Airport Experiment Shows That People Recklessly Connect To Any Free Wi-Fi Spot (softpedia.com)

An anonymous reader writes: Avast carried out a curious experiment at the Barcelona Mobile World Congress. They've set up 3 public Wi-Fi spots at the local airport and waited to see how many users would connect. In just 4 hours, more than 2,000 users used the free hotspots, despite the fact that they knew nothing about the WiFi network, if it was safe, or who was running it. Researchers randomly logged some traffic stats just to prove a point about how easy is to hack users on a public WiFi network. They also recommended using a mobile VPN app when navigating the Web via public WiFi.

Comments

I have hitch hiked before

[invictusvoyd]

But I always carry a concealed weapon

Re:I have hitch hiked before

[KGIII]

Here's the actual announcement from Avast:
https://press.avast.com/en-us/...

That has all you might need. No need to hitch off this softpedia site. They're not adding any value over reading the press release and they don't even include a link (or I didn't see it in their layout) to the original press report. It's the internet, linking is kind of important. Maybe they want to pretend it's exclusive content or real journalism? I dunno... Screw it, avoid entering the unknown and go to a verified source - like the message of the article.

Re:I have hitch hiked before

[Anonymous Coward]

Funny thing is, me and two other military friends used to pick up hitch hikers when we were stationed in New England just for fun. You get to sit in the passenger seat, to your left right is a 9mm, behind you (me) is a .45acp, and driving is a USMC hand-to-hand instructor with an unhealthy fascination in blades.

You wouldn't have a prayer.

#KaBarLurv

Re:I have hitch hiked before

[invictusvoyd]

I was just trying to point out that using an open wifi without https/vpn/whateve is like the good old hitchiking .. You could get robbed/etc you could theoretically get "robbed" over https or VPN also but its safer. Hence the concealed weapon. From the hitchiking perspective , you play along and wait for an opportunity for your .22
And I was downmodded .. shhees /.rs

Re:I have hitch hiked before

[ShanghaiBill]

I was just trying to point out that using an open wifi without https/vpn/whateve is like the good old hitchiking

I don't worry about connecting to public hotspots. My knapsack laptop is a $50 used Chromebook. Good luck "hacking" that, since there is basically nothing on it. They might be able to read emails going back and forth, so they will find out my wife wants me to buy some kitty litter on the way home. Whatever. I doubt if they are even going to get that, since pretty much everything is HTTPS these days.

Re:I have hitch hiked before

[Sax Russell 5449D29A]

you play along and wait for an opportunity for your .22

.22 works well on pests, not so much on 250lbs big rapist-robber dudes. If I had to choose between a .22 and some proper pepper spray to handle such situation, I'd go for the latter.

Re:I have hitch hiked before

[Anonymous Coward]

You're exaggerating dude. As a new editor myself, this usually happens a lot, with companies releasing delayed press releases on their sites because they hire a separate firm to manage their PR/marketing and another one to handle their Web presence. #chillax #dude there's no conspiracy to remote source links from the Internet, and Softpedia always has sources. You look kinda paranoid after *they did link* to their mobile apps and mentioned numerous times it was an Avast study. What was the point of that? Probably a PR lady that takes her job waaay to lightly will tell them to link to the Avast press release 2 weeks after.

Re:I have hitch hiked before

[Anonymous Coward]

This right here. Happened to me too. Thought I was phished or hoaxed. Anyway, there are companies that don't even bother reading PRs, they just copy paste the whole thing and act as they wrote it. From what I can see, the texts are different, so at least the editor read it.

Re:I have hitch hiked before

[Anonymous Coward]

Funny thing is, me and two other military friends used to pick up hitch hikers when we were stationed in New England just for fun. You get to sit in the passenger seat, to your left right is a 9mm, behind you (me) is a .45acp, and driving is a USMC hand-to-hand instructor with an unhealthy fascination in blades.

You wouldn't have a prayer.

#KaBarLurv

I'm a bit curious, what is the track record against suicide bombers?

Re:I have hitch hiked before

[Anonymous Coward]

Companies send press releases in advance all the time. You wouldn't even heard of it if a news portal wouldn't have picked up on it, so shut up and eat your cookie.

Re: I have hitch hiked before

[VikingNation]

Thanks for that link. Very interesting story

Re:I have hitch hiked before

[Ol Olsoc]

I don't worry about connecting to public hotspots. My knapsack laptop is a $50 used Chromebook. Good luck "hacking" that, since there is basically nothing on it.

Exactly this! I'm at breakfast now, using my cheap Chromebook. Altogether too many people seem to think you should only have one device. And nothing of interest on it at all. just a gmail address specifically for the chromebook, and slashdot use.

Re: I have hitch hiked before

[KGIII]

Yeah, I figured I'd find the press release to see if they missed anything. No, they didn't really miss much. They mostly just seem to have reprinted it.

I got some replies that make me think there's a softpedia editor here posting AC. They seem concerned that I linked to the source. I think I'm going to have to keep paying attention to 'em - if I remember. It's pretty busy lately so I might not notice often. Ah well...

Not sure why they moderated you down. I got one the the other day that made no sense. I did get a couple that I understood. ;-) I'm just gonna say what I want, to hell with the moderation. Somehow, this normally works. I'm usually polite but I'm not much for mincing words. Screw 'em. If they wanna mod you down, they can mod me with you. (It gives you a 0 with no comment history available. Dunno why they did it.)

They probably said your off-topic. Which, by now, you can see is why my response is as it is. 'Cause I can do off-topic...

Anyhow, seeing as I'm going for that OT mod (I've got a whole bunch of those) I might as well tell you that the weather is nice. It's a nice, balmy, 73 (convert it yourself, I'm lazy) and sunny. I was downtown last night and oh my... For those that haven't been playing the home game, I'm in PCB, Florida. This is the home of Spring Break. Alas, I have a girlfriend that I've somehow managed to attract (probably with my devilish good looks and raw animal magnetism) so I can not go out ogling and I sure as hell can't offer any of them my penis. I don't know why there aren't more fender benders...

Oh, it stays like this for a month... The colleges all shut down at different times. I admit, I was drinking heavily at the time but that's actually why I bought the house. Well, sort of. I loved the area. Now that I think about it, I love the scenery in Maine. I love the scenery here. Hot college chicks in skimpy bikinis? Yes, yes I do like that. And, being an old man, they all feel compelled to come talk to me if I'm out and about. I've also got my dog with me - he and I need to take a ride downtown later.

There... One good OT post deserves another.

Re:I have hitch hiked before

[invictusvoyd]

try shooting a .22 in the skull

Re:I have hitch hiked before

[Anonymous Coward]

What is this "email" of which you speak?

Re:I have hitch hiked before

[Sax Russell 5449D29A]

Headshots outside CS are not that simple. Hitting a moving target, even at close range, is extremely difficult.

Re:I have hitch hiked before

[sachin.date]

They should repeat this experiment at Def Con 2016.

Re:I have hitch hiked before

[KGIII]

It's too bad that you mentioned that so late. That's an absolutely brilliant idea. Seriously, that's brilliant.

If you've ever been, it's a game of "Spot the Feds!" I'd honestly not be surprised if people were already doing this - though not necessarily for the same reasons.

Now, if you don't mind, I'd like to expand your idea... Do it at Def Con but let's flesh that out.

Don't just do it at the various halls, booths, and in the buildings but do it *everywhere.* Do it in the airport, do it in the hotels, do it in the lobbies of the hotels, and things like that. Make them fit, look normal, give them a variety of names (some less fitting than others like a Starbucks where there is none within visual range), and do nothing BUT log their entrance and any attempts they might make at accessing other computers on the network(s).

Maybe throw some honey pots up - to see who goes poking at what... Maybe put some in the parking garage at the airport. Hell, even create a fake web page, use the authorization, and see about some social engineering. In the hotel lobbies, include a piece of paper as a flier that says "Free Municipal Wireless, use code XXXXXX-HotelName to access!" Things like that... I'm sure it can be expanded much more.

I bet we'd get some meaningful data from it. I'd be *very* interested in seeing how that goes. The problem is, rolling it out would have to be done in a very hush-hush manner. It'd not be really all that easy to keep secret but once cover is blown, it's blown. After that, the experiment is basically ruined or, at the least, any conclusions drawn from it, based on the original premises, are not likely to be valid with the same level of confidence. So, keeping it hush-hush would be imperative.

Also, for fun, it might be worth it if the access point list were all disclosed on the last day. Even better if, at that point, there's a bunch of extra access points and it has been ramped up for a "big announcement to be made at the close of the event" while encouraging the journalists to all attend. Oh my, oh my... Logging any/all internal actions would be good 'cause you know someone's gonna see if they've got default passwords set and things like that. Check to see, leave LAN enabled, who connects to what, or tries to. Check to see who tries to make changes to router settings - and what changes they made. Leave some with older firmware installed, see if someone notices and upgrades it, things like that...

As an aside, I can't admit to this so you'll have to read between the lines. If I were to access someone's router and find that it had the defaults still enabled then I might consider looking. If I looked and, after a thorough investigation, determine that they'd benefit from an upgrade then I might even install the security fixes. If I were going to do that then I'd potentially consider checking to ensure that it's secured, there are some settings that can be changed to tighten it up a bit, and then I'd leave it better than I found it. If there's a networked printer then I might print something out and let them know that they were insecure, that it has been fixed, that I'm now locked out, and that the new password is what it is. But, you know, I can't actually admit to doing anything of the sort.

At any rate, that's a brilliant idea. We're far enough back in time (this thread's a few days old now) so nobody will notice. You and I are probably the last two to participate. I wonder who we can send this to as a suggestion? I wonder if it has been done before and the results just not released? I dare say, you've got a brilliant idea there and one that should be looked into, albeit looked into quietly so as to not bias the results.

The Internet isn't "safe"

[xaosflux]

Why should anyone expect some random WLAN to be "safe" - they are trying to get to the Public Internet, this is just another Public inter-Network along the way.

Re:The Internet isn't "safe"

[greenfruitsalad]

why should i expect it to be unsafe? email is via ssl/tls, chat apps are client-to-server encrypted, all eshops use ssl/tls, google search is by default via ssl/tls, cloud storage i encrypted in transit, so what could they have possibly gained by this devious man in the middle circus? list of websites i access and my http data?

Re:The Internet isn't "safe"

[greenfruitsalad]

s/i encrypted/is encrypted

Re:The Internet isn't "safe"

[Cassini2]

Yes, especially after watching Doctor Who. :-)

Re:The Internet isn't "safe"

[Anonymous Coward]

Why should people expect their own WAN to be safe? Everyone is effectively being monitored and recorded by at least one foreign and probably one domestic security agency, not to mention that sites, aggregators, and even your own ISP are all selling everything you do online to a half dozen marketing data miners. Your PC is likely compromised and running on some Russian/Chinese botnet, and even if your personal files hadn't already been slurped and scanned by all of the above, you're probably storing the most important ones in the cloud anyway, where big data companies are mining, snooping, and selling them to god knows who else all over again.

