8 ms·
82% of People Say They Connect to Any Free WiFi That’s Available in Public
- caymanjim 7y agoI'm one of those 82%. The risk is vastly overblown. If you use apps (for e.g. banking), they're already communicating over encrypted connections, and they're not going to accept unknown certificates. They're completely secure. The Google Play Store and the Apple App Store are completely secure. Your browser is going to warn you about certificates that don't match expectations. You have to go out of your way to fall victim to any MITM attack. The risk from a hostile WiFi is pretty close to zero unless you're the kind of person who blindly clicks on links in email you get, and people like that are unsafe in any environment.
- popotamonga 7y agoThere is always that amateur app you thought you deleted that uses http to send your credentials in plaintext.
- lcfcjs2 7y agoMaybe on Android, but not iOS. Also, you should probably be asking yourself why you entered sensitive credentials into an "amateur" app.
- caymanjim 7y agoI don't really care if my chess app is insecure.
- have_faith 7y agoBut now my opponents will know I only ever open with d4.
- labster 7y agoYou will when the hackers checkmate you.
- baumandm 7y agoYou probably use a different password for every login, but there are a lot of people who don't.
- fef586bedcd49 7y ago>They're completely secure. No, they are not. They will never be. They might be secure, but not completely. It is true that we are getting safer, but you should not stop thinking about the risks that will never go away.
- lcfcjs2 7y agoSorry guy, but https encryption is not easily broken. No one really needs to see your bank balance that badly.
- adrianN 7y agoI don't worry about being randomly stabbed, that seems to be more likely than someone hacking my https connections on a public wifi.
- icxa 7y agoJust like there certainly are some cities or places you should actually worry about being randomly stabbed, there are some public open access networks that should raise your concerns.
- fef586bedcd49 7y agoI don't say that you should always be overly concerned when using a wifi. Though, you should pay attention at which wifi you log on and what services you access while doing that. Do you really need to check you email on a public wifi? If it's not necessary, then just don't do it. It's the small things. Sure you can take this into the extreme (which is never a bad thing in this case), but even if we don't, then we should not teach people that every public wifi is perfectly fine. Please remain thoughtful.
- gjs278 7y agothere is zero risk to checking your email over public wifi
- zdkl 7y agoI believe you are very much mistaken. The risk/reward profile of both acts are wildly different: the chances of getting caught while operating a honeypot AP in a public environment are vanishingly small, not so with running around brandishing a knife. Think of it like gas station card skimmers (where the risk is substantially higher than the rogue AP) where the financial motivation is already enough for some people to try it. I might be a tad cynical on this, but since there's money to be made I bet it happens more often than we hear about.
- ousta 7y agoThe risk from a hostile WiFi is pretty close to zero. "connect to wifi, fake login page. enter credentials and a password. to login" pretty sure you get 50% success rate
- ygjb 7y ago> They're completely secure. No. They are an insecure transport, like most of the internet. The majority of high profile sites, services, and apps will now use TLS by default, but this is one of the few edge cases where a reputable VPN provider would help protect end users from poorly secured apps and services. I would trust the VPN folks vetted by Mozilla, but I am biased because I worked at Mozilla for years and have a great deal of trust for the folks there, or for the technical audience at HN I would recommend using one of the cloud service provider templates for standing up your own VPN server.
- itake 7y agoHow does using a VPN protect you from poorly secured apps and services? My understanding is a MITM attack can happen between your VPN provider and the service, just like it may work on the wifi point.
- vorpalhex 7y agoYou should do your initial vpn setup and first connection over a known good secure connection. Good vpn apps also pin certs and will warn you about migrating hosts or unexpected IPs.
