Does a VPN used on a smartphone with Wi-Fi disabled (mobile data only enabled) provide any sort of protection?
I've never completely understood this, but I think the answer would probably be "no," although I'm not sure. Usually when I leave the house I turn off wifi and just use mobile data (this is a habit from my pre-VPN days), although I guess I should probably just keep it on since using strange Wi-Fi with a VPN is ok (unless someone at Starbucks is using the evil twin router trick . . . ?). I was generally under the impression that mobile data is harder to interfere with than Wi-Fi, but I could well be wrong and my notions out of date. So, if need be, please set me straight. 🙂
Commercial VPNs as a security measure are pretty much a scam, at least in the way they are marketed.
These days, basically any web traffic is encrypted through HTTPS. Even on an untrusted network, nobody will be able to see the actual content (passwords, personal data) of what you're doing. DNS spoofing isn't viable either as any fake site they would send you to would lack the right certificates to establish a convincing HTTPS connection. So all someone can see is what servers you're connecting to, either by logging your DNS requests (can be prevented by using some form of encrypted DNS like DNS over HTTPS) or the IP addresses you connect to. And honestly, how much value does one get out of knowing that there's someone on their network who browses beehaw.org, supergreatbank.com and bigtiddygothgfs.to with no information to connect that to an actual person?
Unless you routinely use shady open Wi-Fi networks - and I'm talking about something that may have been setup on purpose by a malicious actor, not your local supermarket - to do security-critical stuff, you don't need a VPN. Also, if you trust your mobile data provider less than a company that tricks people into thinking you absolutely need their product to secure your data, you should get a different mobile data provider.
Now, there are use cases for VPNs but those are more along the lines of accessing stuff that's not available in whatever region you're currently in.
Edit: there is of course also the use case of hiding illegal stuff. In that case, I will not give any advice. Put some onions on top of your router or something, that's probably cheaper and more reliable.
Edit 2: just to make this entirely clear, I'm talking about commercial VPNs like NordVPN, Surfshark and whoever else pays YouTubers to advertise for them. If you host your own VPN, some of the downsides may not be as relevant. Though I would assume that anyone who even considers hosting their own VPN has enough technical knowledge about how networking works to know about the pros and cons.
Do you want a random third party looking at all of your mail before you pick it up? Even if they can't open the envelope, having somebody else write down every message that comes in who it's from and who it's too and how frequent it is, that creep me out.
If you're uncomfortable with a third party looking at your mail, it's very reasonable to not one third party's looking at your internet traffic. It's the same thing.
HTTPS, sure. But your ISP can and will create a pretty comprehensive social graph about you using only metadata (server IPs or hostnames). Where I live, all home networks basically have a static IP. Also, besides a commercial incentive, ISPs are also mandated to log your connections. VPNs are not.
Usually when I leave the house I turn off wifi and just use mobile data
I would stronly recommend that you set your wifi to only join trusted networks. That way you can also just leave the wifi on and not have it connect to every random network it encounters.
I would still recommend turning wifi off when leaving home for privacy reasons (which can easily be automated). The process to identify if a network is trusted or not requires a handshake. So leaving wifi on makes you trackable by the wifi network operators and the apps on your phone with access to your wifi, wether you connect a network or not.
I run my own wireguard VPN at home and connect to it from my phone when I'm traveling.
Grants me privacy (but not anonymity) from my mobile carrier. Sure, my home ISP still sees my VPN's traffic, but that's still one less company able to monitor my web traffic when I'm mobile.
Well facebook VPN waa sniffing data to see what other Social media the person was using. But something like Proton that prides itself on privacy and encryption should be fine
Your provider will just see encrypted traffic (mostly) anyway, so no it will not provide protection. The only thing that you're now hiding from your provider is which servers you're connecting to. Instead you're showing that info to a VPN company whose main business practice is scaring people into buying a product they probably don't need. Think about who you would trust more.
