query re. OpenVPN providers and encryption [closed]

Question

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.

---

Want to improve this question? Update the question so it's on-topic for Stack Overflow.

Closed 4 years ago.

Improve this question

If the login password of an OpenVPN provider is not kept secure, is the encryption of the openvpn Internet connection then also potentially breached?

Answer 1

No. The transferred data is encrypted by symmetrical encryption, which doesn't depend on the password. However I'm not sure if server certificate is checked during authentification. If yes, then you are secure and the only bad thing is that anyone with your password can connect to that VPN. If server certificate is not checked when using password auth, then this would mean the possibility of MITM (mad in the middle) attack during VPN creation.