- ygjb 7y agoIt doesn't, it simply protects the transport between the untrusted network location (e.g. coffee shop, airport, or Apartment 23C's unsecured wifi) and your VPN endpoint, which presumably has a suitably "safe" transport. Without digging into too much detail, or providing a whack of data because I am not writing long form about this and I spent too much time writing comments on HN this morning :P, but my observation has been that the majority of unsecured apps have service endpoints that are deployed in cloud service provider environments, so if you have a VPN end point that terminates inside the same region, then it is highly unlikely that your traffic will hit the Internet before arriving at it's destination. That said, it's TCP/IP, so all it takes is a routing change and all of those assumptions go out the window... Beyond that, MITM and traffic monitoring is happening all of the time in many network service providers, not all of it's nefarious -- alot of traffic analysis is just sampling to make sure that the network is working well and to understand whats happening. That said, there are many service providers and jurisdictions that opportunistically capture data or modify traffic in flight for purposes other than quality of service (e.g. ISPs injecting advertisements into HTTP traffic, surveillance, etc) Using a VPN in this way doesn't protect you against those kinds of threats - the value in using a VPN here is about preventing local eavesdroppers from monitoring network metadata that can be used to classify your traffic and track you. There are many examples, but one clear one is for marginalized people, such as folks from the LGBT community using specific apps (e.g. gay dating apps such Grindr or Growlr) that could out them to a monitoring service while in a jurisdiction or community hostile to them. Having that traffic tunneled safely to a "known safe" destination, e.g. an AWS or GCP instance in a safer region, would provide a measure of protection. I had a discussion with a colleague about this about a year ago, but I think it would be very awesome to build an open source VPN service that leveraged AWS & GCP VPCs and inter region peering so that it would egress in the same cloud provider regions as destination IP blocks to prevent as much traffic as possible from flowing over the public internet, but I haven't had the time to put into it.
- eli 7y agoYou typo an address in your URL bar and an attacker can serve you a fake login page of your intended destination complete with valid SSL cert.
- taqcp 7y agoRegular users should not be using the URL bar, they should type whatever they want in the search bar.
- saagarjha 7y agoAnd click on the first link, which is a Google ad?
- Endy 7y agoI disagree strongly here. We should be encouraging users to take responsibility and agency for their actions. As admins and tech-aware people in our circles, we should be constantly encouraging better habits like typing URIs manually, decreasing the use of search engines for non-search purposes, and trying to spread literacy. Besides, it's not like we should ever trust a search engine as an authority on anything but the results that bring the host company more money.
- joshuamorton 7y agoWhy is typing a URI manually better? It's undoubtedly less secure and it's upside is...what exactly?
- Endy 7y agoPersonal responsibility is the main benefit; teaching people to look twice at what they do on the Internet. And frankly speaking, if manual user entry is less secure than software that the user does not own from metal to UI, then we need to upgrade the users, not the Web. Demanding a manual entry means that the user is taking deliberate action, not following whatever some piece of software is telling them to be correct.
- sneak 7y agoThings have improved lately, but it wasn’t that long ago that the Chase banking app on iOS did not check the certificate hostname at all, meaning that MITM for the TLS it used was trivial. There are risks, and fortunately they are reducing. A VPN is still a good idea.
- i_am_proteus 7y agoThe risk to individuals is vastly overblown, but if 82% of people connect to any free WiFi they find and 1‰ of those are passing credentials insecurely, an attacker needs to sample on average 1220 people. That's about a hit a day at a busy coffee shop. So y'all and I don't see a risk, but a malicious actor sees a valid strategy.
- e40 7y agoMy brother uses match.com and he kept getting his credentials stolen. He claimed he had a really good password. It happened every time he made a new account. Came down to using public Wifi. The way match.com did authentication was horrible and some info was in clear text. I didn't believe it, but did a web search at the time and found there were a lot of people in the same boat.
- siruncledrew 7y agoSomeone's location also impacts their risk, but generally as long as one isn't in a very dense, high-value-of-information area, the realistic risk that cybercriminals are staked out somewhere like a Starbucks in Topeka, KS waiting to lure people into a MITM is probably less than the actual device getting stolen.
