5 ms·

It's not a "yes/no" answer. If you're visiting http:// http:// sites, if your OS doesn't use DoH/DoT, if you have unpatched vulnerabilities exploitable by same-

by md_ 5y ago

It's not a "yes/no" answer. If you're visiting http:// http:// sites, if your OS doesn't use DoH/DoT, if you have unpatched vulnerabilities exploitable by same-subnet attackers, then maybe it's dangerous. The question is, is it dangerous enough to: - Use a VPN? Yes, if the VPN is free, trustworthy, and not blocked by the wifi. - Not use the Wifi, and instead pay for data/roaming? Nah. - Tell lay users that "avoiding public wifi" is one of the top things they should do to stay secure online? Hell no. User attention is expensive, and wifi is relatively safe. "I don't use public wifi without a VPN" is the new "I never click links in email." It's something semi-technical users say to show off how much less pleasant their online experience is for no particularly good reason. ;)

plibither8 5y ago
I'm trying to reason why you suggest "if the VPN is free". If the VPN is free, I'm confident that I'm paying the VPN provider using my browsing data rather than money. A paid VPN service (somewhat) instills that small amount of trust that my browsing data is not stored/tracked/sold.
- md_ 5y ago
  I meant like Algo. My point was only that the threat here is so small as to not be worth spending real money to mitigate it. But I'm being a bit tongue in cheek--most users are not going to want to set up Algo. And you're right that otherwise, the VPN is probably as sketchy as the wifi itself.
  - plibither8 5y ago
    Algo is interesting! First time hearing about it, thanks :).
    - md_ 5y ago
      This is what I use when: a) I'm traveling b) I remember to turn it on c) I'm not blocked by the wifi (which is common) IOW, while Algo is great, and I'm pretty paranoid, "distrusting public wifi" is sufficiently far down my personal threat model stack rank that I don't really care about it much.
darken 5y ago
> Use a VPN? Yes, if the VPN is free, trustworthy, and not blocked by the wifi. I agree with most of your points; I'd just like to say that I'd never trust a "free VPN"... (Outside of "it's free since I host it".) I'd put most of my effort into vetting which VPN is best audited/trustworthy. As an aside, the other big threat that sidesteps HTTPS certificate validation would be for the attacker to only serve HTTP. The browser will call this out in the URL bar at least. This can be mitigated by sites sending HSTS headers (forcing you to use HTTPS for future connections), but this isn't necessary universal. And requires having visited the site earlier on a "safe" network.
- 7ewis 5y ago
  I have my own self hosted VPN, but I am a fan of Windscribe too, they offer a free VPN which I'd personally trust. I do pay for it, but wouldn't have any concerns recommending it. They actually wrote an article explaining how/why it's free: https://blog.windscribe.com/free-vpn-myths-debunked-70a0aa46849f/ https://blog.windscribe.com/free-vpn-myths-debunked-70a0aa46... Obviously do your own research.
- tialaramex 5y ago
  HSTS is also pre-loaded, you can pre-load an entire apex domain (such as ycombinator.com) or indeed an entire TLD (.dev is pre-loaded). And browsers are starting to offer HTTPS-by-default mode where the browser just interprets HTTP as HTTPS (in links, in bookmarks, almost everywhere) and if the HTTPS server won't accept the connection you get a full-page interstitial where you can choose to let it go for one site that doesn't have HTTPS if you're comfortable with that.
- zargon 5y ago
  Yeah, a free VPN is almost guaranteed to be a honeypot, whereas free wifi has only a small chance of being a problem.
  - willis936 5y ago
    "Free Wi-Fi" also almost always means "no encryption on the PHY" meaning eavesdropping is trivial and MITM is much more likely. I never use public, open Wi-Fi without wireguarding home.
daenz 5y ago
Echoing the other comments about a free VPN, the only free VPN worth trusting is the one you run from your own home router, which a decent router can offer.
deleted 5y ago
[deleted]
kurthr 5y ago
If the WiFi is free... you're the product!

by md_ 5y ago

plibither8 5y ago

I'm trying to reason why you suggest "if the VPN is free". If the VPN is free, I'm confident that I'm paying the VPN provider using my browsing data rather than money. A paid VPN service (somewhat) instills that small amount of trust that my browsing data is not stored/tracked/sold.

md_ 5y ago
I meant like Algo. My point was only that the threat here is so small as to not be worth spending real money to mitigate it. But I'm being a bit tongue in cheek--most users are not going to want to set up Algo. And you're right that otherwise, the VPN is probably as sketchy as the wifi itself.
- plibither8 5y ago
  Algo is interesting! First time hearing about it, thanks :).
  - md_ 5y ago
    This is what I use when: a) I'm traveling b) I remember to turn it on c) I'm not blocked by the wifi (which is common) IOW, while Algo is great, and I'm pretty paranoid, "distrusting public wifi" is sufficiently far down my personal threat model stack rank that I don't really care about it much.

darken 5y ago

> Use a VPN? Yes, if the VPN is free, trustworthy, and not blocked by the wifi. I agree with most of your points; I'd just like to say that I'd never trust a "free VPN"... (Outside of "it's free since I host it".) I'd put most of my effort into vetting which VPN is best audited/trustworthy. As an aside, the other big threat that sidesteps HTTPS certificate validation would be for the attacker to only serve HTTP. The browser will call this out in the URL bar at least. This can be mitigated by sites sending HSTS headers (forcing you to use HTTPS for future connections), but this isn't necessary universal. And requires having visited the site earlier on a "safe" network.

7ewis 5y ago
I have my own self hosted VPN, but I am a fan of Windscribe too, they offer a free VPN which I'd personally trust. I do pay for it, but wouldn't have any concerns recommending it. They actually wrote an article explaining how/why it's free: https://blog.windscribe.com/free-vpn-myths-debunked-70a0aa46849f/ https://blog.windscribe.com/free-vpn-myths-debunked-70a0aa46... Obviously do your own research.
tialaramex 5y ago
HSTS is also pre-loaded, you can pre-load an entire apex domain (such as ycombinator.com) or indeed an entire TLD (.dev is pre-loaded). And browsers are starting to offer HTTPS-by-default mode where the browser just interprets HTTP as HTTPS (in links, in bookmarks, almost everywhere) and if the HTTPS server won't accept the connection you get a full-page interstitial where you can choose to let it go for one site that doesn't have HTTPS if you're comfortable with that.
zargon 5y ago
Yeah, a free VPN is almost guaranteed to be a honeypot, whereas free wifi has only a small chance of being a problem.
- willis936 5y ago
  "Free Wi-Fi" also almost always means "no encryption on the PHY" meaning eavesdropping is trivial and MITM is much more likely. I never use public, open Wi-Fi without wireguarding home.

daenz 5y ago

Echoing the other comments about a free VPN, the only free VPN worth trusting is the one you run from your own home router, which a decent router can offer.

deleted 5y ago

[deleted]

kurthr 5y ago

If the WiFi is free... you're the product!