training differences that may be relevant, but in general, the same ideas apply.