- cmurf 7y agoIs it really each app that verifies its own certificate? Or is it relying on an iOS/Android service to verify the chain of trust? I don't know what the UI would look like, but at the time you connect to WiFi couldn't the user unwittingly accept a pushed certificate, functionally similar to the browser add exception button for an invalid certificate warning, but system wide? I disagree with the comment "go out of your way to fall victim to any MITM attack". If you're trusting employer provided or controlled equipment and haven't personally verified the certificate lists, they totally could MITM your connections without your knowledge if they've already added the exceptions. I know some employers do this, and I know network equipment vendor sales staff have used the ability to MITM employees as an explicit product feature and sales tactic including boasting about the ease with which they can procure faked certs for Google, Microsoft, et al, for this purpose.
- duxup 7y agoRandom HP printers, Wi-Fi with weird names ... no. Places of business ... Yeah I guess I do that, and really, I've no idea if that is actually that business's wi-fi. Granted I run a VPN at nearly all times anyway.
- agumonkey 7y agoAnybody ever abused wireless printers direct wireless modes ?
- dmortin 7y agoDoes it actually matter if you use SSL for connections?
- saagarjha 7y agoIdeally, no. If you install their CA certificate, though, all bets are off.
- blendergeek 7y agoI don't think 82% of people regularly install CA certificates from random WiFi.
- ygjb 7y agoI am inclined to believe alot would, since it's easy to, and many users don't understand the implication of doing so. It's simply the button in the way of getting wifi. It's not that users are dumb, it's that the industry has made this a painful footgun that is easy to trigger.
- dmortin 7y agoWho would do that? I don't think any hackernews reader would.
- winter_blue 7y agoIf you use a VPN, it's absolutely safe. The solution is to raise more public awareness of VPNs, and their benefits. Also, automating the setup of self-hosted VPNs (like OpenVPN) on a home machine (like a Raspberry Pi plugged into the router) would go a long way. I personally prefer not to use third-party VPN providers, as I don't really know whether I can trust them.
- NickBusey 7y agoJust a note that there are many solutions for automated installation of VPN on home machines. HomelabOS (https://gitlab.com/NickBusey/HomelabOS https://gitlab.com/NickBusey/HomelabOS) is one of them, Algo (https://github.com/trailofbits/algo https://github.com/trailofbits/algo) is another.
- pushpop 7y agoThis then just pushes the layer of trust to the developers of the installers. The OPs point is, at some point in the chain you have to trust someone and in his opinion coffee shops are less likely to want to do bad things with your WiFi connection than VPN providers et al. Which I think is a fair point when you look at the costs of scale. ie it’s easier and cheaper to set up a rogue VPN provider or boobytrapped installer than it is a coffee shop. Personally though, the reason I don’t connect to random WiFi networks is most of the ones in the UK ask you for your email address. I’d rather rag my mobile data allowance than hand my email address over to 3rd parties.
- Endy 7y ago>Personally though, the reason I don’t connect to random WiFi networks is most of the ones in the UK ask you for your email address. I’d rather rag my mobile data allowance than hand my email address over to 3rd parties. This is why I have a few spare email addresses that I don't log into. They have no personal information about me (most of these mailboxes were last accessed on computers I don't have anymore or via the public library).
- 7y ago
- rolph 7y agoi used to run a little gig where the free wifi was the gateway, and the access points were a threesome of 802.11 extenders jacked up with an amplifier and labled as per wifi provider. basically MITM ing the starbucks feed and evesdropping out of prurient curiosity. it was easy and got boring after a while so i stopped. never went beyond snooping, but i could have screwed a lot of people if i was an evil guy.
- devoply 7y agouse cloudflare's free vpn, problem solved.
- rstupek 7y agoIsn't the wait list quite long now for it? I'm still at >200k on the wait list with little movement
- tomschlick 7y agoThey haven't opened it up yet because of some changes with the iOS networking side of things. Last update was they were finishing that up over the past/next few weeks.
- eyeball 7y agoHow much protection do you gain by using a vpn like PIA, nord, etc. with a “kill switch” option turned on ?
