8/2/21
9:00 am

The Practical Guide To Mac Security: Part 7, VPN

Check out the rest of the videos in this special course: The Practical Guide To Mac Security.

Using a VPN will protect your data from malicious Wi0Fi networks and ISPs. But thanks to HTTPS, it is mostly unnecessary for typical Mac users.

You can also watch this video at YouTube (but with ads).

Video Transcript: Hi, this is Gary with MacMost.com. This is Part 7 of my course The Practical Guide to Mac Security. This course is brought to you free thanks to my great Patreon supporters. Go to MacMost.com/patreon. There you could read more about the Patreon Campaign. Join us and get exclusive content and course discounts. 
So let's look at Virtual Private Networks. Virtual Private Networks are also known as VPNs. So what is a VPN? Well, when you use a device, like a Mac, to access a service from the internet like a website a lot of things happen in-between your Mac and the website. A simplified look at that would be something like this. You would connect to your Wi-Fi and your data would travel between your Mac and the Wi-Fi. Then it would travel to your ISP usually through a modem of some sort, a cable modem or a DSL modem. So sort of equipment you've got and would go to your ISP or internet service provider. From your internet service provider it will go out to the internet where it would go from on router to another perhaps bouncing around the country or world until it finally reaches the web server that has the data. Then this works in both ways. So your request would get all the way to the website and the website would send back the data all the way through that same chain back to your Mac. There are three parts of that that are really out of your control. 
Let's assume that you trust the website. That's why you're going there. Maybe it's your bank, maybe it's a shopping site and that you trust your Mac. But those three spots in-between could be places where you could be spied on. Where your data could be intercepted. Now if it's your Wi-Fi network then you're probably not concerned about that. But it could be the Wi-Fi network say at a coffeeshop, a conference center, a hotel, a school, or some other place. Then also after it leaves the Wi-Fi equipment it has to go to the internet service provider. If you're sitting in a coffeeshop, the coffeeshop is probably not an internet service provider. They probably have contracted out to a cable company or telephone company or some other internet service for their internet connection. That's the ISP that they've got. You don't know who that is. You don't know whether or not you should trust that. Then from there it goes over the network and there are lots of points there where you may or may not want to trust. That your data is going through there and somebody could see it. Let me point out that it may not be that the organization, for instance the coffeeshop, maybe the one not to trust. For instance a coffeeshop could be completely harmless. But somebody could have somehow gotten into their Wi-Fi equipment and installed malware in there. So the coffeeshop is innocent but because they are not internet savvy they haven't secured their Wi-Fi hot spot they have sitting over the counter that everybody is connected to and that's been compromised. Now you can't trust the Wi-Fi not because the coffeeshop isn't trustworthy but because their equipment has been compromised. 
So VPN will help you solve this problem. If you install a VPM on your Mac and then you turn it On then this entire diagram changes to look like this. From your Mac you've got installed on it a VPM client. It's software running on your Mac. That's going to encrypt all the data as it leaves your Mac before it goes to the Wi-Fi network. So everything here in red shows where data has been encrypted. So if the Wi-Fi network has been compromised they are only going to see encrypted data. So it's just going to look like a bunch of scrambled data to them. They can't tell what it is you're doing. Where you're going. They can't see any passwords or information at all. It's basically all encrypted through the Wi-Fi network, through the ISP, and most of the way through the internet until it finally reaches the VPN  server. 
So when you buy a client and server for VPN, the client part is the software that gets installed on your Mac. The server part sits out there. It's the company that you're going through. So if you went through, say, ABC VPN you would get the ABC VPN client on your Mac and somewhere out on the internet would be the ABC VPN server. You're connecting directly to that through the Wi-Fi ISP and the internet. At that point the data would be decrypted and then it would go back out to the internet and to the website. So you would bypass any problem with the Wi-FI equipment, any problem with the ISP's equipment, and most of the problems that you might experience out there on the internet. Your data would be traveling, for the most part, as encrypted data that nobody could get to. So what does this protect you from?
Well, first it protects you from bad Wi-Fi networks. But also against bad local network equipment. So the Wi-Fi router could be fine but the modem, the cable modem or DSL modem sitting behind that, that might be compromised in some way. Using a VPN will protect you from that and the internet service provider itself if it's tracking data, for instance, that would just encrypt things as it goes through that internet service provider. So you're coffeeshop's internet service provider or hotel's internet service provider wouldn't really know what it is you're up to at all and wouldn't be able to intercept or see your data.
So what does it not protect you from? Well, there's a big misconception of course. Install a VPN and now you've secured everything. That's not true at all. Because most things that you worry about aren't really going to be affected at all. For instance, if the site at the other end is bad, like if you're connecting to a fake site or a site that's trying to steal your data, VPN is not going to help you. You're still giving your password or information to that site. Malware, it has nothing to do with malware. You could still download malware from a site you shouldn't trust just as easily over VPN as from anywhere else. VPN is not going to help you. You online accounts are not protected by VPN's in anyway. So if you have a weak password on your Facebook account using VPN on your Mac won't in anyway affect that. Any social engineering attacks you get, any phishing attack, any link you click on that you shouldn't, anyway you're tricked into giving up your password, the VPN doesn't help you with that at all. The other thing the VPN doesn't protect you against is the VPN company itself. So it's important if you're going to signup for a VPN that you trust that company. That company is keeping everything safe. 
Now there's an alternative to VPNs called SSL. You probably know SSL more as HTTPS. If you look at a URL if you go into a website you may see HTTP colon slash slash Apple.com. But if you look closely most websites today say HTTPS not HTTP. This means it's secured. It's SSL. What SSL does is it encrypts the data from your Mac all the way to the website. So basically there's an encryption that's agreed upon between your computer and the website and the data traveling from your computer all the way through the WI-FI, ISP, and all the way through the internet to the web server is all encrypted. If sounds a lot like VPN. It is. It really does do a lot of the same things. It's actually even more comprehensive than using a VPN. 
So, how does it compare? Well, one of the best things about using SSL is it's automatic. Probably every site you're going to today is using HTTPS. If you try to go to a site, like a gmail or Amazon, or Facebook, or a bank with HTTP:// it's just going to change that to add an S. It's going to automatically connect you securely. The only sites still left around that don't use secure stuff are maybe some old data sites where you're not really logging into them. Maybe you're just going to and they're just somebody's blog or something like that. Almost every site you go to today where you have to login you're doing it over HTTPS. So it's automatic. It's easy. There's nothing you need to do. You're already using it. It's Free. It's not costing you anything whereas a VPN you usually pay an annual fee to use a VPN. The only downside to it really is it's not hiding where you're going. If you're going to go to a site like Amazon then the Wi-Fi network, the ISP they all know you're going to Amazon.com. They don't know what data you're sending back and forth between Amazon.com. They just know you're going there. So there's that one little piece of privacy that probably isn't important in most cases. 
So the question is do you need a VPN? Ten years ago that answer may have been, yeah it's probably a good idea. But today it's a little different. You probably don't need it in 2021. Most users will not need a VPN. It's good for that extra layer of privacy but it's not necessary for most people. Most of the time you'd be using a VPN you'd want to do it while traveling. So you'd only be using it a small portion of the time and probably while traveling you're just doing some basic things like checking your email and a few bits of shopping. Things like that and there's really no need for the privacy there. It's a good extra layer for corporate and government data. I mean if you work for a company that has a policy that says you must use a VPN, then of course obviously you've got to use it. If you're dealing with data that has value, like government data may, then they may insist on you having that installed on your Mac or devices. 
One down side to a VPN that isn't present for SSL is it can make things more difficult. Trying to connect using a hotel's Wi-Fi, for instance, is already problematic in a lot of cases when Wi-Fi is pretty weak or the network is not very good. Adding a VPN to that can make things more difficult. Sometimes you get caught in a loop where, you know, the VPN wants to protect you right away but in order to connect to the internet the hotel's Wi-Fi is going to ask you some questions like your room number, name, a password or something and you're fighting between the VPN wanting to protect you and the hotel saying, wait a minute we're not going to let you access anything on the internet until you give us some information, and you can't do that when you have the VPN turned On. It can be a real pain and I've run into situations where I've been at, say a hotel and their Wi-Fi is so bad that every five minutes it seemed to disconnect and then reconnect and then the VPN has to then reconnect so I end up getting maybe, you know, four minutes of good internet connection followed by a minute of down time while it reconnects to Wi-Fi and then to the VPN. 
So, where do you get a VPN if you still want one. Well, there are tons and tons of companies and here are some that I've used in the past and tried in the past. There are so many more. If you search online for best VPNs or, you know, VPN deals or whatever you'll come up with tons of websites. Some websites that you've never heard of and some that you have. But in both cases most of the sites, and you'll see that say here's some good VPNs. Try these. They're getting paid. Keep that in mind. Even if it's a website that you know and trust they're probably getting paid to actually have that link there. So if they say that one VPN is a good one or here's the top three to use and here are three links. Click one of those three links and go to get that VPN service you've probably given a payday to that site. Now that's not to say that the VPN is bad. It could be a perfectly fine VPN. As a matter of fact all of the ones here at the top that I show probably had those deals out there. It doesn't make them bad VPNs but it does mean that the review sites necessarily can't be trusted. 
So keep that in mind. One other thing to keep in mind is most are basically the same. Most VPNs do not have their own network out there. When you saw that diagram earlier that showed the VPN server, VPN servers that's a whole other level. They're companies that offer VPN servers out there. When you go with a company like ABC VPN chances are they purchased time on these VPN servers. So it's not like using one VPN over another is going to give you fantastic service based, you know, on their service versus another company's service. You probably are going to get the same level of service. So it all comes down to those little apps for Mac and there are apps for the iPhone and how well they work and how cool their little features are where you can choose a VPN in your local area or one based on a country or something like that. It's really pretty much the same type of service you're going to get no matter which VPN you choose. Chances are it really doesn't matter that much which one you choose and you could usually buy a year's worth of VPN service, install it, and then, you know, the next year maybe there's a better deal from one of the other companies. 
So now let me show you what it's like to use a VPN service in case you have never used one before. Typically you would pay for a service on a website, just like you would pay for any other service. Then you would download their app and run through their installer which just prompts you to install, is it okay install, enter password and all of that. Then you end up with something in the Menu Bar here that gives you access to the VPN service. So in this case I have installed something called Private Internet Access and I have an account setup with an annual subscription fee. Now you're going to get controls here and they are all going to basically be about the same in terms of what you get in the controls except that they're going to look different. They are all going to have their own little interface and icons and things like that. So, you get the little logo here. You get a big On/Off switch which is all that really matters. But typically you also get the ability to choose a location. So I can click here and choose a location and it's nice to choose one that's nearby. So in this case they've got servers here in Denver, and I'm in Denver, so it's nice for speed that I can connect to a VPN server that is really close and I also can connect to ones that are further away. I may look to different websites and services as if I'm in those locations because that's what a VPN does according to those websites. If I switch here to Texas it would appear that I'm using a computer that's in Texas. Websites also can get your GPS location and you might see every once in awhile a website request your location and that overrides that. That's your computer saying, yes I am located in Denver. But, you know, sometimes services will use these so it's handy to pick a location that's near you for speed and to make sure things that you use will continue to work normally. But if you wanted to you could pick say, you know, United States or US West or something like that and it would just pick whatever the fastest server is in that country. You can pick other countries as well if you want it to appear, you know further mask your location, and make it appear you're somewhere else. Although this may then make things not work very well if you say, oh yes I'm in London but in fact you're in the United States and then your GPS data for visiting a site and the server data may not be the same and now maybe a website has trouble helping you in some way. 
So you can play with your location if you want but you don't necessarily have to to get the benefits of using VPN. Then to turn it on I just hit this big button here. That's basically what all the controls are. You know you subscribe to the service you just want to turn it on or keep it on. Sometimes there are settings. In this case under the settings here and again this is going to look different for different services, you can have Launch on System Startup, Connect on Launch so it's all automatic. If you're traveling you can just have it turned on and it's automatically going to be on. Here I'll turn it on Manually and you could see here, here's my IP Address, the real IP address of where I'm really located. This is the VPN's servers IP Address. So going back to that diagram this is my computer. This is that VPN server way out there. So everything thinks I'm here but in fact then all the data is going through the VPN service to me. So that's part of the protection there. Then while I've got this on I look like I'm here and that's about it. Everything that is encrypted between me and the VPN service and, you know, as long as I have it on it's going to work like that for any network traffic I've got. But I can then just turn it Off here to disconnect and go back to just using the internet regularly.

Comments: 19 Responses to “The Practical Guide To Mac Security: Part 7, VPN”

Tim A

3 years ago

Why your caution about using the web while you travel; aren't sites that have https domestically and considered secure also connecting in that manner overseas and hence secure?

Gary Rosenzweig

3 years ago

Tim: Using https is fine in most cases. But it pays to be extra vigilant when using a network you don’t trust. For example a man-in-the-middle attack could make a compromised network show you an imitation of Facebook instead of the real thing, and then steal your password when you try to log in. Rare, though, so I wouldn’t worry too much.

Fred

3 years ago

Hi Gary, Your discussion on VPNs talked about secure connections to websites through VPN or SSL. What about mail and text messages. Are they secured by VPNs. Thanks, Fred

Gary Rosenzweig

3 years ago

Fred: Apps like Mail and services like iCloud, Gmail, school and corporate email servers, etc, have been using SSL for a long time now. So they are pretty secure. VPN would add another layer to that, but most people wouldn't need it. The odd thing is that email in itself is kind insecure, because services need to send email between each other, iCloud to some other service for instance. So end-to-end encryption isn't possible. But VPN doesn't help that at all and if the Wi-Fi you are using is compromised it would be safe and encrypted when passing through that point.

Nick

3 years ago

So after I turn Have an great day! VPN on do I just act as normal? Click on Safari to use web?

Gary Rosenzweig

3 years ago

Nick: Once your VPN shows it is on and working, just browse as normal. You shouldn't notice any difference.

FredS

3 years ago

The password manager app Dashlane includes a free VPN. They are in the process of revamping their app, so it's a little clunky to get started, but it's doable.

Linda

3 years ago

I am curious to know if apps we have downloaded, say from our bank, would also be secure like going to their site would be https://. So they would be safe (safer?) to use while traveling.

Gary Rosenzweig

3 years ago

Linda: Hard to say since they would built the app either way. But I would expect that they are quite secure, use SSL, and were designed with security in mind. I'll bet there is something on the bank's site or app description that mentions security.

Ron

3 years ago

I’m wondering what is the role of using the Tor browser in gaining privacy. What can ISP track when using Tor? Are there any points along the chain for spying when using a Tor connection?

Ron

3 years ago

If I set up a VPN on my Synology NAS, is Synology hosting a VPN server out there somewhere, so that it’s just the same as signing up with any other VPN?

Ron

3 years ago

Is spying on data to a website the same as spying on email? Does all email just ultimately go to an equivalent of a website, making it the same as any other internet connection?

Lance

3 years ago

Living in Canada, I have a Canadian Netflix account. Can I access the US Netflix shows (which are different) if I use a US based VPN? Will the streaming speed be affected?

Gary Rosenzweig

3 years ago

Ron: I don't know much about the Tor browser. I'd imagine a lot of its privacy features are the same that you get with Safari. As for Synology, you'd need to read their documents or contact their support. I know nothing about their product. Email and websites are different things. They work in different ways and have different uses. Don't send secure information over email, but don't worry about general correspondence.

Gary Rosenzweig

3 years ago

Lance: I doubt that Netflix will be tricked by using a VPN. Streaming would be slowed, too, yes.

Lawrence

3 years ago

You mentioned that if the website has SSL, it’s pretty secure and you may not need a VPN. This is great to know when using a Mac. But like so many of us, I use dedicated Apps for banking, etc. When I log into my bank on my iPhone, I’ll often use my fingerprint and/or two-factor. But I don’t know the security status (https) of the site since it doesn’t display it.

How do I know the security level of dedicated banking Apps, investment Apps etc.? Is it assumed that they have SSL?
Thanks

Gary Rosenzweig

3 years ago

Lawrence: Dedicated apps almost certainly use SSL. In fact for a while now Apple has insisted on that as an App Store submission rule. But apps like banking apps probably started with SSL from the very start. You'd need to ask them for confirmation, but I'd be shocked it a single one didn't use SSL.

Steve Ferris

3 years ago

Two questions:

1. If I specify to my VPN that I trust my home Wi-Fi network, is it right to assume I get no added benefit at all from my VPN subscription when I’m at home? 
2. If I am at home on my trusted Wi-Fi network, how can I take advantage of my VPN disguising my network address? Do I just tell the VPN that I don’t trust my home Wi-Fi?

Gary Rosenzweig

3 years ago

Steve: Yes for both.

Comments Closed.

The Practical Guide To Mac Security: Part 7, VPN

Comments: 19 Responses to “The Practical Guide To Mac Security: Part 7, VPN”

Welcome to MacMost

Free Weekly Newsletter

MacMost Online Courses

Keyboard Shortcuts PDF

Connect with MacMost

MacMost Sections

Popular Tutorials

Information