3 ms·

Based on your quiz results(https://lolwifi.network/quiz/58efbbca-9b4d-4825-adb7-0e98133fe2a5 https://lolwifi.network/quiz/58efbbca-9b4d-4825-adb7-0e98133...) ,

Based on your quiz results(https://lolwifi.network/quiz/58efbbca-9b4d-4825-adb7-0e98133fe2a5 https://lolwifi.network/quiz/58efbbca-9b4d-4825-adb7-0e98133...) , I notice you acknowledged: - TLS only protects application-layer data (Q1) - doesn't cover layers 2-6 - Client isolation cannot be verified before joining (Q2) - ARP spoofing, DNS manipulation, port scanning, certificate solicitation, MAC collection, and traffic analysis are all possible attacks (Q6) - Personal computers lack defense-in-depth (Q8) But then concluded: "Public WiFi is safe for everyone" (Q10). Your HN comment says "there's nothing preventing me from securely using public wifi" - but you haven't explained how. This is the issue: vague, hand-wavey claims without materialistic explanation(s). What specific protections are you using? You acknowledged these malicious behaviours in Q6: - ARP spoofing - DNS manipulation - Port scanning - Certificate solicitation - MAC collection - Traffic analysis You claim HTTPS makes it safe, but you didn't explain: - How HTTPS prevents ARP poisoning (it doesn't - this happens at Layer 2) - How HTTPS prevents port scanning of your device (it doesn't - attackers scan your listening services directly) - How HTTPS prevents DNS manipulation when 80% of users don't use DoH/DoT - How HTTPS prevents SNI leakage when ECH adoption is <5% - What specific mitigations you've deployed against the network service exploitation you acknowledged TLS operates at layers 5-7. The attacks you listed in Q6 happen at layers 2-4. Your HTTPS traffic is irrelevant to these attacks. The quiz asked about everyone, not just you: This isn't about how well you've personally secured your device. It's about whether the general public should be told "public WiFi is safe because HTTPS." Most people: - Don't know what services are listening on their network interfaces - Are running unpatched software (Q8: personal computers lack defense-in-depth) - Aren't using DoH/DoT - Aren't aware SNI is unencrypted - and the rest If you're going to have a good conversation about this you need to provide better, more specific explanations - not just "HTTPS makes it safe." What exact technical controls are you deploying? What does the average person need to configure to achieve your level of protection? Without specifics,it's all a bit hand-wavey.

josephcsible 10mo ago
> You claim HTTPS makes it safe, but you didn't explain: > - How HTTPS prevents ARP poisoning (it doesn't - this happens at Layer 2) HTTPS doesn't need to prevent ARP poisoning itself, because if you try to MITM my connection with it, HTTPS will prevent that, and if you don't, then ARP spoofing hasn't accomplished anything. > - How HTTPS prevents port scanning of your device (it doesn't - attackers scan your listening services directly) Firewalls protect you from that. > - How HTTPS prevents DNS manipulation when 80% of users don't use DoH/DoT Exact same answer as for ARP spoofing. > - How HTTPS prevents SNI leakage when ECH adoption is <5% SNI leakage happens over the Internet in cleartext even with mobile hotspots. What does this have to do with public Wi-Fi? > - What specific mitigations you've deployed against the network service exploitation you acknowledged Which things specifically do you mean by "network service exploitation" that I haven't already covered? > TLS operates at layers 5-7. The attacks you listed in Q6 happen at layers 2-4. Your HTTPS traffic is irrelevant to these attacks. See my responses above. > The quiz asked about everyone, not just you: > This isn't about how well you've personally secured your device. It's about whether the general public should be told "public WiFi is safe because HTTPS." Nothing I answered was about my specific devices. Everything I've said is about how mainstream devices work out-of-the-box today. > Most people: > - Don't know what services are listening on their network interfaces Mainstream devices are configured out-of-the-box with deny-by-default firewalls. > - Are running unpatched software (Q8: personal computers lack defense-in-depth) Mainstream devices are configured out-of-the-box with automatic updates. > - Aren't using DoH/DoT > - Aren't aware SNI is unencrypted > - and the rest Again, that happens over the Internet in cleartext even with mobile hotspots. What does this have to do with public Wi-Fi? > What exact technical controls are you deploying? What does the average person need to configure to achieve your level of protection? Nothing, assuming usage of a modern mainstream Windows/macOS/Linux/iOS/Android device.

josephcsible 10mo ago

> You claim HTTPS makes it safe, but you didn't explain: > - How HTTPS prevents ARP poisoning (it doesn't - this happens at Layer 2) HTTPS doesn't need to prevent ARP poisoning itself, because if you try to MITM my connection with it, HTTPS will prevent that, and if you don't, then ARP spoofing hasn't accomplished anything. > - How HTTPS prevents port scanning of your device (it doesn't - attackers scan your listening services directly) Firewalls protect you from that. > - How HTTPS prevents DNS manipulation when 80% of users don't use DoH/DoT Exact same answer as for ARP spoofing. > - How HTTPS prevents SNI leakage when ECH adoption is <5% SNI leakage happens over the Internet in cleartext even with mobile hotspots. What does this have to do with public Wi-Fi? > - What specific mitigations you've deployed against the network service exploitation you acknowledged Which things specifically do you mean by "network service exploitation" that I haven't already covered? > TLS operates at layers 5-7. The attacks you listed in Q6 happen at layers 2-4. Your HTTPS traffic is irrelevant to these attacks. See my responses above. > The quiz asked about everyone, not just you: > This isn't about how well you've personally secured your device. It's about whether the general public should be told "public WiFi is safe because HTTPS." Nothing I answered was about my specific devices. Everything I've said is about how mainstream devices work out-of-the-box today. > Most people: > - Don't know what services are listening on their network interfaces Mainstream devices are configured out-of-the-box with deny-by-default firewalls. > - Are running unpatched software (Q8: personal computers lack defense-in-depth) Mainstream devices are configured out-of-the-box with automatic updates. > - Aren't using DoH/DoT > - Aren't aware SNI is unencrypted > - and the rest Again, that happens over the Internet in cleartext even with mobile hotspots. What does this have to do with public Wi-Fi? > What exact technical controls are you deploying? What does the average person need to configure to achieve your level of protection? Nothing, assuming usage of a modern mainstream Windows/macOS/Linux/iOS/Android device.