Does AirVPN validate its certs properly in the connection process?

[greenclaydog 6]

Is AirVPN vulnerable to a MiTM attack by sysadmins looking to throttle their clients? According to  http://security.stackexchange.com/questions/53444/vpns-vulnerable-to-mitm-because-any-certificate-goes OpenVPN does not validate that the cert is correct, thus making it possible for ISPs, sysadmins etc, to trick the client to use a fake cert so they may monitor the connections contents. Is AirVPN safe from this?

[Staff 9972]

Is AirVPN vulnerable to a MiTM attack by sysadmins looking to throttle their clients?

 

No.

 

According to  http://security.stackexchange.com/questions/53444/vpns-vulnerable-to-mitm-because-any-certificate-goes OpenVPN does not validate that the cert is correct, thus making it possible for ISPs, sysadmins etc, to trick the client to use a fake cert so they may monitor the connections contents. Is AirVPN safe from this?

 

Safe. Frankly, we don't even know whether VPN services without client-side certificate validation exist. Probably not but if you find them, avoid them at all costs.

 

The only way to break the trust is suggested in the thread you linked and requires a compromised system, just like you would do with HTTPS. Any security consideration and audit must start from a non-compromised system, obviously.

 

Kind regards

[LZ1 672]

Hello!

 

If Airs site was vulnerable to like so, it would totally ruin Airs Christmas!

 

You can also check the specs, if you haven't .

 

Welcome to AirVPN.