VPN is what a smart person uses when they are at an internet cafe or somewhere else with public internet where you can’t trust that the traffic isn’t sniffed by someone for giggles and your bank credentials are going to leak.
Not only that, but the iOS and Android APIs for HTTP requests make it really difficult to accidentally use unencrypted HTTP:
* By default, only secure connections are allowed
* You have to enumerate allowed exceptions to this policy in your app manifest XML / Info.plist
* Exceptions are only permitted for specific use cases where mandatory encryption is infeasible, like browsers, podcast players, embedded device clients (which will also require the local network access permission), etc. If you're shipping a banking app and you exempt your own site from encryption, App Review will tear you a new one.
Let’s say a hacker hooks up the hotel internet to a firewalla and opens a free wifi spot. You log in and it sees from your traffic that you’re a customer of ABC bank and Gmail and ATT from the traffic - next thing you know you get a text message from your “bank” that someone has stolen your credentials in “XYZ Arizona” and you have yourself a phishing attack. The exposure scenarios are only limited by the imagination of humans and modern LLMs.
This doesn't seem novel in any way, given the amount of data available online you can already be targeted by fake bank texts, no need for the free wifi hotspot.
I just use my home router as VPN to not care if the 100 apps om my phone have a working encryption. I also use it to access my home services so that they are not exposed to the internet. I also use it to limit exposure on my VMs on a cloud hoster.
Redundancy is not detrimental to security and privacy. On the contrary, having more layers would protect you in case one of them fails (zero-day, bugs, etc.)
If there's a zero-day in TLS there would be a huge amount of problems that a VPN wouldn't protect you against. Even if you're using a VPN (or just a trusted ISP from your home), as soon as your data leaves their hands it would be vulnerable.
Like, suppose I want to send a physical letter to my bank. I can either ensure it can't be opened (using TLS), or I can get a trusted mailman to bring it to the mail central (using a VPN or trused ISP), but only one of those measures are going to protect me against a malicious mailman carrying it from the mail central to the bank.
I’d expect the mail carrier who goes from the mail center to the bank to be slightly more trustworthy than the one who visits me off in the middle of nowhere. Or at least, if that carrier is untrustworthy, it is a big problem for a lot of rich people who have the time and money to think about this sort of stuff.
> it is a big problem for a lot of rich people who have the time and money to think about this sort of stuff
Because banks famously love spending time and money on IT security... Anyway, if TLS was broken, that would be a big problem for everybody.
Using a VPN to protect against a zero-day in TLS, is sort of like hoarding gold to prepare for a collapse of society, in that it's a very unlikely scenario, and if it actually were to happen you'd have a bunch of other problems that aren't solved by gold / a VPN.