4 ms·
I felt exactly the same way. I've run into people who have the idea that public wifi is insecure, as in don't hit your bank's website over that insecure channel
by jsight 8y ago
I felt exactly the same way. I've run into people who have the idea that public wifi is insecure, as in don't hit your bank's website over that insecure channel. But in reality, the services that really need security are going over TLS, where at least the connection itself is secure (presuming that you are taking the same safeguards that you'd take on a "secure" network). In reality, no internet network is naturally secure and the only security are these transport level encryptions.
But, of course, there is more to it than that. What about the unencrypted connections? DNS access and logging? Ironically these are what people tend to worry the least about but are the most likely to be compromised. A VPN can be very helpful here.
The article brushed across this distinction in a way that I think may have just been confusing to anyone that didn't already understand it. The net effect is that they might see these two pieces of advice as contradictory.
- subway 8y agoThe bigger issue with public wifi is even actually finding your bank's server in the first place. HSTS largely saves the day here, but is far from universal. If any non TLS requests are in the request chain, and you don't have an eagle eye on the address bar, all bets are off.
- ridgewell 8y ago>But in reality, the services that really need security are going over TLS, where at least the connection itself is secure. I think other considerations include whether or not the sites that you visit implement HSTS. While many sites do support HTTPS-only logins, several webservices are actually quite vulnerable to software such as SSLstrip[1], which redirects hijacked users to plaintext HTTP pages whenever feasible. While many sites implement TLS, several sites don't implement HSTS. I am not sure about the HSTS policies of the top 3000 sites so I will not comment on that. [1]https://moxie.org/software/sslstrip/ https://moxie.org/software/sslstrip/
- surge 8y agoRight, and he's not counting the metadata an ISP or wifi provider can be collecting about you, they might not be able to see your private traffic to your bank, but now they know who you bank with. You might be passing that information on to ProtonVPN, but I'm more afraid of what someone sniffing wifi traffic can find out about me than a service I'm paying for, its about the same risk with my ISP. AT&T even collects data from its consumers.