When I use a VPN, I very rarely imagine that the coffee shop / home internet that I’m hooked up to will have a malicious actor or compromised host physically inside it. I mean, maybe. But more likely is that I’m protecting against a malicious ISP, or effectively doing an extra level of authentication to my work network before I get access to non-world-visible elements of it (that shouldn’t be exposed to anyone in the world that wants to poke at it). The “someone else at the cafe is malicious” case isn’t un-heard of, but it’s not the most common threat model. That’s my point.
From the article:
When apps run on Linux there’s a setting that minimizes the effects, but even then TunnelVision can be used to exploit a side channel that can be used to de-anonymize destination traffic and perform targeted denial-of-service attacks.
“Deanonymize” and denial of service are very very different from hijacking the connection and rerouting destination traffic to a hostile device, which it sounds like are what’s possible on iOS and Windows.
I don’t really know the full details (e.g. what does it mean that “there’s a setting”, and is activating that setting starting this week any different in practice from applying the patch that will surely come this week for Windows and iOS). But it does sound fair to say that there’s a serious level of vulnerability that’s exclusive to Windows and iOS.
When I use a VPN, I very rarely imagine that the coffee shop / home internet that I’m hooked up to will have a malicious actor or compromised host physically inside it. I mean, maybe. But more likely is that I’m protecting against a malicious ISP, or effectively doing an extra level of authentication to my work network before I get access to non-world-visible elements of it (that shouldn’t be exposed to anyone in the world that wants to poke at it). The “someone else at the cafe is malicious” case isn’t un-heard of, but it’s not the most common threat model. That’s my point.
From the article:
“Deanonymize” and denial of service are very very different from hijacking the connection and rerouting destination traffic to a hostile device, which it sounds like are what’s possible on iOS and Windows.
I don’t really know the full details (e.g. what does it mean that “there’s a setting”, and is activating that setting starting this week any different in practice from applying the patch that will surely come this week for Windows and iOS). But it does sound fair to say that there’s a serious level of vulnerability that’s exclusive to Windows and iOS.