The provider and national TLAs will see all traffic that is in cleartext and meta traffic which is even more valuable. It can also actively tamper with that traffic. So you're technically incorrect and you assume your threat model is universal. It's not. And, of course, there are use cases for Tor, whether with or without VPN.
Your replies all make a very big assumption that the only connections being made, by people who are advocating VPNs, are over https (or possibly ssh) and thus VPN isn’t necessary. There exists more services than that some of which aren’t end-to-end encrypted (many messaging apps, for example).
Also, I agree that at the end of the day, a user is trusting someone not to snoop. But given that ISPs have been proven to snoop (for various reasons), I personally will put my trust in a VPN provider that I have researched and one that has shown a considerable resilience against outside forces. Mullvad comes to mind here.
Yes, a VPN is probably overkill if all the user is doing is using a web browser, nowadays. But it is useful beyond just setting up a tunnel for access.
Any public data exchange has an element of risk, but the management/priority of that risk relates to your relevant risk matrix/profile.
Any exposed data transverses via a provider, be it mobile or Wi-Fi is pertinent, if you are concerned about provider vulnerabilities and exposure, be it Wi-Fi or mobile, use a VPN and related encryption.
Or don't. Unless you know that your provider is working against your best interests, a VPN provider is just as likely to be compromised as your cable or mobile ISP.
What sort of protection are you after? Your VPN should encrypt your data to make it more difficult to snoop on your activity. I wouldn't trust any random WiFi hot-spot just because you got a VPN encrypting your traffic though.
Note that VPN is just trusting a different network.
If you trust your VPN provider not to misuse your unencrypted traffic / inject exploits, but not your mobile phone provider (or any other network provider you might roam onto), then a VPN provider could help.
If you trust your VPN provider less than the mobile phone provider, the situation is reversed - you would be better not to use a VPN.
If you trust them equally, there is probably no point using a VPN (except for the roaming situation, which could be forced in certain circumstances).
Before answering your first question (I'm actually not sure how to answer! I'll have to think about it 🤔)--my laptop has wifi, which transmits and receives radio waves to/from my router; my router is connected to a cable (broadband cable? I guess? Not DSL at any rate), which is connected to the internet (and there's also a MODEM in there somewhere too). My laptop doesn't have the ability to connect by mobile data which uses, I guess?, cell phone towers, but my smartphone can use both. So they're two different systems is I guess what I'm getting at, and I was never clear on how or if a VPN provided any sort of basic privacy if it was only using cell towers. This is a potentially really dumb question (the head injury doesn't help 🤕), but remember, William Gibson used to think that computers were powered by these gleaming magical crystals (or so he claims), before he looked inside one and discovered that it was basically just a floppy plastic record spinning around really fast.
The first step in security is to answer who you're defending against. Someone stealing your phone? A cop with a STINGRAY device? All the security decisions you make are based on your initial threat model.
Generally, home internet, wifi, and cellular data are considered safe against passers-by (assuming your wifi password is strong). However, they are also assumed to be eavesdropped on by your ISP and government. Details of your internet traffic can then also be revealed by your ISP to other people during legal action, such as if you're being investigated for piracy.
There are ways to further protect your internet traffic from being snooped on, even from your ISP and government, by using things like HTTPS, DNS over HTTPS, and of course, VPNs.
Definitely not a stupid question! Networking infrastructure is complex. I've been working in IT for years and still find myself scratching my head at times going, "Wait, how does the OSI model work again?"
Connecting to a VPN on your phone while using mobile data basically means the cell phone tower handling your data only sees encrypted data. Whoever your VPN provider is will see your traffic instead of the cell tower.
However, in modern times it's fair to be wary of backdoors and exploits that can compromise your device and render the VPN encryption moot. There's not much that regular people can really do to mitigate that possibility other than not use a phone.
If you're interested in learning more networking fundamentals, I'd recommend starting with the OSI model and its layers.
A handy mnemonic I whipped up with ChatGPT last year for better remembering the order of the layers: