Re:Tell HN: Your Android carrier can remotely turn settings on
by kevin_thibedeau on Monday December 12, 2022 @04:31PM
(#33960660)
They don't have to break TLS. They just use an exploit to get access to one of the unencrypted sides of the link.
VPNs cannot break TLS, (unless you're dealing with the intelligence apparatus of a major power, which probably can break TLS) so they cannot introspect most of the content you send and receive anyways.
What they can do, however, is see the domain name of the HTTP requests you send when setting up TLS.
Chaining VPNs doesn't add security by any metric.