- ronjouch 7y agoNetworking newbie question: why are "locked-by-password" and "secure" conflated with WiFi? Is there a technical reason for not having access points that are secure/encrypted and open? HTTPS is able to do protocol negotiation in the open, then provide a secure channel. Why is there no such thing at the WiFi link layer?! I found some discussion at https://security.stackexchange.com/questions/35867/why-isnt-open-wifi-encrypted https://security.stackexchange.com/questions/35867/why-isnt-... and https://security.stackexchange.com/questions/149422/why-isnt-a-standard-for-encrypted-but-open-wifi-developed https://security.stackexchange.com/questions/149422/why-isnt... , with wildly varying answers.
- dep_b 7y agoI find public WiFi without password unhygienic just like the average pub toilet or an internet café Windows XP computer. I might get away fine using them but I always feel a bit dirty afterwards. Paid for an unlimited 4G plan just to not have to use public WiFi anymore anywhere.
- bsamuels 7y agoAny security professional who says there's a large _security_ risk when using free wifi has completely lost their marbles. App stores require apps use https nowadays, and nobody is MITMing https, full stop. If you want to talk about risks of using public wifi, then privacy should be the topic. DNS queries are not encrypted. Imagine how valuable it would be for a chain like Starbucks to know what websites their customers are looking at while in the store? I don't know if they do that, but it's multiple orders of magnitude more likely than a free wifi access point posing a security risk to end users.
- saagarjha 7y ago> App stores require apps use https nowadays No: there are exceptions apps can apply for. > nobody is MITMing https Kazakhstan is by forcing you to install their certificate to get online.
- hsnewman 7y ago> nobody is MITMing https? How about my company?
- tomschlick 7y agoThis is about public hotspots. Your company has every right to MITM connections on it's networks with it's devices.
- azinman2 7y agoThe concern is a public hotspot, not a state actor. Anywhere in such a country is a problem, public wifi or not.
- CalChris 7y agoNobody hanging around in a cafe. But https is not ultimately secure and state actors have the resources to do this, in particular China. However that same security professional better be complaining about home/corporate WIFI.
- 7y ago
- felipeerias 7y agoWhy does not having a WiFi password mean that the information must travel unencrypted? And why is a password enough to encrypt that information, even if said password is written in large letters on a wall for everybody to see? I'm sure that there are a good technical reasons, but at the same time it seems like there should be a better way to have convenient and safe WiFi networks in public spaces.
- beatgammit 7y agoI think the answer is that public WiFi hotspots don't have any way of verifying that they are who they say they are, whereas TLS works because you have a trusted third party (the CA) that verifies the keypair. So, if a WiFi hotspot used something like TLS, the data would be encrypted, but you have to way to verify that you're not going through a malicious third party's hotspot on the way to the public WiFi.
- jackewiehose 7y agoOk, but to quote my GP: > And why is a password enough to encrypt that information, even if said password is written in large letters on a wall for everybody to see?
- Ayesh 7y agoThe best security is the one you don't have to educate people about. Today's HTTPS implementations such as HSTS/Preload, DoT/DoH, etc can thwart most of the dumb attacks easily. In mobile apps, you can even pin a particular certificate and it's pretty much safe from.someone with the network access. I work on security, and I connect to open wifi networks all the time when I travel. I trust myself to not install random root certs and not ignorant to go past https warnings. For my own apps, I have HSTS preloaded, proper CSP headers, and don't TLS < 1.2.
- el_benhameen 7y agoI think the point that some of the naysayers here are missing is that while SSL and a VPN aren't _perfect_ security, they're more than enough for Joe NineToFive. They eliminate the vector of a random person running a honeypot network trying to scoop up low-hanging banking credentials. If you have a knowledgable, perhaps state-level adversary trying to get you in particular, then yes, connecting to random hotspots is probably not a great idea, but you either already knew that or were compromised long ago.
- ConfusedDog 7y agoBecause the alternative is no wifi. Give me a more secure option, I'd take that. Otherwise, I'm gonna trust TLS does it's job. I know there could be a "heartbleed" zero-day out there, but beats no internet at all.
- edf13 7y agoI’ve a new one... let’s ask how many people think the green/ssl bar means it’s safe to enter your credit card details into the site? SSL != trust
- brokenmachine 7y agoHow many people even know about the bar/lock at all? Most people don't have any idea how it all works.