I would like to make this story as short as possible since my question is not th
ID: 659858 • Letter: I
Question
I would like to make this story as short as possible since my question is not that long, I have worked with journalists previously in war zone where we investigated the involvement of EU IT companies in selling monitoring software to Dictator regimes owned ISP companies, One was a french company that I can't mention their name nor their software but the software was capable of simply monitoring anything from clients PCs even if it was encrypted.. it would be decrypted.
So my question is in case of being connected to VPN with SSL support and Certificate server/client verification plus user authentication. how secure can user's browsing be?
Is it possible for the ISP company that user is connected to, to know what anyone is browsing regardless if he/she is connected to a secured VPN connection?
Explanation / Answer
Connecting to VPN and using the Internet in the scenario you described is actually very secure. In the case you're talking about (mutual authentication), it is safe to say that ISPs aren't able to intercept and eavesdrop on the connection to know what the user is doing.
However, in the example you made about war situations, government agencies don't just rely on ISPs intercepting connections. An example with which I'm quite familiar is the Syrian civil war. Regime agencies, supported by Russian and Chinese tech and advisers, have actively tried much more invasive methods.
Kaspersky has published a report detailing those invasive methods. They include malware disguised to look as if it contains important information to press or opposition (wanted activists names, lists of imprisoned members of the press, etc.), web pages serving malicious code, documents containing exploits, and a number of other methods. They mostly rely on social engineering.
To put in one line: Yes, that VPN scenario sounds pretty secure. However, in a broader context, only taking care of VPN will not guarantee you the security you're looking for.