Oh and if you're on mobile/tablet, you're basically just renting the phone from the carrier and OS provider in an essentially limited license capacity. But don't worry, it's free as long as you agree to "share" your data with them.

And why should I be worried about random WLANs at the airport again?

Captcha: Indolent

Re:The Internet isn't "safe"

[Anonymous Coward]

For applications that don't use certificate pinning, they could have used a MITM attack on you by proxying your requests and using their own valid certificate. As application developers wake up to this more of them are using certificate pinning to prevent or at least report on these types of attacks. Most applications today will allow the attack though. Hence the importance of an encryption layer that isn't easily compromised by a certificate that your system is configured to trust (in other words the "use VPN" statement is right on the money).

Re:The Internet isn't "safe"

[ArsenneLupin]

so what could they have possibly gained by this devious man in the middle circus

Maybe they were hoping that you were a Windows weenie who'd compulsively click away any dialog that appeared, even though this this time it happened to be a warning about a mismatched certificate? In which case you would be the clown in that circus...

Re:The Internet isn't "safe"

[OverlordQ]

That would require them to get a signed signing cert. Which doesn't happen quite as often as the scare stories purport.

Re:The Internet isn't "safe"

[Anonymous Coward]

A generic hotspot should never be considered safe. An airport, however, is considered a safe space. Beyond the airplane security thing, it is a place where visitors to your country or city often arrive or depart, when first impressions are made. Free wifi is part of the hospitality people expect.

I do not see this as a valid experiment, as it is does not have the same social assumptions as say hooking up to a random wifi at a store or restaurant. I would say this says more about the lack of airport security(the airport should prohibit and scan for unsecured outside WiFi connections, and even discourage secured WiFi hotspots, as part of normal security standards.

Re:The Internet isn't "safe"

[Anonymous Coward]

Actual exchange I had a few years ago when we were going to go on a family trip:

AC walks up to family member (FM) who is looking at Facebook on the computer. They exchange pleasantries. AC gets out tablet and starts reading.

FM: Hey, quick question. What is a "certificate error?"

AC: <not really paying attention> Where did you see that?

FM: Well, I saw one earlier before I got on my email and Facebook and another just popped up when I went to check my email again.

AC: <Takes a look at laptop and sees an untrusted root certificate warning. Opens a new tab and tries another website sees same thing. Checks wireless AP, literally says "$Airport -- FREE." Checks email on tablet and sees test email from FM> Well, you're fucked. They have the password to your email and Facebook and may have put a virus on your computer. Also, there is literally a sign 10 feet over there that says "we do not offer free WiFi."

FM: Oh well, since they already got my info, is it ok if I still use it for looking at CNN or the Times?

we use roads in the same way

[turkeydance]

1. know very little about the road. 2. is it safe? (Marathon Man ref) who knows? 3. who's running it? Feds/State/local/private/etc? WiFi is asphalt for smartphones. full speed ahead.

PasswdIsFreeWiFi

[Anonymous Coward]

why not?

Are people connecting to any free wifi hotspot?

[PSXer]

Or do their devices automatically do it for them?

Re:Are people connecting to any free wifi hotspot?

[mjwx]

Or do their devices automatically do it for them?

The only time I've ever had my Wifi connect to a strange access point without me asking it to were one's named "Linksys" and this was back in 2006. Seemed my old Windows XP lappy would interpret any open AP named Linksys as one I've connected to before because I had connected to one callled Linksys before.

I'm pretty sure modern OSes dont do this any more.

Yes, stop snickering, I called Windows "Modern".

Re:Are people connecting to any free wifi hotspot?

[sims 2]

Umm no... That's still standard practice. It's actually one of the only ways I've found to get devices to correctly roam between APs. Works on APs with and without encryption set.

Best way to solve it? Set a key on the AP you connect to then if another has the same name your computer won't be able to connect to it because the AP doesn't have the right key.

Re:Are people connecting to any free wifi hotspot?

[Anonymous Coward]

I remember my coworker and his wife were invited to boss' home for dinner, and he found that his wife's iPhone automatically connected to his boss' home Wi-Fi (WPA encrypted). Later he told us iPhone was worth its money because it's so smart as to connect to any Wi-Fi without password.

Of course, we wouldn't be so cruel to tell him the truth, that, iPhone is not that smart....

Re:Are people connecting to any free wifi hotspot?

[Anonymous Coward]

There are only two possibilities here:

1) The story is bullshit
2) The co-worker's wife had been there before on her own, and not for "dinner"

No iPhone or anything else will connect to a WPA network without it already having stored the password. So my vote is for #2 above.

Re:Are people connecting to any free wifi hotspot?

[thegarbz]

Devices by default do not connect to open access points that are unfamiliar. Actually not just default, I don't know any way to set any of my devices to allow this course of action. All my devices announce the presence of the network, but none will connect.

Re:Are people connecting to any free wifi hotspot?

[Lord Bitman]

or both networks were called "home" and had the password "no1willguess"

Re:Are people connecting to any free wifi hotspot?

[Anonymous Coward]

Umm no... That's still standard practice.

Not for Windows it isn't. Newer versions of Windows will by default definitely not automatically connect to a WiFi of the same name but different BSSID/MAC. You can easily verify this yourself on default setting installs of Windows against physically separate WLANs with same SSID.

If someone is spoofing your BSSID/MAC too you are being targeted in a way that only extremely paranoid and competent (the two doesn't always go hand in hand) security practices can have any hope of stopping.

Also, if you have followed the incredible stupid "security advice" to have hidden SSID at home. Then all your devices will be screaming for this hidden ID wherever you go, and it is trivial to spoof an auto-connect of your device.

Re:Are people connecting to any free wifi hotspot?

[swb]

I haven't experienced that with Windows 10 Enterprise and two APs from two different vendors in the house. My laptop connects to both APs depending (I'm assuming) on which one has the best signal. They're at opposite corners of the house, and you get none/marginal signal if you were to try to connect to the distant AP (which I why I added the second AP).

It's kind of surprising how broken the 802.11 spec is around these issues. One, you could have wanted a transparent but default system for encrypting radio traffic even if it was an open system. An open system should just mean you don't need to enter a passphrase to connect, not that you want radio traffic in the clear.

And some kind of transparent certificate exchange that would let clients authenticate the AP even if it was an open system.

Re:Are people connecting to any free wifi hotspot?

[evolutionary]

Or do their devices automatically do it for them?

Not unless you tell them. The default of most Laptops/Cell Phones is for you to specify whether to automatically connect to any unencrypted networks. This happened because it's the nature of most people to use what is available. And people don't want to hear that convenience always comes at the price of security. Every time. Or as a friend of mine put it: "Necessity is convenience + time" People see the word "free" and don't think of the consequences. Look at the people who get their "free" phones with a contract, not even realizing that their phone as so much preloaded spy apps preinstalled for them. It's like a kid taking candy from strangers, or worse a drug dealer (it's almost as addictive). Or the "cheap" laptops which in my experience have more preinstalled "market-ware" than the lightly more expensive business grade laptops. People in general are lazy and cheap when it comes to security and countless companies have built highly successfully marketing strategies based on this fact including (big surprise) Microsoft, WhatsApp, Facebook. I could go on. This is why India blocked FAcebook from opening their limited (to facebook approved content only) free wi-fi over there. They understood the dangers of a central controller free Internet platform in poor regions of that company. The ultimate opportunity to control what people see/hear and influence people's thinking over there. Will we ever learn, except for a few "weird" people, it seems unlikely.

Re:Are people connecting to any free wifi hotspot?

[Anonymous Coward]

Whoosh!

Re:Are people connecting to any free wifi hotspot?

[Anonymous Coward]

I haven't experienced that with Windows 10 Enterprise and two APs from two different vendors in the house. My laptop connects to both APs depending (I'm assuming) on which one has the best signal. They're at opposite corners of the house, and you get none/marginal signal if you were to try to connect to the distant AP (which I why I added the second AP).

It's kind of surprising how broken the 802.11 spec is around these issues. One, you could have wanted a transparent but default system for encrypting radio traffic even if it was an open system. An open system should just mean you don't need to enter a passphrase to connect, not that you want radio traffic in the clear.

And some kind of transparent certificate exchange that would let clients authenticate the AP even if it was an open system.

Hmm.. I was certain Windows started checking BSSID in addition to SSID since Windows 7 (at the same time they stopped broadcast leaking the name of SSID's that was approved for auto-connect in your WiFi list, something still done by many other systems), but I can now only find official support information for the second part (broadcast) not the BSSID part, so my apologies for correcting you in error.

um

[Anonymous Coward]

Oh man, not my traffic stats.

H4X3D.

isn't gmail/google all https?

[xxxJonBoyxxx]

seems like avast missed the point when google, gmail, and youtube went 100% https

the bit about "detecting" devices is also retarded: just serve up a page to new connectors and log the agent and you should get stats on browsers/oses

Re:isn't gmail/google all https?

[msauve]

"seems like avast missed the point when google, gmail, and youtube went 100% https"

What about people who use browsers which don't force an ssl connection to those URIs? Or, an IMAP email client, similarly. Users would still be subject to DNS hijacking.

And, you only mention Google services. There's way more to the Internet than that.

Re:isn't gmail/google all https?

[Anonymous Coward]

The trend is definitely to move to SSL/TLS protocols. Apple and Google both use it for the services on iOS and Android respectively, Facebook automatically redirects to https and their Android client uses https as well. (I assume iOS is the same, I didn't check myself)

Are people using random public WiFi really using something other than Apple or Google to check their mail? We know that XMPP/Jabber is used almost exclusively over SSL/TLS these days. Corporate email is only accessible over IMAP with SSL/TLS, even through a VPN because that's how Exchange Server is configured out of the box for IMAP (when not using exchange/NTLS protocol directly).

Re:isn't gmail/google all https?

[Anonymous Coward]

Corporate email is only accessible over IMAP with SSL/TLS, even through a VPN because that's how Exchange Server is configured out of the box for IMAP

That's just bullshit... I can't be bothered to look beyond Exchange 2013, but it's not TLS by default: https://technet.microsoft.com/...

When you install Microsoft Exchange Server 2013, IMAP4 client connectivity isn't enabled. To enable IMAP4 client connectivity, you need to start two IMAP services, the Microsoft Exchange IMAP4 service and the Microsoft Exchange IMAP4 Backend service. When you enable IMAP4, Exchange 2013 accepts unsecured IMAP4 client communications on port 143 and over port 993 using Secure Sockets Layer (SSL).

Not that "Corporate" even means Exchange in all cases.

Re:isn't gmail/google all https?

