4 ms·
I expected better from Mozilla. Connecting to unsecured WiFi is mostly not a problem. Most websites and applocations encrypt traffic and the security of the ch
by imbusy111 8y ago
I expected better from Mozilla.
Connecting to unsecured WiFi is mostly not a problem. Most websites and applocations encrypt traffic and the security of the channel does not matter.
Plus, the recommendation to installl shady antivirus software throws the motivation of this article into doubt.
- glitcher 8y agoI agree. The section on "Use tough passwords and change them frequently", except for the final suggestion to use a password manager, felt like antiquated password advice.
- plemer 8y agoWhat do you use instead of a password manager?
- TimTheTinker 8y agoI think you misunderstood the sentence. OP is saying TA's password advice (except for "use a password manager") is antiquated.
- plemer 8y agoYou're correct, I misread. Thank you.
- stretchwithme 8y agoAs long as the password manager is trusted. Some are run by a single person nobody's heard of. I met a woman in Vegas who ran one and who couldn't believe that people trusted it so much.
- tokyodude 8y agoAnd then there are ones like LastPass that people on HN seem to recommend even though their TOS basically says they spy on all your browser behavior and sell it to 3rd parties
- TimTheTinker 8y agoI trust 1Password at present. Everything they’ve done so far (including the structure of their financial incentives) has indicated to me that they are both willing and able to protect my privacy (even from future untrustworthy management) via their software.
- SlowRobotAhead 8y agoBecause that IS antiquated password advice. 1. In terms of “strong passwords” it’s better to use the words “paraphrase” which if they get past 4 words are almost always stronger than traditional “passwords” humans actually use. It’s a nitpick, but using the better term leads to better results in my experience. “Do I need a new password? No, you need a new passphrase” 2. In terms of rolling credentials frequently and on some time period, NIST specifically recommends against that now.
- amluto 8y agoAnd the average secured WiFi isn’t secure in a useful sense. Anyone else using it can pwn your unencrypted traffic just fine using standard techniques.
- kerng 8y agoAs soon as you are on the same collision domain as an adversary I think the risk of being attacked and exploited increases drastically. Many do it, but it's not a very safe thing to connect to untrusted Wifi.
- hahajk 8y agoCan you explain further? Are you saying SSL doesn’t provide the security a normal person thinks, there is more unencrypted traffic outbound than a normal person thinks, or that the unencrypted headers of the otherwise encrypted traffic are more valuable to a hacker than a person might think?
- kerng 8y agoAn adversary doesn't have to decrypt the traffic, they just reroute to their own TLS site to trick users. Or they do broadcasts like LLMNR to grab things and there are some WPAD attacks. Firewall on many computers might also allow things through, to perform relay or direct password bruteforce attacks. There are so many attacks that are possible, decrypting traffic really isn't so interesting.
- mmirate 8y ago> Most websites and applocations encrypt traffic DNS requests, connections' IP addresses and HTTP's Host header are still in plaintext; in short, lots of metadata goes out the window on wireless Layer-Ones.