5 ms·
Many of the tools that I use have already been mentioned, so I'll only mention that VPNs make me feel much better about working from coffee shops. I use Encrypt
by peterlk 9y ago
Many of the tools that I use have already been mentioned, so I'll only mention that VPNs make me feel much better about working from coffee shops. I use EncryptMe, but most any VPN will do
- skrebbel 9y agoCan you explain how that matters? I mean, isn't every service you use on HTTPS these days?
- ZenoArrow 9y agoSites using HTTPS are still vulnerable on a public WiFi access point if you don't use a VPN. To give an example, an attacker can perform session hijacking: https://scotthelme.co.uk/advanced-session-hijacking/ https://scotthelme.co.uk/advanced-session-hijacking/
- cm2187 9y agoThat’s sites not using HSTS and where the user is not paying attention I’d argue people who are thinking of using a VPN wouldn’t fall for this kind of attack.
- ZenoArrow 9y ago> "where the user is not paying attention" What signs should the user be paying attention to?
- cm2187 9y agoThe https lock logo. If it is there the interception mentioned in the link is impossible.
- ZenoArrow 9y agoHow so? Effectively with a MITM attack the attacker becomes a router. Users don't connect to sites directly, the attack can be made transparent at the user level.
- cm2187 9y agoThe only way one can MITM an https connection is by terminating the https connection at the level of the attacker and presenting an http connection to the user, hoping he won't notice the absence of the green https lock. The attacker cannot serve to the victim a valid certificate for facebook.com unless the facebook.com private key or a CA has been compromised. Alternatively the attacker could try a close enough domain (facebooks.com, or something) that it controls and for which it can get valid certificates, and redirect the victim hoping the user won't notice the slight difference in domain name.
- dzek 9y agoFun thing to do: block all http traffic (or even block all but https) and try to work for a day or two. That's the best way to see how many services still relies on http at least partially. ... unfortunately I hope it will get better and soon we all will be able to do that
- deleted 9y ago[deleted]