[unrtst]

"seems like avast missed the point when google, gmail, and youtube went 100% https"

What about people who use browsers which don't force an ssl connection to those URIs?

This used to be a problem, because users might type in "google.com", and the browser would first go to "http://google.com" (ditto for other sites).
Along came HSTS: https://en.wikipedia.org/wiki/...
That shouldn't be a problem anymore, so long as the users browser supports that, and the server is sending it (which many do these days, because of all the SSL kerfuffle).

Or, an IMAP email client, similarly.

This may actually be worse. In many cases, clients connect to the clear text port and then issue STARTTLS (or similar) if the server had said it supports it.
So, a MITM *could* proxy and restrict the connection to non-tls.

I would like to know what there stats were for unencrypted traffic versus encrypted traffic. How necessary is a VPN if you don't care if the middle knows your source and destination IP's and nothing else?

Re:isn't gmail/google all https?

[Anonymous Coward]

Currently HTTPS adoption is growing at a pretty fast rate, so I'm guessing that the time it would take to educate users about rogue hotspots is longer than the time it takes for most of the internet to switch to HTTPS.

Re:isn't gmail/google all https?

[Anonymous Coward]

I guess it depends on how crappy your email provider is, but most German free email providers at least switched to refusing connection if you do not have TLS enabled.
Of course if you have a really crappy mail client a downgrade attack is still possible, but honestly if your mail client is that crappy I can probably get much simpler access to your email by finding one of the hundreds of other gaping security holes that email client has and exploit it by sending you an email. Much less risk and much wider audience than setting up an access point somewhere.

Re:isn't gmail/google all https?

[msauve]

"That shouldn't be a problem anymore, so long as the users browser supports that..."

LOL. The fallacy is obvious.

Re:isn't gmail/google all https?

[FictionPimp]

Why would anyone using exchange 2013 ever enable imap? You would be using activesync (which is ssl) or RPC over HTTP aka outlook anywhere (which is actually over HTTPS). For legacy support there is still MAPI, which is not over HTTPS, but can be configured to use encryption.

IMAP connectivity for exchange servers makes no sense today. Everyone has a phone that supports activesync or outlook anywhere. On the laptop, if you are willing to buy exchange but not a recent version of office you need to seek professional help.

What is next? Enable POP3?

Re:isn't gmail/google all https?

[Anonymous Coward]

On the laptop, if you are willing to buy exchange but not a recent version of office you need to seek professional help.

I am seeking help, please tell me where. I need to purchase Office 2016 for all our technicians, so they can use it on their Linux laptops, and not only when they are on the Windows desktops in the office.

No, Office 365 is not a valid answer. Nor is webmail (OWA or the newer web based outlook).

Re:isn't gmail/google all https?

[ArsenneLupin]

https wouldn't help if the users are dumb enough to summarily dismiss any SSL certificate warning that pops up...

So, user education is still needed, even if everybody switches to SSL.

Re:isn't gmail/google all https?

[unrtst]

HSTS support across browsers: https://www.owasp.org/index.ph...
Current usage stats: http://caniuse.com/#feat=stric...

IE: 11 (windows 7 and 8.1+)
Edge: all versions
Firefox: 4+
Opera: 12+
Safari: 7+ Mavericks (Mac OS X 10.9)
Chrome: 4.0.211.0

That will cover the majority of users.

Regardless, there is still no fallacy. Users can easily protect themselves from that situation by using a browser that supports HSTS, which simply means using a system that has been updated within the past several years. It also greatly reduces the attack footprint, which is the big selling point for this ad/article.

Re:isn't gmail/google all https?

[FictionPimp]

Thunderbird and Evolution both have OWA support. You do not need IMAP.

Further more, if you are all linux laptops, why did you run a windows server? That is pretty backwards thinking.

Colour me unsurprised.

[mjwx]

Lets face it, people are dumb.

People would still take candy from strangers if we didn't drill it into them from a young age. Stupidity isn't limited to Wifi, it pervades everything people do.

However airports are strange. A lot of people are stuck there for some time with little to do. So free Wifi is a godsend, I admit, despite being quite security aware, that I've been a bit free and loose with connecting to airport Wifi when bored out of my skull at various airports (mostly Australian ones who didn't have free Wifi until recently).

Free Wifi isn't inherently unsafe, but must be treated with suspicion. However most people wont, so back to my original point... People are dumb.

Re:Colour me unsurprised.

[Austerity Empowers]

Not always easy to know what the name of the freewifi service is in an airport you are not familiar with too. All you really know is you're not going to PAY for one, so it's either free or you're tethering. But which one is the free one?

Re:Colour me unsurprised.

[mjwx]

Not always easy to know what the name of the freewifi service is in an airport you are not familiar with too. All you really know is you're not going to PAY for one, so it's either free or you're tethering. But which one is the free one?

That's kind of my point.

How are you to know the difference between a legit and non legit network if they're both named "LAX Public Wifi".

You should really be suspicious of any Wifi network you dont control or at the very least, know the owners on a personal level. I use free wifi for browsing /. but not for doing banking or anything else that could potentially harm me, but as a sysadmin, I'm mindful of such things where as the average Joe isn't.

Re:Colour me unsurprised.

[Anonymous Coward]

You live a sad life, if a stranger offering food is treated with suspicion and distrust rather than gratitude. The rules we learned as a child and the behaviour that cultivated are not necessarily appropriate for adult life.

Re:Colour me unsurprised.

[toonces33]

For random browsing of the news, it might be fine. But the other problem with free WiFi in places like airports is that kids will start streaming music and videos and it will be dog slow.

In reality, I am not sure if there is much difference between free WiFi at an airport and free WiFi at a hotel or a coffee shop. They are all effectively the same thing from an insecurity perspective.

Re:Colour me unsurprised.

[shawn2772]

I use free wifi for browsing /. but not for doing banking

That's backwards. Your bank's web site is authenticated, so your browser can fairly strongly verify that it's legitimate, and the data is encrypted and authenticated so it can't be modified. Browsing /. (or any non-TLS web site), on the other hand, is dangerous because the Wifi operator can inject whatever they like into the stream. Exploits that target your browser, drive-by downloads, ads, tracking cookies (for any site)... whatever they like.

Unless your bank has screwed something up, you can safely do your banking on a hostile network, but browsing /. is risky.

Re:Colour me unsurprised.

[ChunderDownunder]

Beware! It reminds me of a Doctor Who episode

Re:Colour me unsurprised.

[aaarrrgggh]

Honest question though-- can extended validation be spoofed by MITM?

Ultimately you have to trust someone-- if not the wifi then your VPN provider.

Re:Colour me unsurprised.

[wvmarle]

If the above is true as you say, there's no way to securely do anything on the Internet.

Take e-banking. I control my network until the wall socket, where my ISP takes over. Arguably you can trust your ISP because it's in their interest to have you trust them. The same accounts for the network of my bank, I trust them because it's in their interest that I can trust them.

But how about the network(s) in between? I don't know how my local ISP links to my local bank. Same city - could have a direct link, but more likely there's at least one network in the middle. If I connect to a bank overseas there are more networks in between. That's the nature of the Internet.

There is no reason to trust any of those intermediate networks. None. So why do we still bother with https? According to you it's not safe, as there are untrusted networks in between. It'd also be impossible to do any e-banking safely. Yet somehow this is done on a large scale, yet somehow it's https that's seemingly keeping us safe, but according to you that's not the case. Maybe you care to explain more than just say "you're wrong"?

Re:Colour me unsurprised.

[XanC]

HTTPS doesn't fall apart with a man in the middle. It's end-to-end. It's specifically designed to detect that kind of tampering.

Re:Colour me unsurprised.

[DaTrueDave]

What makes you think your HTTPS session is with your bank?

Re: Colour me unsurprised.

[oobayly]

So, how did you recreate my bank's EV certificate with a CA that is in my trusted root certificates?

Re:Colour me unsurprised.

[mjwx]

That's backwards. Your bank's web site is authenticated, so your browser can fairly strongly verify that it's legitimate, and the data is encrypted and authenticated so it can't be modified. Browsing /. (or any non-TLS web site), on the other hand, is dangerous because the Wifi operator can inject whatever they like into the stream. Exploits that target your browser, drive-by downloads, ads, tracking cookies (for any site)... whatever they like.

Here's the thing, I dont really care about something as trivial as a /. account. To expend efforts on securing that against all manner of threats wastes resources.

Also TLS is not immune to MITM attacks. It makes it harder, sure but not immune. Besides this you've got the traditional methods of social engineering, for example, a user goes to hsbc.co.uk and the rouge access point is configured to send them to hsbc.malice.com which looks identical to HSBC's internet banking site. You can collect their username and password without even bothering to break TLS. Depending on the sophistication of the site, they can even collect 2nd factor authentication info.

Granted, the risk of this kind of attack is low, which is why it's not worth protecting my /. account but it is worth protecting my banking details and credit card numbers.

As a security minded IT professional, I always assume two things about public Wifi.
1) that it is rouge.
2) that technology does not magically protect me.

I've always found it wise to err on the side of caution.

Re:Colour me unsurprised.

[Wycliffe]

People would still take candy from strangers if we didn't drill it into them from a young age. Stupidity isn't limited to Wifi, it pervades everything people do.

This "drilling" does very little to actually stop abductions. First off, most abductions are not strangers but rather someone they already know. Secondly, they've done experiments and kids will readily go with someone with a puppy/kitten if they tell them they have more in the back of their van.
The "don't talk to strangers" is completely silly. The one safety tip I try to teach my kids is that if they get lost to immediately walk up to the first stranger they see and ask for help. Don't wait for a stranger to come to you. If you pick the stranger then the odds of picking a bad person are slim to none but if they pick you then the odds of them being a bad person are significantly higher.

Re:Colour me unsurprised.

[Zaelath]

Proxying HTTPS is non-trivial, unless "the right stuff" is access to a certificate authority or users that are stupid enough to accept bad certificates.

You might be thinking Blue Coat or the like, but that only works because you install your signing certificate on all the clients...

Re:Colour me unsurprised.

[Time_Ngler]

Because if the ssl certificate doesn't match the domain name, then the browser will know it.

Re:Colour me unsurprised.

[Anonymous Coward]

Ever notice how it's always the most obnoxious bastard that is wrong? (hint: that's you)

Re:Colour me unsurprised.

[Time_Ngler]

SSL is specifically designed to defeat MITM attacks.

Re:Colour me unsurprised.

[Anonymous Coward]

As a security minded IT professional, I always assume two things about public Wifi.

1) that it is rouge.

2) that technology does not magically protect me. .

You always assume public WiFi is red? Why? I kinda picture it as blue.

Re:Colour me unsurprised.

[Anonymous Coward]

See, if someone controls the network, they can also trivially do a man in the middle attack.

