Slashdot Mirror
The Problems of Web Surfing in Public Places
Krishna Dagli writes to mention a New York Times article about the dangers of public web surfing. The article looks at the sloppy habits people have when using public terminals, and the issues that using a wireless signal in a public place. From the article: "Michael Sellitto, a graduate student studying international security at Harvard, said that even though he encrypted any sensitive data on his laptop, he planned to sign up for a service like HotSpotVPN to add another level of security when he is traveling, especially when using poorly protected networks at cafes and hotels. 'The problem is, the really good people have written sniffer programs so that the less-sophisticated people have access to the same technology,' Mr. Sellitto said. 'Say a Microsoft Word document gets transmitted. The sniffer program will collect that and someone could open it up on their computer.'"
Just one of several glaring errors: One guy says not to shop online, but reading email is probably ok. WTHeck??? Online shopping is almost universally via ssl these days, which IS safe (as long as you trust your merchant). Reading email is still mostly via unencrypted channels.
Who wrote this crap?
Ideally, a web browser on a public computer would be set up not to save any personal data, such as cookies, passwords, form entries, etc. Of course, in most cases it is not so, and such browser save cookies, and even passwords from the users... Fortunatelly, some browsers, like FF, have a convenient menu item that clears all personal data recorded by the user, and so it's possible to ensure that you leave no cookies or form entries behind, even if the browser is setup to allow them... Worst thing if the public computer runs IE, or some other browser where you have to dig in options screens to clear all your data. In many cases, such meddling with the browser is frowned upon by whoever is supposed to be watching over the computers.
This is a sig. It is appended to the end of comments I post.
That's all the more reason to listen to The End-to-End Argument [PDF]. (Wiki link if you don't want a PDF.)
Never trust the network!
Although, I suppose VPNs technically don't adhere to the end-to-end argument, exactly..
You are thinking of it in terms of watching a TV. That's not the problem. Like you say, most people have nothing to say.
However, the real problem is that someone will set up a laptop to sniff an open wireless network and then grep the output for credit-card numbers and MMO passwords. Once they nail a CC#, they can examine the surrounding packets to find expiration dates, names and addresses, and that stupid "security code". MMO passwords can be used to empty a user's inventory for real money.
How many people shop from Starbucks? I dunno. I bet quite a few do. How many play WoW at Starbucks? Probably some.
I'd rather you do it wrong, than for me to have to do it at all.
Everyone, even the contractors know the password, and they refuse to change it, Dolts.
- The Google Toolbar has a spell checker button AND it works, consider that before hitting submit next time k?
However, the real problem is that someone will set up a laptop to sniff an open wireless network and then grep the output for credit-card numbers and MMO passwords.
While this is somewhat of a concern, the risk is greatly reduced by the fact that the vast majority of shopping sites use SSL to encrypt transactions where credit card numbers are being sent. That would make any sniffing attempts useless.
Hell, even Yahoo has a secure login for email these days.
AccountKiller
On a related note, check out this article in ITtoolbox called Look At All Of These Passwords!. Apparently, the public terminals at DefCon had illicit listeners. It's pretty amazing how many popular sites don't have any safeguards against a linux user using ettercap.
the risk is greatly reduced by the fact that the vast majority of shopping sites use SSL to encrypt transactions where credit card numbers are being sent
Maybe you don't know, but SSL is useless vs local sniffing because of things like ARP Poisonning ect. SSL is fundamentally broken. Consider every SSL connection you send wirelessly (short of using WPA) to be plaintext. Don't even dare connecting to your bank with it.
Some banks actually issue scratch-off cards, that contain a bunch of authentication numbers. Each of those can be used only once, and they have to be used in order they are listed on the card. That way, even if the login data is stolen, no transaction can be done without intercepting the physical card... Sort of a one time pad scheme for transaction authentication. It's simple, cheap, but effective.
As far as I know, this is more popular in Europe, and few, if not none of the American banks use this system...
This is a sig. It is appended to the end of comments I post.
You could get a cheap hosting account that offers SSH and open a SOCKS tunnel on your machine or router and point your browser at that. DNS will be resolved on your hosting company's server (for SOCKS 4a and 5), and everything will be encrypted until it leaves the hosting company's server, at which point it will about as secure as any other wired connection (which is to say, not at all to the determined cracker). You also get the benefit of the static IP address and ability to run mail and web servers. Check here and here and here for some ways of keeping your tunnels persistent under *nix and win32, and look at unixshell# or JVDS for hosting plans. I've used them both, and they both seem pretty good.
I just use an SSH-based SOCKS proxy for my secure wireless surfing needs. I've got a Linksys router set up back at home that I loaded with Linux.
You can read a guide I wrote a while back on how to do this here. FF, Thunderbird, and GAIM all support SOCKS proxies, so it works out great for me. Only problem is your DNS traffic goes out unencrypted, but that isn't necessarily a big deal, unless you are visiting something along the lines of www.penisland.net.
"Better to be vulgar than non-existent" -Bev Henson
Um, I think GP was referring to use of public terminals, rather than use of wireless networks. I've logged people I've never met out of their G-mail accounts on public terminals many times...
No, the problem with SSL is that it's useless if the endpoint is compromised, eg. keylogger in, eg. net cafe. MiM attacks on SSL are trivial on shared Layer 1 with weak or no encryption, eg. 802.11a/b/g with or without WEP, hubbed or arp spoofed switched ethernet.