4 ms·

Any security professional who says there's a large _security_ risk when using free wifi has completely lost their marbles. App stores require apps use https no

Any security professional who says there's a large _security_ risk when using free wifi has completely lost their marbles. App stores require apps use https nowadays, and nobody is MITMing https, full stop. If you want to talk about risks of using public wifi, then privacy should be the topic. DNS queries are not encrypted. Imagine how valuable it would be for a chain like Starbucks to know what websites their customers are looking at while in the store? I don't know if they do that, but it's multiple orders of magnitude more likely than a free wifi access point posing a security risk to end users.

saagarjha 7y ago
> App stores require apps use https nowadays No: there are exceptions apps can apply for. > nobody is MITMing https Kazakhstan is by forcing you to install their certificate to get online.
- hsnewman 7y ago
  > nobody is MITMing https? How about my company?
  - tomschlick 7y ago
    This is about public hotspots. Your company has every right to MITM connections on it's networks with it's devices.
- azinman2 7y ago
  The concern is a public hotspot, not a state actor. Anywhere in such a country is a problem, public wifi or not.
CalChris 7y ago
Nobody hanging around in a cafe. But https is not ultimately secure and state actors have the resources to do this, in particular China. However that same security professional better be complaining about home/corporate WIFI.
Endy 7y ago
That "nobody" is wrong. Entire governments are MITM'ing all connections. Businesses are interfering as well. So there is a risk, but you have to question risk/reward rates.
- tsimionescu 7y ago
  Yes: all connections. Both those from public WiFi and from secure wired connections and anything else. Point still stands: there is no extra risk form using a public WiFi as long as your traffic is encrypted.
_jal 7y ago
> and nobody is MITMing https Any security professional asserting this doesn't know whereof they speak. There are entire product categories of MITM devices ("TLS inspection") for sale. Another poster mentions nation states doing this openly. Buy aside from many corporations and some nations states, nobody is doing this, full stop.
- bsamuels 7y ago
  When it comes to cybercrime, it's a prospect of "how much time & money will it take to make X dollars" Maybe at one point in the future, purchase of theoretical MITM devices and deploying them in a dragnet of free wifi access points without the FBI finding out will be profitable. But for now, there's much cheaper and more profitable ways to make money criminally.
- nodesecurity 7y ago
  The OP was correct. Yes TLS inspection exists, but requires a special CA certificate installed on the device. Yes, state actors have compromised CA's. Yes yes yes it's all possible and does happen. No, you're not being MITM'ed when you connect to a restaurant wifi. If everything needs to be qualified to the millionth degree, with every caveat laid out and explained, we won't have time to discuss interesting things. The OPs comment is correct general advice.
  - _jal 7y ago
    I'm well aware of how inspection works. You are more than welcome to make your own risk evaluations, but you're looking at this through too narrow a lens. The OP may be sort-of correct for your average first-world facebook-phone user with "nothing to hide", so I kind of agree with your last sentence. But it is way too blithe and unconcerned, and, well, they won't be the first self-described "security expert" who's judgement I find lacking.
- tsimionescu 7y ago
  Corporate TLS Inspection products rely on each user (or the system administrators) installing the MITM certificate on all corporate systems. Unless users are also installing 'public' root certificates, this is a non-issue. And if users are installing bad root certificates, then a fully closed wifi network will not be very good protection either way. Now, nation states, which may be able to obtain valid PKI certificates for MITM purposes, are a whole other level of adversary. Still, again, anyone who can do that will probably not be deterred by you using a WPA-PSK2 protected Wi-Fi AP. So, overall, I don't see what kind of increased security risk you would be exposing yourself to by using public wifi networks.
laputan_machine 7y ago
> and nobody is MITMing https, full stop. Not true: https://tools.kali.org/information-gathering/sslstrip https://tools.kali.org/information-gathering/sslstrip Most free access points have a http endpoint that requires you to 'sign in' first, that is MITM'd and then sslstrip any outbound https requests from there.
- bsamuels 7y ago
  SSLStrip does not work for iphone or android apps since HTTPS is explicit. SSLStrip also does not work for major social networks or financial institutions that implement HTTPS Strict Transfer Policy, which is basically all of them. The only way you can use SSLStrip nowadays is if you have BofA/whatever phishing links on your wifi portal's home page, which is a pretty hard sell phishing wise.