Wrong. Banks and other secure sites identify themselves with a certificate signed by a trusted root authority. This ensures that you're connecting to an authenticated party and that nobody in between you and them can eavesdrop on your communications without breaking the session key, the private key of the site's certificate or the private key of the trusted root authority that signed the site's certificate; all of which are very hard mathematical problems. So hard in fact as to be completely impractical, which is of course the point. The United States and other powerful governments have gone to the effort to steal or break root certificate private keys, but even then the rumored successes have been modest and it's not what I would call trivial. Furthermore, once the world figures out that a root certificate has been compromised it's immediately revoked which means that such breaks are far too valuable to waste on hacking your bank account. A genuine private key to a trust anchor root certificate, Verisign for instance, would be worth millions of dollars or more to the right people on the black market. Although in practice simply being in possession of such information illicitly is so incredibly dangerous to your life and limb, not to mention your freedom, that it would arguably be better to simply destroy it and forget you ever knew it.

Re:Colour me unsurprised.

[Zaelath]

EV is sold to CTOs that are managers but not technical or even aware how customers think.

There's no technical security advantage, at all.

There might be a customer advantage if they even knew what an EV cert was, but they don't, and if you try to explain it to them, they don't care.

Re:Colour me unsurprised.

[WaffleMonster]

BULLSHIT!

See, if someone controls the network, they can also trivially do a man in the middle attack. Just like all the other crap.

It isn't trivial. To perform a successful MITM attack you would need to crack the chain of trust between the sites public key and root cert installed in the browser or invent a parallel chain linking back to a trusted root cert installed in the browser.

This requires obtaining the private key from CA, CA subordinate or bank server. Alternately you could compute a useful collision of signature algorithm and insert your own key into the trust chain as was done /w MD5 signatures using a playstation cluster many years ago.

None of the above is trivial or easy. It is very likely anyone with the capability (e.g. governments) would not elect to piss it away attempting to drain the average Joe's bank account. ROI would be quite negative in the extreme.

If you control the network and have the right stuff, there is nothing which is "safe". And HTTPS falls apart with a malicious actor in the middle who can control your connection and sit in the middle.

Sorry, dude. You're so wrong as to be dangerous. You should fix that.

Networks are not worth defending because their issues can so easily be sidestepped by deployment of end-to-end encryption. I believe various dogmas causing operators to waste money on network castle defenses is harmful. It takes resources away from defending the only thing that matters... systems.

Re:Colour me unsurprised.

[Anonymous Coward]

HTTPS doesn't fall apart with a man in the middle. It's end-to-end. It's specifically designed to detect that kind of tampering.

Unfortunately for the rest of us, the real world implementation often falls short of the ideal. For example, the heart bleed bug was a recent example of how even small mistakes in the code can be disastrous. Sometimes, it only takes a few small mistakes here and there to completely destroy the security of a crypto system, even when the theoretical design itself is sound. History is replete with examples and the NSA lives for finding the flaws and chinks in the armor of real world implementations that fail to live up to that theoretically perfect design.

Re:Colour me unsurprised.

[DamonHD]

Rouge? I suppose that HSBC's logo is red, yes... B^>

(We had a product at work that we delighted in calling RougeWave, is if a cosmetics explosion...)

Rgds

Damon

Re:Colour me unsurprised.

[Anonymous Coward]

What makes you think someone who constructed a collision of a root CA is going to waste that by using it to MitM random people at the airport? All it takes is one person to realize how they got hacked, and then the cert will get revoked.

Unless you've got a few billions dollars in your checking account, I can confidently say that you're safe from this kind of attack.

Re:Colour me unsurprised.

[Anonymous Coward]

Among the 2000 users in the example, how many do you think would think twice before ignoring the annoying popup from the browser.

Not that it really matters. The vast majority of those users just wanted to kill time with reading news/forums and looking at cat pictures/youtube videos while waiting for their flight. The article mentions that 1% used dating apps, I'm pretty sure they would have mentioned if "one user even did online banking."
As for Tinder a lot of people just uses it to kill time, even as a group activity. Not for actual hookups. It's the modern version of Hot or Not pages that were popular in the late 90's.
The interesting thing would be if they could tap into the Gmail accounts since a lot of people were checking their mail.
Assuming that most of the users were checking important mailboxes and not just their throwaway accounts then it could contain private information that the end user care about.
Now that I re-read the article it is poorly phrased. They group Google searches and Gmail together at 61.7%. Considering how many people uses the google search field to go to Facebook that puts the Gmail usage to about -15%.

What it boils down to is that the researchers makes the assumption that the users doesn't think about what kind of activities they do when accessing a public network and presents it as a potential security risk if the users were to do something that they didn't and if the users then would ignore any certificate warnings.
I've met drunk hobos with more valid safety concerns than that.

Re:Colour me unsurprised.

[Anonymous Coward]

Last I checked, Chrome freaks the fuck out if the cert doesn't match the domain and won't let you continue without make you really try hard to get around it.

Re:Colour me unsurprised.

[thegarbz]

but as a sysadmin, I'm mindful of such things

Are you really? You talk about public WiFi as if private WiFi can be trusted. Your home connection goes to a third party that is in bed with the NSA, do do people who you know on a personal level. Your data is whisked away and routed across the internet through any number of points completely unencrypted.

Why would you be mindful of a public WiFi connection but not of the rest of the network?
Also why would you not use an encrypted and verified SSL connection but feel comfortable doing general browsing?

Re:Colour me unsurprised.

[Anonymous Coward]

I don't understand how this gets to Informative. You are the one who is utterly wrong and does not understand HTTPS. Unfortunately i cannot mod you down.

Re:Colour me unsurprised.

[Anonymous Coward]

They could even modify the text of the summaries to try to influence your thinking. I know that /.'s readership is too small to make that worth the effort, but in the case of a big newspaper for example, it could be worth it for some men-in-the-middle (government, political entities opposed to the government, some companies, some foreign governments...).

Re:Colour me unsurprised.

[Anonymous Coward]

> but if they pick you then the odds of them being a bad person are significantly higher.

In case of a child who looks obviously lost? I don't think that's significantly higher. There are a lot of people who would want to help a lost child. I'd say to prevent getting lost even more, possibly with nobody around at all is a better reason. Of all the bad things likely to happen to a child, someone hurting them intentionally is very, very, very far down the list anyway, even though it scares many more than the daily traffic etc.

Re:Colour me unsurprised.

[Anonymous Coward]

Lets face it, people are dumb.

People would still take candy from strangers if we didn't drill it into them from a young age. Stupidity isn't limited to Wifi, it pervades everything people do.

I wouldn't call people that dumb. The dangers and evils of this world is vastly exaggerated.
Let's face it. It doesn't matter how many guns you have, if you go into the public and don't shoot anyone you can see there is plenty of opportunity for strangers to stab you in the back. This does however not happen since no-one is that interested in stabbing you in the back.
There is absolutely nothing that effectively stops suicide bomber, yet you can walk around safe from them. Simply because there is none that has the intention of targeting you.

People aren't necessarily dumb, they just don't want to make their lives inconvenient just because of the theoretical possibility that someone might attack them.
If hijacking airport networks starts to become a thing then people will change their habits.
Theoretical attacks are infinite and for anyone with their priorities straight protecting yourself against man in the middle attacks is lower than any physical assault.

Re:Colour me unsurprised.

[redback]

wouldnt worry too much about the certificate problem, idiots will just click through.

Re: Colour me unsurprised.

[Anonymous Coward]

Through a virus/"free game/porn download" that install my forged root certificate so I can spoof any site I want. Fake but "valid" certificates generated on the fly - perhaps you saw a slight delay when connecting? Oh, perhaps it isn't on your machine - yet. Having it on a few percent of the machines out there is enough to get me rich. Grabbing those credit card numbers as they shop through my proxied https - occationally getting me into their bank where I get them an extra loan to purchase a nonexisting car.

Life is not so hard for the laid-off programmer/networking engineer . . .

Re:Colour me unsurprised.

[Xenna]

"The one safety tip I try to teach my kids is that if they get lost to immediately walk up to the first stranger they see and ask for help. Don't wait for a stranger to come to you. If you pick the stranger then the odds of picking a bad person are slim to none but if they pick you then the odds of them being a bad person are significantly higher."

Let them pick a mother stranger to further reduce the risks.

Re:Colour me unsurprised.

[Anonymous Coward]

OK, so the MitM concern is even less justified.

Re: Colour me unsurprised.

[jafiwam]

If you've got that, just use a keylogger and wait for common bank names to be visited before activating it.

No need to mess with certs and risk getting spotted if you have control of the box already.

Re:Colour me unsurprised.

[Anonymous Coward]

Let them pick a mother stranger to further reduce the risks.

And a white or Asian one, to reduce them still further.

(Is that racist? If so, the parent's comment is sexist.)

Re:Colour me unsurprised.

[Kjella]

but if they pick you then the odds of them being a bad person are significantly higher.

In case of a child who looks obviously lost? I don't think that's significantly higher. There are a lot of people who would want to help a lost child.

If the odds are say 99% and 99.99%, then the odds of a good outcome is only increased 1% because usually either way is fine. But the risk of a bad outcome is increased by a factor of 100 from 0.01% to 1%. The latter is the significant number.

Re:Colour me unsurprised.

[shawn2772]

Here's the thing, I dont really care about something as trivial as a /. account. To expend efforts on securing that against all manner of threats wastes resources.

You missed the point, completely. It's not that someone may snoop on your /. browsing or credentials, it's that someone will inject arbitrary other content into what you're retrieving from the /. server, which can be used to compromise your machine, extract credentials from your browser, etc.

Also TLS is not immune to MITM attacks. It makes it harder, sure but not immune.

Unless the attacker has compromised a CA, and barring bugs in your TLS stack (which used to be a big problem, but has recently gotten cleaned up), yes it is immune to MITM attacks.

Besides this you've got the traditional methods of social engineering, for example, a user goes to hsbc.co.uk and the rouge access point is configured to send them to hsbc.malice.com which looks identical to HSBC's internet banking site.

Unless you look at your browser window to see if the connection is secure.

We really need to get to a point where all web sites use TLS and browsers can be configured (or are configured by default!) to reject any HTTP connection. Then you won't need to look.

Granted, the risk of this kind of attack is low, which is why it's not worth protecting my /. account but it is worth protecting my banking details and credit card numbers.

You fail to understand the threat models here. The point is that your bank's site was built under the assumption that the network between the bank and your computer is untrustworthy, while slashdot was built with the assumption that it is trustworthy. When you know it's not, you're still safe with the bank because no security assumptions are being violated. Not so with slashdot.

I've always found it wise to err on the side of caution.

Except that you're erring on the side of risk because you don't understand the security issues.

Re:Colour me unsurprised.

[shawn2772]

That's backwards. Your bank's web site is authenticated, so your browser can fairly strongly verify that it's legitimate

BULLSHIT!

