For someone so smug, you sure say some stupid shit. In what world would wrapping all of your traffic in an encrypted tunnel not provide additional privacy when using a public endpoint?
You’re routing all your traffic through a single inspection point. They too can scrape anything that isn’t HTTPS. They can list every site you visit without DoH.
Corporations are just as unaccountable as ISPs and governments.
That’s not what’s at argument here. You said that VPNs offer no additional privacy, which is completely incorrect. They have their own pitfalls, yes. But that’s not what you were arguing. You can’t just move the goalposts when someone points out that you’re wrong.
Hotel can see every site you connect to and you’re exposed to SNI fingerprinting by their ISP. Metadata leaks over both LAN and WAN (traffic volume, timing patterns, dest IPs, connection frequency) and both netadmin and ISP can infer your browsing habits without actually seeing the content. Other guests with wireshark and too much time on their hands.
Moreover, many types of traffic aren’t HTTPS, including NTP, DHCP, SNMP, FTP, SSH (without HTTPS), most IoT devices, VoIP, gaming traffic, many application APIs, apps with embedded DNS overrides (really apps in general, especially mobile apps, especially meta and alphabet apps), even email unless TLS is explicitly configured. And many websites simply don’t serve HTTPS and will attempt to redirect to HTTP.
This is without getting into encryption strength and post-quantum standards. And I was referring to 802.1X/MDM enterprise profiles not CA.
I don’t think anything can monitor or mess with your local web traffic once you have encrypted DNS.
VPNs don’t add any privacy over HTTPS+DoH. Installing CA certs and whatnot is insane.
Stop getting your opsec advice from influencers on youtube. It’s snake oil.
“VPNs don’t add any privacy over HTTPS+DoH”
For someone so smug, you sure say some stupid shit. In what world would wrapping all of your traffic in an encrypted tunnel not provide additional privacy when using a public endpoint?
You’re routing all your traffic through a single inspection point. They too can scrape anything that isn’t HTTPS. They can list every site you visit without DoH.
Corporations are just as unaccountable as ISPs and governments.
That’s not what’s at argument here. You said that VPNs offer no additional privacy, which is completely incorrect. They have their own pitfalls, yes. But that’s not what you were arguing. You can’t just move the goalposts when someone points out that you’re wrong.
Hotel can see every site you connect to and you’re exposed to SNI fingerprinting by their ISP. Metadata leaks over both LAN and WAN (traffic volume, timing patterns, dest IPs, connection frequency) and both netadmin and ISP can infer your browsing habits without actually seeing the content. Other guests with wireshark and too much time on their hands.
Moreover, many types of traffic aren’t HTTPS, including NTP, DHCP, SNMP, FTP, SSH (without HTTPS), most IoT devices, VoIP, gaming traffic, many application APIs, apps with embedded DNS overrides (really apps in general, especially mobile apps, especially meta and alphabet apps), even email unless TLS is explicitly configured. And many websites simply don’t serve HTTPS and will attempt to redirect to HTTP.
This is without getting into encryption strength and post-quantum standards. And I was referring to 802.1X/MDM enterprise profiles not CA.