The student/worker. This person has responsibilities to attend to, and uses a VPN provided by their school or company to access resources on their network when they’re at home or traveling. In most cases, this person already has a free VPN service provided to them, so they’re not exactly shopping around. Also, if they’re worried about security, they can always fire up their VPN when using airport or cafe WI-Fi to ensure no one’s snooping on their connection. Photo by Ed Yourdon.
Protocol: When you’re researching a VPN, you’ll see terms like SSL/TLS (sometimes referred to as OpenVPN support,) PPTP, IPSec, L2TP, and other VPN types. We asked Samara Lynn, Lead Analyst for Networking and Small Business at PCMag, whether or not a user shopping for a VPN should shop for one over another. “SSL is what is commonly used these days. All of these protocols will provide a secure connection,” she explained, and pointed out that most solutions are invisible to the end-user anyway. Strictly, each protocol has its benefits and drawbacks, and if you’re concerned about this (specifically, PPTP vulnerabilities,) you’re probably already aware of them. Most users don’t need to be concerned about this—corporate users on the other hand, are probably all using IPSec or SSL clients anyway.
IPSec – Internet Protocol Security (IPSec) can be utilized with Layer 2 Tunneling Protocol (L2TP) or Internet Key Exchange version 2 (IKEv2). While it is not open source, it does do well in the performance category and can be used natively (without apps) on most operating systems. IPSec/IKEv2 may be the best protocol to use with some mobile devices (iOS), which do not work as well with OpenVPN.
Extensible Authentication Protocol (EAP) is a PPP authentication protocol that allows for an arbitrary authentication method. EAP differs from the other authentication protocols in that, during the authentication phase, EAP does not actually perform authentication. Phase 2 for EAP only negotiates the use of a common EAP authentication method (known as an EAP type). The actual authentication for the negotiated EAP type is performed after Phase 2.
VPN services, while tremendously helpful, are not foolproof. There's no magic bullet (or magic armor) when it comes to security. A determined adversary can almost always breach your defenses in one way or another. Using a VPN can't help if you unwisely download ransomware on a visit to the Dark Web, or if you foolishly give up your data to a phishing attack.