See, if someone controls the network, they can also trivially do a man in the middle attack. Just like all the other crap.

You don't know anything about TLS and PKI, I see. Go read up on it and then come back and we can discuss like adults.

Re:Colour me unsurprised.

[Anonymous Coward]

Arguably you can trust your ISP because it's in their interest to have you trust them.

Unfortunately, all they can do is complain, when the government mandates yet another round of insecurity in the name of fighting "terrorism".

Don't trust any ISP whose employees aren't already serving times for "aiding terrorism".

Re:Colour me unsurprised.

[ArsenneLupin]

See, if someone controls the network, they can also trivially do a man in the middle attack. Just like all the other crap.

Most browsers will pop up a warning if somebody attempts a man-in-the-middle-attack with SSL. So, as long as the user is sufficiently educated to heed that warning, he should be ok. But then a sufficiently educated user would not run a browser or OS vulnerable to "drive-by downloads" either...

Re:Colour me unsurprised.

[Anonymous Coward]

And how do you know the domain name? Did you type it in yourself (including https?), or use a bookmark?

If you just said "check the address bar", let me tell you of this new invention called "Javascript", that allows making your browser do all the things you don't want.

If you said "entered it myself", but didn't enter "https", you may allready have been redirected.

And that's before getting to all the holes in the CA system (there are at least as many holes as there are trusted certificates in your browser).

Re:Colour me unsurprised.

[Wycliffe]

Let them pick a mother stranger to further reduce the risks.

And a white or Asian one, to reduce them still further.

(Is that racist? If so, the parent's comment is sexist.)

The parent's statement is at least true. A female is probably a safer pick than a male if you're worried about abduction as would an older person. And I would probably agree with the Asian but I'm not sure the white is a true statement. It's hard to find hard stats as most stats don't differentiate between strangers and acquaintances but there is very little statistical difference between blacks and whites when it comes to child abuse. On a side note, although women and asians are probably a safer pick than men for abductions, more women than men abuse their own children. Likewise as a percentage of the women who have to pay child support, there are more deadbeat women than deadbeat men. The problem with sexist and racist statements is like any stereotype they only hold in limited circumstances.

Re:Colour me unsurprised.

[ArsenneLupin]

Honest question though-- can extended validation be spoofed by MITM?

It depends on the security of the certification agencies' procedures, and on any vulnerabilities that might be present in the user's browsers. If the user's browser happens to still trust Diginotar, then yes, even extended validation can be spoofed by the MITM

But joking aside, extended validation protects against some types of attacks against the CA or the website you want to visit, so if the MITM used any of those vulnerabilities to get his fake cert, then extended validation is slightly more secure. However, if the attacker relied on other security holes, then there is no difference.

Re:Colour me unsurprised.

[houghi]

I use a DNS server I know and trust, not the one given via DHCP.

Yes, at some point you are never sure. My bank moved and how do I know that that building really is where they are located? I never verified it. I just assumed that is the case.

Re:Colour me unsurprised.

[Wycliffe]

In case of a child who looks obviously lost? I don't think that's significantly higher. There are a lot of people who would want to help a lost child.

Yes, most people would be fine helping a lost child but they might not notice as most people go on with their day to day somewhat oblivious to their surroundings while a predator is actively looking and scanning the crowd and therefore are much more likely to notice them because they are looking for them. The odds are still really slim as stranger abductions are extremely rare but unless the person is in uniform and hired to scan the crowd, a predator (if present and in the area) will likely be the first person to spot a distressed child.

Re:Colour me unsurprised.

[ArsenneLupin]

There's no technical security advantage, at all.

There is one slight technical advantage. For a domain-validated certificate, the intruder can obtain a fake certificate if he can hijack (even temporarily) all connections from the target web server to the internet, or if he can hijack (even temporarily) the target domain's DNS. Indeed, that way, he may be able to intercept any mails, DNS or web requests that the CA might send to the victim server, and be granted the certificate.

For EV, the intruder would additionally need to supply (or forge) some paperwork "proving" he is the legitimate owner of the target domain, which slightly raises the bar.

There might be a customer advantage if they even knew what an EV cert was, but they don't, and if you try to explain it to them, they don't care.

Consider yourself happy if they even knew what an kind of cert was, and why it is a horribly bad idea to summarily dismiss warnings about bad or mismatched certificates...

Re: Colour me unsurprised.

[Anonymous Coward]

I used the one Lenovo[1] was so nice to put on your machine, which just happened to include the private key.

[1] They weren't the only ones, just the first ones to get caught, and thus the name I remember.

Re:Colour me unsurprised.

[houghi]

That could make them even more in panic if they can not find one and unwilling to accept help from somebody who sees them and is honest. They will be obviiously in stress and then will be an easier target for the person with bad intentions.

I think the first thing is good enough. Any addition will confuse the kid more than helping it. Especially when looking at the ods.What is most importand is to keep the time the kid is lost as short as possible.

Re:Colour me unsurprised.

[jittles]

I don't browse anything through a public WiFi hotspot. Not even at a hotel. I VPN to my home network and RDP into a box whose sole purpose is to allow me to browse the web remotely from my own network.

Re:Colour me unsurprised.

[oh_my_080980980]

LMOL ok Potsy. NO OPEN WIFI IS SAFE. Got it. That's the point. You can't trust any wifi because you don't no if it's secured,safe or has been hacked, regardless if the source is trusted. But what most people use it for like Youtube, it's fine. Just don't do banking from your phone on a public wifi.

Re:Colour me unsurprised.

[Anonymous Coward]

I wouldn't trust "LAX Public WiFi", I would guess that their security is LAX.

Thanks, I'll be here all night.

Re:Colour me unsurprised.

[b0bby]

I agree, I told my kids to ask a mother or female for help first. It's sexist, but it's also playing the odds. Admittedly the chance of a random male wanting to harm your kid is minuscule, but a random female is even more minuscule. And just the fact that they are given some guidance may make them more likely to ask for help in the first place.

Re:Colour me unsurprised.

[operagost]

Social engineering is capable of undermining any technology.

Re:Colour me unsurprised.

[AthanasiusKircher]

Yes, most people would be fine helping a lost child but they might not notice as most people go on with their day to day somewhat oblivious to their surroundings while a predator is actively looking and scanning the crowd and therefore are much more likely to notice them because they are looking for them.

If only people spent as much time worrying about rather mundane things that injure and even kill lots of kids, rather than developing strategies to avoid random rare "predators."

Don't get me wrong -- abuse of children is horrible, and it should be prevented. But your scenario is incredibly rare. Kids die every day because they weren't strapped into car seats correctly, or because their smoke detectors weren't kept up by the parents in their house, or because they were handed a plastic bag to play with, or whatever.

I'm not saying "predators" aren't worth worrying about. But on the list of terrible things that could injury or kill your child, they're pretty far down the list. And despite your speculation, people DO notice a distressed child. Heck, almost every other week these days there's a story about some neighborhood busybody who calls up the cops because she sees a child playing in the park alone or because an 11-year-old is sitting in the car while her mom went into the store for a couple minutes. These aren't even children in distress, and people are calling police to arrest the parents for neglect. And you somehow think "predators" are something to worry about.

FACT: It's more likely that your young child will be "abducted" from you under a false or misleading accusation by CPS about your "neglect" than it's likely that your child will be actually abducted by a random stranger "predator."

Those are real stats... look up the numbers, if you don't believe me.

Re:Colour me unsurprised.

[AthanasiusKircher]

Let them pick a mother stranger to further reduce the risks.

I really think this is unnecessarily sexist. It feeds into this collective social fear these days that any man who dares to talk to a young child might be a pedophile.

Part of the problem is that sexual abuse of children by women is estimated to be grossly underreported, and estimates vary from a few percent up to 40% of abuse happens from women. Boys are particularly at risk. It's also often harder for kids to know whether they are abused, frankly -- because women are much more likely to be in situations where it is somewhat normal for them to touch kids. Mothers tend to do "bathtime" more than fathers, they tend to help with dressing and undressing, etc. Babysitters tend to be female, as do older nannies. Kids are therefore used to having such women touch them (even occasionally private parts), while for many men to even get into a situation where they could grope a kid, it would already have to be very weird.

For these and even more reasons, it's often harder for children to clearly know when something "wrong" has occurred with a female in a common situation, compared to being randomly groped or undressed by an adult male. Hence, the difficulty in estimating abuse by women.

Couple that with the fact that society tells us that women are NOT child molesters, and it makes it much less likely that kids will come forward. And older boys are even socialized to believe that such contact with older women is to be lauded.

Example of social biases: When I was in high school, a coach in a neighboring district had apparently dated a girl on his team. Apparently no sexual contact happened, but he was nevertheless publicly shamed in the newspaper and fired -- rightly so, for his abuse of power. Meanwhile, in my own high school, a female guidance counselor was actually caught literally having sex in the high-school auditorium with a male student. Apparently the "relationship" had been going on for several months, back to when it would have been statutory rape. The guidance counselor was quietly dismissed, with no charges, and the only reason I know about it is because I had a friend whose parents knew someone in administration. Years later, I ran into a good friend of the male student in question and asked about it -- yeah, the friend knew about it, and frankly, when his friend told him, they just basically went around high-fiving each other because he had "bedded" a hot adult woman.

While this anecdote doesn't really apply to social expectations of young kids, it points out the disparate perspectives we have when women might do inappropriate things with male children.

Regardless, beyond the instructions to "seek out a mother" playing into social stereotypes which have led men to be fired from elementary school positions and daycare jobs for no apparent reason, I have real doubts that the advantage is significant. A distressed kid in a public place is very unlikely to happen to walk up to the one guy who both happens to be a pedophile AND is super-prepared so he can magically whisk the kid out into his van without anyone noticing. If your kid is lost on a lonely road in the middle of nowhere, I suppose it might be worthwhile for the child to play the odds and get in a car with a woman rather than a man. But short of that extremely unlikely scenario, I don't know the advice is necessary -- especially given the negative stereotypes around men it engenders (no pun intended).

Re:Colour me unsurprised.

[Xenna]

I see your point.

However, there's been a big scandal in my country about a pedophile who worked in a childcare center. It's rare for a man to work in childcare. This man (he was also gay) did, and the parents were all patting themselves on the back about how tolerant and grown up they were. They even let him babysit there children. Turns out he was a pedophile who specialized in toddlers (who couldn't speak up for themselves).

I believe that women are not entirely safe either, but the kind of abuse they get into is typically less predatory than what you see in these guys. Personally I would be very hesitant to let a man or boy babysit my children.

The advice - sexist as it may be - is sound. The well being of my loved ones comes first, any desire not to be racist of sexist takes a back seat to that. And I'm not even ashamed of that ;-)

Like free hookers

[Anonymous Coward]

You just can't help yourselves.

