4 ms·

I think this article isn't considering wifi. Most early sites were pressured into using SSL because you could steal someone's session cookie on public wifi. Wi

I think this article isn't considering wifi. Most early sites were pressured into using SSL because you could steal someone's session cookie on public wifi. Without cryptography, all wifi is public, and in dense areas, you would be able to steal so many cookies without having to actually get suspiciously close to anything. I'm guessing without crypto, we would only access financial systems using hard lines, and wifi wouldn't be nearly as popular. Mobile data probably wouldn't have taken off since it wouldn't have been useful for commerce.

quietbritishjim 2y ago
I thought WiFi was somewhat secure from other clients, even if your connection is unsecured at the TCP layer, so long as they're not impersonating the hotspot. You're certainly not secure from the hotspot itself, of course.
- Amezarak 2y ago
  Back in the day, we had a Firefox extension for stealing other people's cookies over WiFi. https://github.com/codebutler/firesheep https://github.com/codebutler/firesheep https://en.wikipedia.org/wiki/Firesheep https://en.wikipedia.org/wiki/Firesheep
- Rygian 2y ago
  Unencrypted WiFi would be equal to broadcasting your unsecured TCP traffic for everyone to eavesdrop in. Early domestic WiFi would use WEP ("Wired-Equivalent Privacy") which was very vulnerable: https://library.fiveable.me/key-terms/network-security-and-forensics/wep-vulnerabilities https://library.fiveable.me/key-terms/network-security-and-f...
- eurleif 2y ago
  Only if the WiFi network is password-protected, which causes connections to be encrypted. Pretty much all WiFi is password-protected nowadays -- if a cafe wants to enable public access to their WiFi, they'll write the password on the wall -- but that only became the case after Firesheep and other sniffing tools drew attention to this issue around 2010. In the old days, there were plenty of networks with no password (and hence, no encryption) at all. The GP specified "without cryptography", in reference to a counterfactual world where we weren't allowed to encrypt things.
  - quietbritishjim 2y ago
    Ah ok. I thought they were referring back to SSL in their first paragraph. Interesting, I had forgotten that WiFi networks once didn't all have passwords.
  - DaiPlusPlus 2y ago
    > Pretty much all WiFi is password-protected nowadays I was at Disneyland last week and stayed at one of their hotels - and all the guest Wi-Fi networks were passwordless and therefore insecure. Ditto the free WiFi at the airports at both ends; oh, and the in-flight Wi-Fi too. While walking around the park my iPhone listed a bunch of passwordless mobile hotspots too. Are you thinking of captive-portals with logins/passwords? (E.g. Mariott/Hilton “Enter your room-number and last-name” portals) - I assume you’re aware that’s only used to authenticate after the WiFi connection is already established? ——— (I really hope that I’m wrong on this; but I’m not aware of any modern wifi standards that address this…. Of course, corp/edu networks can just use RADIUS or a client-certificate (which works on wired networks too). Also, it’s surprising we still haven’t figured out getting TLS to work with home-user-grade routers’ control-panels…
  - kortilla 2y ago
    > Pretty much all WiFi is password-protected nowadays This is absolutely not true in the US. All major hotel chains have no encryption, airports do not, Starbucks doesn’t, etc. It’s usually small businesses that opt for a WPA pass phrase because that’s easier to setup than the captive portal nonsense that all of the big companies use.
  - _yb2s 2y ago
    Aren’t they still just encrypted against the password itself? So if it is a public place like a coffee shop with a known password, anyone can decrypt the data?
    - SAI_Peregrinus 2y ago
      No, the password just allows key exchange to start. Every client has its own session key.

quietbritishjim 2y ago

I thought WiFi was somewhat secure from other clients, even if your connection is unsecured at the TCP layer, so long as they're not impersonating the hotspot. You're certainly not secure from the hotspot itself, of course.

Amezarak 2y ago
Back in the day, we had a Firefox extension for stealing other people's cookies over WiFi. https://github.com/codebutler/firesheep https://github.com/codebutler/firesheep https://en.wikipedia.org/wiki/Firesheep https://en.wikipedia.org/wiki/Firesheep
Rygian 2y ago
Unencrypted WiFi would be equal to broadcasting your unsecured TCP traffic for everyone to eavesdrop in. Early domestic WiFi would use WEP ("Wired-Equivalent Privacy") which was very vulnerable: https://library.fiveable.me/key-terms/network-security-and-forensics/wep-vulnerabilities https://library.fiveable.me/key-terms/network-security-and-f...
eurleif 2y ago
Only if the WiFi network is password-protected, which causes connections to be encrypted. Pretty much all WiFi is password-protected nowadays -- if a cafe wants to enable public access to their WiFi, they'll write the password on the wall -- but that only became the case after Firesheep and other sniffing tools drew attention to this issue around 2010. In the old days, there were plenty of networks with no password (and hence, no encryption) at all. The GP specified "without cryptography", in reference to a counterfactual world where we weren't allowed to encrypt things.
- quietbritishjim 2y ago
  Ah ok. I thought they were referring back to SSL in their first paragraph. Interesting, I had forgotten that WiFi networks once didn't all have passwords.
- DaiPlusPlus 2y ago
  > Pretty much all WiFi is password-protected nowadays I was at Disneyland last week and stayed at one of their hotels - and all the guest Wi-Fi networks were passwordless and therefore insecure. Ditto the free WiFi at the airports at both ends; oh, and the in-flight Wi-Fi too. While walking around the park my iPhone listed a bunch of passwordless mobile hotspots too. Are you thinking of captive-portals with logins/passwords? (E.g. Mariott/Hilton “Enter your room-number and last-name” portals) - I assume you’re aware that’s only used to authenticate after the WiFi connection is already established? ——— (I really hope that I’m wrong on this; but I’m not aware of any modern wifi standards that address this…. Of course, corp/edu networks can just use RADIUS or a client-certificate (which works on wired networks too). Also, it’s surprising we still haven’t figured out getting TLS to work with home-user-grade routers’ control-panels…
- kortilla 2y ago
  > Pretty much all WiFi is password-protected nowadays This is absolutely not true in the US. All major hotel chains have no encryption, airports do not, Starbucks doesn’t, etc. It’s usually small businesses that opt for a WPA pass phrase because that’s easier to setup than the captive portal nonsense that all of the big companies use.
- _yb2s 2y ago
  Aren’t they still just encrypted against the password itself? So if it is a public place like a coffee shop with a known password, anyone can decrypt the data?
  - SAI_Peregrinus 2y ago
    No, the password just allows key exchange to start. Every client has its own session key.