We discovered a fundamental design problem in VPNs and we're calling it TunnelVision. This problem lets someone see what you're doing online, even if you think you're safely using a VPN.
Good summary by another user in the crosspost over in [email protected]:
breaking news: researchers discover that network protocols work as intended. mindlessly connecting to an untrusted network is still a bad idea.
to quote the article: “Do not use untrusted networks if you need absolute confidentiality of your traffic” or use HTTPS and a SOCKS5 proxy