Re:Like free hookers

[Anonymous Coward]

but you can wear a condom.

False security

[HeadSoft]

Always assume all networks are insecure. You're always correct.

Re:False security

[bobbied]

Always assume all networks are insecure. You're always correct.

True, but some are more "secure" than others and people don't pay attention to this, which is the point of this little social experiment.

Actually, IMHO the security issue of open WiFi needs attention at two points. First, you need a really good and effectively configured firewall on your device. Second, those providing services over the web need to secure all data in transit. It's helpful if the users are aware of the risks, but in today's day and age I don't see your average users able to comprehend the problem enough to deal with it effectively. Those who provide services over the internet must therefore be responsible because you are not going to keep people from connecting to that "Free WiFi" no matter what you do.

Personally, I configure all my portable devices to use encrypted VPN's that force all my traffic though my home network, using DNS servers I control, firewall rules I know about and web filters I control. It's a bit much for personal security and I did it to see if I could, but there are services out there that offer the same things and I'd suggest everybody use something like that.

Re:False security

[jimbolauski]

It's easy to make a secure network you just have to disable all incoming and outgoing connections.

HTTPS or SSL isn't enough?

[blahbooboo]

So if you use HTTPS or SSL secured connections, how are these connection types vulnerable on unsecured wifi?

Re:HTTPS or SSL isn't enough?

[BitterOak]

So if you use HTTPS or SSL secured connections, how are these connection types vulnerable on unsecured wifi?

Virtually all browsers contain root certificates which have been shown to be untrustworthy. It isn't really safe to trust SSL for your security anymore. You need a reliable Internet provider.

Re:HTTPS or SSL isn't enough?

[guruevi]

Who do you trust as a reliable Internet provider? You're better off just deleting all root certificates (if you're that kind of paranoid) and make exceptions for every single site you visit.

OR you could just do like me: you don't store information that matters in places you don't have full control over.

Re:HTTPS or SSL isn't enough?

[KGIII]

A friend of mine recently sent me these two links:
http://www.vpngate.net/en/
http://www.vpnbook.com/feature...

I've played with them both, they're not bad backups. They're as trustworthy as they are but they're free. They seem to be fairly legit. If I were just browsing at an airport, I'd be okay with that. I wouldn't do banking on 'em or anything like that. As I recall, the second one was better than the first as far as throughput and reliability. I played with 'em for a few days.

Re:HTTPS or SSL isn't enough?

[ChunderDownunder]

Neverthless, clickbaity summary is clickbaity. All the article mentioned was that traffic had analysed which sites users had visited, NOT that any of them had been compromised.

Does one trust the findings of a paranoid article at face value pimping avast and various VPN services?

That's not to say indiscriminate public wifi is legit but I don't think it's telling us anything we didn't already know.

Re:HTTPS or SSL isn't enough?

[WaffleMonster]

Virtually all browsers contain root certificates which have been shown to be untrustworthy. It isn't really safe to trust SSL for your security anymore. You need a reliable Internet provider.

Yea, go find that reliable Internet provider that connects you to the same untrustworthy Internet.

Re:HTTPS or SSL isn't enough?

[Anonymous Coward]

Because wi-fi is a LAN protocol, not an Internet protocol. Before you can even open a browser, the wi-fi connection gives an attacker a connection to your phone and everything on it.

Re:HTTPS or SSL isn't enough?

[Anonymous Coward]

Well, seriously.

Using someone else's free vpn is not for the security minded. Yes, they protect you from "free wifi scammers", but the can do the same scams themselves. Are they more trustable than the free wifi provider? It is easy enough to set up such a vpn, and collect information for years before using those card numbers etc.

No, set up your own vpn at home, use that when you travel. Setting up a vpn is not that hard.

Re:HTTPS or SSL isn't enough?

[KGIII]

Yeah, they're as trustworthy as they are - which means I don't trust 'em much. I used 'em to browse the web, etc... I just have a network at home that I can use as a VPN but I prefer to just use the whole thing by remote via VNC. Then I'm not carrying anything with me for data. One thing I'd like to do is figure out how to use 2 factor authentication for VNC.

PIA

[Anonymous Coward]

VPN

BSOD

[Anonymous Coward]

Mr. Facebook was at Paris sometime ago. Doing?

mitm

[Anonymous Coward]

I'd be curious to see how many of those reckless people would still use their preferred services with an SSL warning coming from a mitm ssl proxy.

Logging=hacking?

[fred911]

"logged some traffic stats just to prove a point about how easy is to hack users on a public WiFi network. "

Logging is a long way from poisoning an arp table, serving tainted SSL and recording packets plain text.

Re:Logging=hacking?

[Anonymous Coward]

Agreed, plus they had set up the wifi, of course they could "hack" it, they had the passwords. That's stupid.

Why shouldn't it be safe?

[hawguy]

The bigger question is, why shouldn't it be safe to connect to any random Wifi hotspot? Literally everything should be using https by now, SSL certs are even available for free, so there's no excuse not to. I often connect to public Wifi hotspots (and use a VPN since I know that everything is *not* secured with SSL) and there's really no other option (other than "never use public wifi hotspots") since there is no way to know whether the "Starbucks" or "Starbucks - SFO" or "Starbucks - Public" SSID is the legitimate one.

Re:Why shouldn't it be safe?

[PhrostyMcByte]

there is no way to know whether the "Starbucks" or "Starbucks - SFO" or "Starbucks - Public" SSID is the legitimate one.

And there's no way to know what these "legitimate" hotspots are doing with your data either. Treat everyone as the attacker and your options become far clearer.

Re:Why shouldn't it be safe?

[Anonymous Coward]

Exactly. If you computer is hardened and you use encrypted links, then you are safe. If your computer OS is a toy system, then you are toast no matter what.

Re:Why shouldn't it be safe?

[Anonymous Coward]

Exactly. If you computer is hardened and you use encrypted links, then you are safe. If your computer OS is a toy system, then you are toast no matter what.

Shit man, you just ruled out BSD, Linux, Mac, and Windows. What the hell are we supposed to use?

Re:Why shouldn't it be safe?

[bobbied]

MS-Dos 5.0 with Windows 3.11, or if you really insist, OS2.

Re:Why shouldn't it be safe?

[evolutionary]

The bigger question is, why shouldn't it be safe to connect to any random Wifi hotspot? Literally everything should be using https by now, SSL certs are even available for free, so there's no excuse not to. I often connect to public Wifi hotspots (and use a VPN since I know that everything is *not* secured with SSL) and there's really no other option (other than "never use public wifi hotspots") since there is no way to know whether the "Starbucks" or "Starbucks - SFO" or "Starbucks - Public" SSID is the legitimate one.

Um, is this a trick question? There are MANY sites that don't encrypt all data. (Most sites I believe still only encrypt the login password, and many don't even do that.) Plus you have to consider the devices and software as well. It's not just websites. What about email sent through those wifi hotspots? You've just given sniffers an easy access port to record those messages without even having to register on the network. Yes, there are flaws in the current WPA2 and especially in WPA1 and WEP, but to make it easy to record data without even having to register on the network or even hack some basic encryption? Not a great idea in my opinion. It's like an open invitation to sniff anonymously. Relying on HTTPS is a sure way to leak data, because not all traffic goes that way due to various Internet application and services that don't encrypt because of lack of diligence or optimization efforts.

Just another hopeless wanker

[Anonymous Coward]

Over 60% can't even manage to marry a compatible mate.
Why would you assume they could hookup with a safe network.
What wanker did this study?

Please, Avast, continue!

[Nicopa]

Please, continue this research and expand it to every airport! And make it a permanent thing!

Seriously: Avast is a "security" company that sells security to those feeling "insecure". So it's in their best interest to keep that feeling, seeing threats where there are none. In this case... why should a public WiFi network be more trustworthy than any other network in the middle of the big Internet? You should be doing SSL/TLS, SSH, etc. by now everywhere and that's it.

Re:Please, Avast, continue!

[Anonymous Coward]

Not to mention that they MITM TLS connections using their own root certificate that they install on your machine. Makes me wonder if their own users would have had their browsers trust Facebook.com, even if the bad AP was sending them fake certs.

Possibly the most moronic car analog in history

[Anonymous Coward]

1) no, nothing like a road. A phone line, perhaps, but anyway.
2) see above
3) see above
3a) one example where your choice of roads was based on 'the feds'.

THIS

Re:Possibly the most moronic car analog in history

[Anonymous Coward]

It's an airport so let's go with an aircraft analogy.

1. There's a plane waiting at the gate. You most likely don't know the blokes/sheilas performing its maintenance.
2. You only have the word of the operator that the actual aircraft is safe.
3. Do you personally know the pilot and copilot? Do they have ulterior motives?

Re:Possibly the most moronic car analog in history

[Anonymous Coward]

1. If there's a plane at the gate and you're going to be getting on it, you've already got a ticket that you paid for, and the company that hired the people doing the maintenance can be sued (maybe by your next-of-kin). Free wi-fi is like getting a free plane ride, if the cost of your ticket was that you have to hand over your ID and open your laptop to them.
2. If you've heard from anyone at all that the plane is safe, that's more people than have told you that the free wi-fi is safe.
3. Once you're on the plane, you at least know where the pilot and co-pilot are most of the time. You have no idea who or where that free wi-fi is coming from.

Free wi-fi is like volunteering for the TSA's "random" searches. You're giving away all your stuff for them to examine, they can't be trusted not to share your dick-pics, and you absolutely won't like the Trojan they leave behind after the full cavity search.

Re:Possibly the most moronic car analog in history

[ArsenneLupin]

can be sued (maybe by your next-of-kin)

Good point. Whereas with Wifi, you'll be able to do the suing yourself. Indeed, the worst that could happen with free Wifi is that your weird orange-haired-wankpuffin fetish comes to light, but there's no danger to life-and-limb.

Once you're on the plane, you at least know where the pilot and co-pilot are most of the time.

You might know where they are, but you don't know where they should be. Namely in sick-leave...

and you absolutely won't like the Trojan they leave behind after the full cavity search.

That's not a trojan, that's a femidom!

Aspire to be reckless.