saagarjha 7y ago

> App stores require apps use https nowadays No: there are exceptions apps can apply for. > nobody is MITMing https Kazakhstan is by forcing you to install their certificate to get online.

hsnewman 7y ago
> nobody is MITMing https? How about my company?
- tomschlick 7y ago
  This is about public hotspots. Your company has every right to MITM connections on it's networks with it's devices.
azinman2 7y ago
The concern is a public hotspot, not a state actor. Anywhere in such a country is a problem, public wifi or not.

CalChris 7y ago

Nobody hanging around in a cafe. But https is not ultimately secure and state actors have the resources to do this, in particular China. However that same security professional better be complaining about home/corporate WIFI.

Endy 7y ago

That "nobody" is wrong. Entire governments are MITM'ing all connections. Businesses are interfering as well. So there is a risk, but you have to question risk/reward rates.

tsimionescu 7y ago
Yes: all connections. Both those from public WiFi and from secure wired connections and anything else. Point still stands: there is no extra risk form using a public WiFi as long as your traffic is encrypted.

_jal 7y ago

> and nobody is MITMing https Any security professional asserting this doesn't know whereof they speak. There are entire product categories of MITM devices ("TLS inspection") for sale. Another poster mentions nation states doing this openly. Buy aside from many corporations and some nations states, nobody is doing this, full stop.

bsamuels 7y ago
When it comes to cybercrime, it's a prospect of "how much time & money will it take to make X dollars" Maybe at one point in the future, purchase of theoretical MITM devices and deploying them in a dragnet of free wifi access points without the FBI finding out will be profitable. But for now, there's much cheaper and more profitable ways to make money criminally.
nodesecurity 7y ago
The OP was correct. Yes TLS inspection exists, but requires a special CA certificate installed on the device. Yes, state actors have compromised CA's. Yes yes yes it's all possible and does happen. No, you're not being MITM'ed when you connect to a restaurant wifi. If everything needs to be qualified to the millionth degree, with every caveat laid out and explained, we won't have time to discuss interesting things. The OPs comment is correct general advice.
- _jal 7y ago
  I'm well aware of how inspection works. You are more than welcome to make your own risk evaluations, but you're looking at this through too narrow a lens. The OP may be sort-of correct for your average first-world facebook-phone user with "nothing to hide", so I kind of agree with your last sentence. But it is way too blithe and unconcerned, and, well, they won't be the first self-described "security expert" who's judgement I find lacking.
tsimionescu 7y ago
Corporate TLS Inspection products rely on each user (or the system administrators) installing the MITM certificate on all corporate systems. Unless users are also installing 'public' root certificates, this is a non-issue. And if users are installing bad root certificates, then a fully closed wifi network will not be very good protection either way. Now, nation states, which may be able to obtain valid PKI certificates for MITM purposes, are a whole other level of adversary. Still, again, anyone who can do that will probably not be deterred by you using a WPA-PSK2 protected Wi-Fi AP. So, overall, I don't see what kind of increased security risk you would be exposing yourself to by using public wifi networks.

laputan_machine 7y ago

> and nobody is MITMing https, full stop. Not true: https://tools.kali.org/information-gathering/sslstrip https://tools.kali.org/information-gathering/sslstrip Most free access points have a http endpoint that requires you to 'sign in' first, that is MITM'd and then sslstrip any outbound https requests from there.

bsamuels 7y ago
SSLStrip does not work for iphone or android apps since HTTPS is explicit. SSLStrip also does not work for major social networks or financial institutions that implement HTTPS Strict Transfer Policy, which is basically all of them. The only way you can use SSLStrip nowadays is if you have BofA/whatever phishing links on your wifi portal's home page, which is a pretty hard sell phishing wise.