Slashdot Mirror
The Problems of Web Surfing in Public Places
Krishna Dagli writes to mention a New York Times article about the dangers of public web surfing. The article looks at the sloppy habits people have when using public terminals, and the issues that using a wireless signal in a public place. From the article: "Michael Sellitto, a graduate student studying international security at Harvard, said that even though he encrypted any sensitive data on his laptop, he planned to sign up for a service like HotSpotVPN to add another level of security when he is traveling, especially when using poorly protected networks at cafes and hotels. 'The problem is, the really good people have written sniffer programs so that the less-sophisticated people have access to the same technology,' Mr. Sellitto said. 'Say a Microsoft Word document gets transmitted. The sniffer program will collect that and someone could open it up on their computer.'"
Say a Microsoft Word document gets transmitted. The sniffer program will collect that and someone could open it up on their computer
Yeah, but while in a public place, someone looking over your shoulder might be a more realistic worry.
Just one of several glaring errors: One guy says not to shop online, but reading email is probably ok. WTHeck??? Online shopping is almost universally via ssl these days, which IS safe (as long as you trust your merchant). Reading email is still mostly via unencrypted channels.
Who wrote this crap?
It used to be a hobby of mine. tcpdump and ethereal. Chat, email, documents, http requests, password snarfing. Then I discovered that most folks had nothing of any interest to say. One step above listening to teenage girls talk on their cell phones.
First entomology, then virology, and finally bioinformatics systems. Bugs follow me wherever I go.
I used to work at an Apple store across the street from a high school. I would estimate that 75% of the packets coming into that store came from myspace.com. Of course, these kids would never log out, which meant you could walk up to just about any computer, launch safari, go to myspace and start editing the profile of whomever last used the computer. Favorite edits included
- Changing interests to include homosexuality, drugs, etc.
- Changing background images
- Changing profile photos
- Joining a group of people who check their myspace at the apple store. (I'm in that group too)
I couldn't bring myself to break off any friendships, that's a bit too mean.The article looks at...the issues that using a wireless signal in a public place.
Next we're going to look at the issues that posting without editing.
https://www.eff.org/https-everywhere
How many websites you use have a "log me in automatically" checkbox, ticked by default?
What gets me is sitting down to a mocha double soy and finding all these post it notes under the table with elegantly written little bits like 'bad1983girl', 'iluvpuppies' and 'password'...
A feeling of having made the same mistake before: Deja Foobar
"The article looks at the sloppy habits people have when using public terminals"
When I first read that, I thought it was going to talk about people picking their nose/teeth/ears while using the terminals. I wonder what those dangers are? "What's that green thing on the key there? EWWWWWWWWWWWWWWwwwww..."
Anyone with a laptop on the same segment or WAP can run their own DHCP server. That way when you connect, there's a very good chance that they can send you connection details first.
That way they can make themselves into the gateway and from there it's trivial to screw with your traffic.
Has there ever been a documented case of people having their credit card details stolen by eavsdropping over an unsecured transmission? Not keyboard sniffing the user's machine or hacking the receiving servers database. An actual, verified case of cc number theft.
I'm not asking because it can't be done. Obviously unsecured wireless networks are very easy to monitor. But the issue here is I'm constantly amazed at the focus people have on the security of transmission, rather than spyware on their machines or the potential security of end servers which seem to me to be a lot more vulnerable and ripe for attack on the kind of scale that's actually useful to criminals.
Often the same people will happily hand over their credit cards to be taken out the bank of a resturaunt, fax or phone cc details through to businesses or throw out printed receipts with their full details (and signature).
Why this obsession with HTTPS?
One of these days I'm moving to Theory - everything works there
Um, excuse me? All the workstations in the net cafe will have the cafe owner's CA certificate installed, which will validate all the MIM attack certificates for them (assuming that they didn't just have a modified version of firefox installed that lied about the SSL status). SSL is completely and totally worthless when the attacker controls the workstation you are using.
The only thing SSL does is to ensure that communication between two secure endpoints cannot be accessed by somebody who merely controls the channel between them. It cannot be of any use to you if your endpoint is not secure.