[TheRealHocusLocus]

Simple countermeasure! Just boot up your old Aspire One netbook with XP 'beast', an obsolete alternative distribution of XP where anything that stunk of bloat was omitted or disabled or covered with Hazmat stickers or XOR'd out and ridiculous excess like print spoolers are absent, and nothing is guaranteed but things just might load at all, eventually. This screaming monster only takes three times as long to boot as you'd expect. Then the many Atheros Wifi drivers which do not work fail to load successively, then the only one that does work loads, which happens to be part of an "AT&T Communications Manager" ATTCM bundle that no one in their right mind would choose over anything else. ATTCM wastes your time looking for stupid phone devices they've pissed people off by not supporting and finally gets around to the Wifi. A hundred Wifi beacons later it finally gets around to displaying its hello icon on the screen. Another hundred beacons and the ATTCM user interface is beginning to take shape, drawn before your very eyes, it looks like a cross between a haXor serialz generator and a pinball machine. Another hundred beacons go by and you can almost hear it groan like it's passing a turd, and it manages to say "Scanning for Networks". Now it starts to listen for beacons. It won't show you any network names until it has finished looking and going though its profile database with a tiny spoon and making you wait another few seconds, just because. How cute, now it's trying to show the names. Some jump scroll thing appears that you fear to touch because it is so badly implemented you might jump over whole screens. But the arrows don't work right either. The encrypted login takes too long to describe here. But if you manage to glimpse and click on an unsecured network it's like it has to fill in forms and mail them in, it's so slow. You can feel the excruciating agony of a simple Wifi connect, lose yourself to complete despair "obtaining an IP address" because you've installed countless DHCP servers and watched the packets go by and nothing on God's Green Earth takes this long unless you're being bullshitted. Eventually you realize it has been saying "connected" for awhile but you didn't realize it because there are tears in your eyes. If only you'd have remembered to start Firefox as all this was happening it'd only be a minute or so away from displaying, but you didn't because you feared it would slow things down further. Firefox is now loading, sounds like the drive shaft is loose...

TL;DR It's difficult to imagine doing anything in a reckless manner with this setup. I'm safe.
Actually it's not as bad as I let on. Or maybe it is and I'm so much worse.

Always assume wifi is untrustworthy

[linuxguy]

Always assume wifi is untrustworthy and you'll be fine. You don't need to pay companies like Avast to cover your behind. Most websites these days with sensitive information use https/SSL. Slashdot does not. But I care little about my Slashdot account.

Marketing Skew

[MakersDirector]

Avast has a problem. They apparently do not understand that their business model - to sell people protection - skews their perspective - that people should fear hacking and theft of information - and leads them to believe that people need them to protect them and the protection they offer.

It's a common problem companies have, and starts at the top - the US Government believes it needs to protect those outside it's borders because surely they cannot defend themselves and accordingly, they find evidence to support it.

Protection and mafia style businesses selling protection have a tendency to perpetuate themselves.

And go and set up what they think are "traps" to teach consumers just how dumb they are.

And how much they need Avast to help them for protection.

The Mafia has had this same method of operation for a number of years.

The funny thing being, the mafia was protecting those who paid from the mafia themselves who would beat you up if you quit paying them.

I wonder how many people believe the marketing crap these companies are trying to sell?

Re:Marketing Skew

[gstoddart]

that people should fear hacking and theft of information

Terrible use of hyphenation aside (it reads ... like .. it was ...spoken by ... Shatner): people should fear such things, because they're very real and present dangers in our lives. It's not some abstract thing, it's a real issue.

Yes, Avast wants to sell you security. But any halfwit who even pays a little attention to the news headlines on tech websites should be able to grasp that, yes, hacking and information theft is a thing, it happens all the time, and isn't something to just ignore and pretend doesn't exist.

Business models aside, the world is full of crooks and thieves.

Don't believe me? Plug your PC into the internet without a firewall, and see just how long before you get hacked. What's the current numbers for a new Windows machine? Under 30 minutes last I saw.

You'd have to be a moron to think that security isn't a daily issue people using technology should be at least somewhat aware of.

Re:Marketing Skew

[MakersDirector]

I leverage public access wireless connections regularly and have run without a firewall and virus protection for about five years.

In that time, I've been hacked numerous times, which I invite people to do, as long as you don't harm me or my data and most people don't.

Twice I've been hacked maliciously, one time slowing my machine to a crawl and another time loading something up on my machine I wasn't wanting.... I backtraced him and overwrote his MBR after delivering a nice little message and then reset his router with a special ROM flash that would make life fun for him from that point on...

My point is: Quit selling fear. Quit nitpicking people's speech patterns like a child. And quit labeling people who don't conform to your myopic worldview fools and morons. The world is full of crooks and thieves if you yourself are a crook and thief seeking external validation for what you do.

In any case, quit projecting. You do know what projecting is, don't you?

Security is only an issue if you don't know your own systems.

In today's day and age. Many do, much better than the so called experts such as yourself who advocate nothing other than being a childish insulting infant who was picked on too much as a child with a chip on his or her shoulder the size of Gibraltar.

You cannot recognize "safe" WiFi

[gweihir]

In most circumstances you cannot recognize or verify that a given public WiFi network is safe. What you do instead is assume it is non-safe and use secure communication technologies, like SSH, VPN links, etc. This has been known for ages.

Incidentally, logging traffic is not "hacking".

It's kind of like pussy

[Anonymous Coward]

Everyone wants to stick their dick in, preferably unprotected, and paying as little as possible.

Is it worth it??

Protect yourself. Use a VPN.

Does Everyone Have State Secrets On Their Phone?

[zenlessyank]

Geez. I think folks are getting a little too big for their britches. Who gives a shit about an erasable phone? If you are that afraid to surf some wireless signals then turn the damn thing off. This sort of shows that a lot of people don't care and they shouldn't care.

Reasonable experiment shows hyperbolic conclusion

[Anonymous Coward]

Researchers looking at a superficial behavior decide that it is indicative of a deeper innate human property, despite calling themselves Behaviorists. News at 11.

Hacking WiFi

[Nastee]

Would be news for nerds and something that matters.

Ok, You identified the OS

[Anonymous Coward]

What is the percentage of users compromised? I would love to connect to any network and remain completely anonymous. My motto is "Anonymous Coward for life!". How many are actually being compromised? I am absolutely sure anyone with a smartphone can setup a rogue access point. Probably even DNS spoof. How many users is this happening to? Its like saying someone lied, or someone stole the car I left the key in. Do you want to educate people? What is the end game? People are always going to take advantage of people. I want to foil their attempts where possible, but I do not want to live in an Orwellian society.

Re: Are people connecting to any free wifi hotspot

[Anonymous Coward]

I do not know a single person who does not have a data connection. As soon as I leave me house, wifi gets turned off. If I bring my tablet I can tether it to my phone. The last time I tried a free wifi hotspot it was like dial up on aol. Shit actually. VPN's are not trustworthy imo either.

how to force OS to not send data before vpn link?

[Anonymous Coward]

I agree that using a VPN is the top when travelling and using public wifi networks, but as far as I know every phone (android, at least) starts sending some data (email check, push messages check, etc) just as the wifi connection is estabilished, while the VPN is connecting.

Is there a mobile OS that has an option to not send data on wifi until a vpn link is estabilished?
Or, better, a mobile OS that considers itself to be connected only after a VPN link is activated and not considers itself online when connected to a wifi.

Thank you

VPN Difficulties

[brunes69]

You know, I see constantly people advising that you use a VPN when connecting with pubic wifi, without anyone ever acknowledging the difficulty of this problem.

You see, between when I click "Connect" on the public wifi click-through, and when I have time to connect my VPN client, probably 50 different applications on either my laptop or my mobile phone HAVE ALREADY likely detected a positive connection and reached out to the internet. Any or all of these connections could already be compromised, BEFORE I can even get my VPN connected.

Until OS vendors like Microsoft, Apple, and Google recognize this problem and allow you to create a rule like "Never connect to non-local addresses over a route that traverses unencrypted wifi", this will continue to be a problem. I wish more people were discussing it, because I see no solution in sight. The closest thing to a solution is with Android you can use Tasker to automate connecting your VPN as soon as it can see the VPN server, but even at this point, at best it's a race against all the other processes on your phone firing up as well.

Re:VPN Difficulties

[Anonymous Coward]

when I have time to connect my VPN client, probably 50 different applications on either my laptop or my mobile phone HAVE ALREADY likely detected a positive connection and reached out to the internet.

Some VPN vendors offer an "internet kill switch" to mitigate such concerns. I agree with you OS's should do a better job than this - but there are VPN clients out there which can help. I've been fairly happy with PureVPN for personal VPN usage. Work usage - no choice of which VPN client to use - setup a secure tunnel to another system where I know/control the key and do all work on that other system.

Re:VPN Difficulties

[AmiMoJo]

On Windows you just configure the firewall to block all apps from accessing the wifi (only allow connections to the VPN's TAP connection), except for a browser you keep installed specially just to access the wifi login page.

Presumably the same thing would work on Linux. On Android you can do it if you have root and install something like iptables for your firewall.

Re:VPN Difficulties

[Daniel Boisvert]

I use Cloak on iOS, and it supports this functionality. I configure it to allow unencrypted traffic on specific trusted networks, and the VPN auto-connects on any network that I haven't approved, blocking other traffic until the VPN comes up. It seems to use the enterprise features Apple has provided to do this via a VPN profile, and it works very well. I have no idea what features it supports on Android and/or Windows Phones, but I'm very happy with it on Apple devices.

Re:VPN Difficulties

[crtreece]

I use openVPN Connect on Android, and it has a setting where it takes control of all network connections, and blocks traffic when the VPN connection is not up.

Re:VPN Difficulties

[smellsofbikes]

You know, I see constantly people advising that you use a VPN when connecting with pubic wifi,

The last time I tried this, she slapped me.

Re:VPN Difficulties

[brunes69]

RIght, I know about this option. But since you likely do not want to use VPN when not on unencrypted wifi - because it eats CPU for breakfast - this is still not the answer.

Re:VPN Difficulties

[crtreece]

all VPN, all the time. Even at home, and the wifi is managed by me, I still don't want my ISP tracking me or injecting ads/whatever into the data stream.

Windows Phone does this automatically

[Gumbercules!!]

I once (recently) had a Windows Phone for work - recently enough to be on the beta of Windows Phone 10 (as in in the last 3 months). It automatically connects to any WIFI hotspot, if Wifi is enabled and it's as annoying as hell. Windows Phone 8.1 and 10 both do it.

So I would be in a shopping centre and my phone would auto connect to the wifi (which was of course open but without internet unless you punch in some code you get on your receipt when you buy something). I'd then try to check my mail and find it wouldn't connect - then remember about the stupid autoconnect and turn off my wifi. Then I'd go back to the office and realise after a day or so that my wifi was still off.

So I imagine a good number of these travellers were on Windows Phone and didn't even notice they'd connected to the wifi. Not a huge number because... you know.. Windows Phone.. but still, airports have business travellers and Windows Phone pretty much only exists in businesses, so at least some of them.

considering that

[dimko]

most of the traffic these days is encrypted, how does it matter? I would connect to network called - "we_h4x0r_ya", since my traffic can't be man in the middle anyway using SSL certs. So point of experiment is?

Funny they chose an airport...

