Secure Use of Passwords Over a VPN Connection

VPN services promise to protect your privacy, but do they protect your sensitive data? That’s a tough question because users connect to the internet to do a variety of things, from shopping and banking to accessing video content and chatting on social media. But beginning to use any service requires first signing up with a username and password, but can a VPN keep the process of creating or updating passwords secure?

Typing passwords without a VPN connection

Let’s take a simple example: you are sitting in a coffee shop using their Wi-Fi and you want to log into your online banking account, so the obvious question to ask is whether it is safe to do so with or without a VPN. Since banks use encrypted connections, the data you are entering should look like gibberish to the prying eyes of whoever might want to spy on you.

But if, for example, a hacker is also sitting in that cafe connected to the same Wi-Fi network and notices what site you are logging into for online banking, then they could well decide to steal your username and password via a man-in-the-middle attack, with which they would redirect you to a website that looks exactly like the banking site that you intend to connect to, but this time the site would be under their control. Without a VPN, the site you’d actually be logging into will be the hacker’s site and so you will essentially give away your login credentials.

Typing passwords while connected to a VPN service

By using a VPN service, both the coffee shop owner and the hacker can only see that you are connected but won’t see to which site, so man-in-the-middle attacks are not possible. The premise of a VPN connection is that VPN software runs on both sides of the connection – on your computer and on the private network that you are connecting to – and so you’ll be on the list of authorized users to successfully connect to that VPN network.

So now when sitting in that same coffee shop but this time using a VPN connection, your traffic is encrypted and no one else but the VPN service provider is able to see it. As such, the data is completely protected unless you have some sort of malware or key-logging software installed on your computer that is capturing everything you type on that keyboard. But keep in mind that, once connected, you are still on a private network, so it depends on the network’s policy as to which information is logged and captured and which is not.

At the end of the day, it comes down to trust: do you trust your VPN service provider? It will end up being the only network you can trust instead of whichever network you are connected to, and so it’s important to feel protected. Of course, it’s better to be safe than sorry if you want to avoid unpleasant surprises, and so take actions like using a password manager to generate cryptographically secure passwords and store them for you or activating two-factor authentication or 2FA for every service that supports it. By doing so, you’ll take the extra step of securing the online account.

Resetting passwords over VPN connection

By keeping in mind that the data traveling through a VPN connection is encrypted, it’s safe to assume that the information you enter into a password field will also be protected from prying eyes. This cannot be said about data in transit, however, so once again two-factor authentication comes into play when resetting passwords. Hackers can ask for a password reset, and without use of 2FA you likely won’t even notice the unauthorized access. Yet even if they are able to capture the data in transit – for example, if the site has very low security and sends the password in plain text – without additional access to this second authentication factor, they won’t be able to access your data.

So, a VPN service is of great help when connecting to unsecured networks. Anyone with the proper technical knowledge can eavesdrop on your traffic and steal sensitive data but that isn’t the full story, which is why it is recommended to use a VPN alongside activating 2FA. Your data is valuable, so keep it safe.