[xenobyte]

Some airports have the worst wifi ever! People who are just passing through won't connect to roaming data services which are beyond expensive but will look for a working wifi anywhere. Passed through Toronto Pearson Airport late January 2016: Possibly the worst wifi ever. Hard to connect, frequent drops, basically no actual network connection. I was basically looking for *anything* to get connected and would most likely have jumped on any open network...

Pretty much

[Sycraft-fu]

When I'm traveling, I always connect to public WiFi in the airport. It is usually pretty easy to tell which is the "official" airport one but whatever. I just fire up my VPN and go about my business. I know it isn't encrypted, isn't secured, etc. However getting things encrypted is cheap and easy as you say.

Re:Pretty much

[bobbied]

Heck, I just do that no matter what WiFi I'm connected to out of habit. Even at the in-laws house where I'm the designated network administrator (the guy who configures the router and gets called when something breaks) I use the VPN to home for all my network traffic. About the only time I don't use VPN is when I'm at home and need to use the printer...

Re:Pretty much

[Anonymous Coward]

It is usually pretty easy to tell which is the "official" airport one but whatever.

It is just as easy to mimic the official airport WiFi.

BOAonline.com, WellsFargoBank.com, Wellfargo.com,

[raymorris]

Victim types BOA.com into their browser. They see the BOA page, and if they bother to look they'll see the secure icon.

If they bother to look back at the address bar again, they'll see bankofamerica.net, BOAonline.com, or BOAbank.com.

Most people won't notice a problem. If some people notice, so what? The bad guy doesn't have to steal from EVERYBODY, just from SOMEBODY.

Not just airports, but planes too...

[TheDocOz]

Nothing new here. I did a similar experiment a year or so back, but instead of an airport, it was on an plane. A surprising (or not!) number of people were happy to give up their details including credit card numbers to sign onto a completely fake wifi network...

The fascination with proving ignorance.

[geekmux]

So, a security company that makes a living creating software to protect the stupid and ignorant from the dangers of the internet, somehow needs to perform yet another test to prove just how stupid and ignorant consumers are about security.

Sorry, but it doesn't matter if it's political or technical. I grow very tired of pointless surveys proving how stupid consumers can be. It's pointless because consumers don't care. That's not going to change, and we have the statistics to prove it.

Consumers are ignorant about security. That fact hasn't changed for the last 50 years, and it's not going to change in the next 50 years. Stop trying to prove or disprove it already. If you want to be entertained by stupid people that badly, turn on reality TV.

Google VPN

[FictionPimp]

I use Project FI, and on my Nexus phone google already automatically VPNs my data when using public wifi. So the only monster with my data is the same monster I already trust with my data, google.

Re:Google VPN

[Anonymous Coward]

I use Project FI, and on my Nexus phone google already automatically VPNs my data when using public wifi.

Perhaps this explains the reason Google broke VPN functionality on Android 4.4 and refuses to fix it.

obv dept

[Anonymous Coward]

duh

there is no safe wifi

[Anonymous Coward]

Even if the wifi is legit who says it's safe? Any number official and unofficial persons can be listening in. The only save way is to use end-to-end encryption (like https for browsing) and then who cares how sage the wifi is. It either works or not.

Why would that be a reckless behaviour?

[Afty0r]

If I want my packets sending to other hosts on the internet, I connect to wifi to do it. Or my ISP. Or my friends ISP. Or my works network. They're just packets being routed - if people are sending *sensitive* packets IN THE CLEAR on anybody's network - including their own internet connection at home or at work - then that is the problem. Not the network, which you shouldn't trust anyway.

Re:Why would that be a reckless behaviour?

[evolutionary]

Yep, that's the Microsoft I know. Just like the default options in IIS 4.0 or "Option explicit"(not being turned on) in VB: worst defaults ever. Gotta love convenience at the price of security. Go get em, MS. You Rock! (inversely)

when something is free, people will flock

[Anonymous Coward]

Once in an airport during a relatively short connection, I had the need to access my company's VPN on my Windows laptop, could not do it on the phone's browser. My phone was 4G capable but I had not set it up for tethering. In a pinch, I downloaded a free tethering app and connected with my laptop. Did not take the time to setup a password as my flight was boarding by then and I was just going to be connected for a minute. By the time I was done, there were 4 people connected through my phone. In total, less than 5 minutes had elapsed.

I will connect too

[m76]

I have no sensitive information stored on my laptop. So they can hack all they want, worst case I reinstall.

Re:I will connect too

[Anonymous Coward]

I've got news for you... A rootkit isn't going to be removed by reinstalling Windows. Worse yet... It could phuck up your bios.

Windows 10...

[Anonymous Coward]

IIRC, Win 10 asks you if you want to automatically connect to free WIFI spots in the setup screens.

Re:Windows 10...

[bobbied]

Just say "NO!" .... To Windows....

Unless you insist on running Windows 10, then just say "No" to the dialog during the setup..

Just in case it's lost on somebody, I'm making a joke....

Re: Are people connecting to any free wifi hotspot

[rickb928]

Just how I do it.

I wander by several open or semi-open WiFi hotspots daily, and having my phone latch onto one, wait for me to sign on, and fail to get email, texts (yes, texts), etc until it figures out I am gone is not just annoying, it is a failure mode. My carrier hates me for this, and tries to force WiFi on by various means. I average 10-12GB mobile data, and use my mobile hot spot for my tablet when I'm in marginal WiFi signal areas, which is most of the time.

WiFi hotspots can be a serious pain - for me, not worth the trouble.

What's the difference

[Anonymous Coward]

Sure, I don't know who or what is running the WiFi where I connect but I don't know who runs each router on the path between me and my bank either. Why is trusting a random WiFi access point any different than trusting all the random routers my traffic crosses? Does Avast have a product they're hoping to sell that miraculously protects users from malicious WiFI APs? I can't think of any other reason for this "study."

Re:What's the difference

[oh_my_080980980]

Yup: "...people should utilize a VPN service that anonymizes their data while connecting to public hotspots to ensure that their connection is secure. Avast SecureLine VPN for Android and iOS devices encrypts connections on unsecured public Wi-Fi and allows users to browse anonymously. " https://press.avast.com/en-us/...

People trust airports. So live up to the trust.

[eepok]

They trust that the airport is on the job-- just like they are when they purchase a ticket, check their luggage, go through screening, sleep in the terminal, and eventually board the plane. An airport is an extremely safe place.

So if the concern is that people are risking their digital health by connecting to bad Wi-Fi spots, there's an easy 4-step solution:

1) Provide free Wi-Fi. Most airports do this.

2) Require all Wi-Fi spots to follow a specific naming system. (LAX-Terminal17). Provide the warning throughout the airport that if you're connected to a Wi-Fi hotspot and you can't see the terminal or business from where you are, you may have connected to a hotspot attempting to exploit the demand for free Wi-Fi. 3) Forbid all non-airport-supported open Wi-Fi hotspots.

4) Download a wardriving app for Android and get to sniffing out bad Wi-Fi hotspots.

Then brag about it. Seriously. "We at Slashdot International Airport care about your personal safety and the safety of your private information. We implemented a system that finds malicious Wi-Fi hotspots and punishes their creators. We have found and stopped X hotspots already. We would like to remind you that Slashdot Airport provides multiple secure and reliable hotspots throughout the airport labeled per their areas. If you connect to a hotspot whose area you're not in, your data may be at risk."

Then apply for awards. Seriously. "And the winner of the Mobile Data Best Practices Award is... "

What android VPN client would people recommend?

[SkunkPussy]

Free would be nice, open source even nicer.

Maybe more exploit ?

[DrYak]

list of websites i access and my http data?

Which by the way, if using HTTPS (either because explicitly type it, or because you use a plug-in like HTTPS everywhere) is quite limited. From the outside you only see connection to *IP* address (to the front load-balancing/reverse proxy server, or to the apache server hosting all the virtual domains if that one is straight facing internet). The actual URL (server's full name, and document) is only asked once the encryption is established. (That's why you need stuff like SSL's SNI extension, so the server can hand out the correct certificate corresponding to the peculiar virtual server you want to visit).

so what could they have possibly gained by this devious man in the middle circus?

Indeed, intercepting data isn't probably the main goal. Even back since FireSheep, the security of internet websites has been getting better. Not that the end users care much (I think I remember an article on /. back then that lots of "victims" were amused but didn't really grasp the implication), but the companies have reacted a made HTTPS at least an option if not the main access point.

The risk might comes from the network it self: a public network is an ideal place for an hostile to perform network scan, looking for vulnerable services or even vulnerable network stack component to exploit.
A public Wifi network might not be handing out public IPs/might be NATed/might not be accessibly routed from the internet - thus the various device connected to it might not be scannable from the internet at large.
But from within the network it would be possible to perform a scan (brute force the SSH port of unix-running laptops*), including looking for services which aren't normally routed (like SMB network shares, Zeroconf)

Note that, regarding such a risk, the notoriety of the Wifi sport doesn't play such a big role.
- You might be at risk if you connect to some shady Wifi network operated by hostile.
- But you might as well be at risk if you connect to some well known "clean" public Wifi, but on which there's a rogue device connected scanning its neighborhood for vulnerabilities.

------

*: If you're fed-up with constant hammering on your SSH server - which still pollutes your logs EVEN AFTER you've switched to key-based-only logins or 2-factors, Fail2ban is your friend.

car analogy

[Anonymous Coward]

He also has a diesel truck fleet, which he fills with gasoline because that's all that he has available.

I've been aware of this for years - and worse

[Anonymous Coward]

After the first airport WIFI services began, I noticed a number of other AP's showing up. Because of the proliferation of these odd APs I've occasionally carried an older MBP set to act as a VM honeypot running either Windows XP SP2 or OSX 10.7. On various layovers and I have walked or used the airport conveyor system to roam the terminals and I've had hundreds of connections to "free" APs that start hitting all of the usual ports. The most disturbing thing is that a good many of these appear to be honeypots themselves. I have not looked into the situation closely (among other reasons: nobody is paying for my time), but I have always assumed that the APs were set-and-forget devices coupled with a burner phone to send data to untrackable recipients. I first noticed these in the 2004-5 period and assumed that the APs were created with Gumstix, or similar, embedded systems. With today's proliferation of Arudino and Raspberry Pi systems, I don't doubt that many of these APs are made with them.

I expect that a really nasty man-in-the-middle could be hidden in plain sight. I'm not naming the very nice hospitality suites available to frequent travelers or those with the proper color of credit card - but, some of those suites provide showers, nap facilities, a bar and restaurant - and it would be trivial to set up the MITM on a current, high-end laptop and just 'forget' it when leaving the suite. The folks using that facility are, literally, the gold standard for high-value data capture.

Needless to say, I never use public WIFI and when in a hotel, I have my own AP that I connect to CAT-5 cable and open a VPN before enabling my own, invisible, in-room WIFI. It's getting harder every day to find hard-wired ethernet and MITM is an ever present danger when traveling.