Slashdot Mirror
Using Airport and Hotel Wi-Fi Is Much Safer Than It Used To Be (wired.com)
As you travel this holiday season, bouncing from airport to airplane to hotel, you'll likely find yourself facing a familiar quandary: Do I really trust this random public Wi-Fi network? As recently as a couple of years ago, the answer was almost certainly a resounding no. But in the year of our lord 2018? Friend, go for it. Wired: This advice comes with plenty of qualifiers. If you're planning to commit crimes online at the Holiday Inn Express, or to visit websites that you'd rather people not know you frequented, you need to take precautionary steps that we'll get to in a minute. Likewise, if you're a high-value target of a sophisticated nation state, stay off of public Wi-Fi at all costs. But for the rest of us? You're probably OK. That's not because hotel and airport Wi-Fi networks have necessarily gotten that much more secure. The web itself has.
"A lot of the former risks, the reasons we used to warn people, those things are gone now," says Chet Wisniewski, principle researcher at security firm Sophos. "It used to be because almost nothing on the internet was encrypted. You could sit there and sniff everything. Or someone could set up a rogue access point and pretend to be Hilton, and then you would connect to them instead of the hotel." In those Wild West days, in other words, signing onto a shared Wi-Fi network exposed you to myriad attacks, from hackers tracking your every move online, to so-called man-in-the-middle efforts that tricked you into entering your passwords, credit card information, or more on phony websites. A cheap, easy to use device called a Wi-Fi Pineapple makes those attacks simple to pull off. All of that's still technically possible. But a critical internet evolution has made those efforts much less effective: the advent of HTTPS.
"A lot of the former risks, the reasons we used to warn people, those things are gone now," says Chet Wisniewski, principle researcher at security firm Sophos. "It used to be because almost nothing on the internet was encrypted. You could sit there and sniff everything. Or someone could set up a rogue access point and pretend to be Hilton, and then you would connect to them instead of the hotel." In those Wild West days, in other words, signing onto a shared Wi-Fi network exposed you to myriad attacks, from hackers tracking your every move online, to so-called man-in-the-middle efforts that tricked you into entering your passwords, credit card information, or more on phony websites. A cheap, easy to use device called a Wi-Fi Pineapple makes those attacks simple to pull off. All of that's still technically possible. But a critical internet evolution has made those efforts much less effective: the advent of HTTPS.
Glad we have that covered - just canâ(TM)t happen according to Sopos.
It comes with laptop maintenance, even if you don't ask for it.
-- Tigger warning: This post may contain tiggers! --
We're all happy for you.
I always thought the intention of free public wifi was to enable crime and create plausible deniability.
How should I connect to motherless for my daily dose of bestiality?
So I can use my credit card on public wifi again? Yay! I feel so free now that some stranger has said I shouldn't worry anymore!
Thanks for looking out for me internet man!
Awesome. Wired is a blank screen when I click on it.
For anything important (let's say anything involving money, and even Facebook), https has been the norm for 8, maybe as many as 10 years. Before that, it wasn't terribly common, and wifi leaked everywhere. Sites like Slashdot didn't encrypt, or encrypted only credentials, so you could get clever tricks like ssl strip... but so what? Let the mast0|r H@k0|~ steal your slashdot credentials... so what?
2 years ago there were a lot of not so important websites that you could snarf information from. Let's say newspapers, or advertising sites. Are you really concerned about that? Oh no someone knows what article I read on NYT, or knows the movie i looked up on IMDB!
The problem with security people is they don't understand priorities, and real risks. They think EVERYTHING needs to be secure, and aren't familiar with tradeoffs. Is it better that almost everything uses https now? Of course. But don't over sell it. I'm not really terribly concerned that Wired didn't encrypt my traffic in 2016, and neither is anyone else. My Bank or Financial site however, better be air tight. (And many times it's TERRIBLE)
Still don't trust public WiFi no matter how good the security of websites have become. And why should I trust it? There's no reason to. I can either tether to my phone or use the hotel WiFi. Cost to me is about the same. I'll use my phone unless I am in a foreign country and the WiFi is faster than my cellular data. But no matter where I am I always VPN to a "secure network" and use remote desktop to surf the web on a machine on that "trusted network." There's no need to trust someone else's network. Though once it leaves my LAN it ends up in an untrusted network regardless.
...who says, "my site only has recipes on it! Why do I need HTTPS?"
It's not about you. It was never about you.
People who care switch on their VPN if it's isn't already on by default and the other get spied on by even more people than usual.
A VPN costs about 5$month for usually 5 machines concurrently (PCs, cellphones, tablets...)
It is very easy to set up a hotspot with a convincing name, that people will connect to. Do anything unencrypted in such a connection at your own peril.
American and British Spy Agencies Targeted in-flight Mobile Phone Use (Dec 7 2016) https://theintercept.com/2016/... .
Southwinds, Thieving Magpie and Homing Pigeon
Canada had the wifi part covered.
Domestic spying is now "Benign Information Gathering"
Who issues your trusted domain's HTTPS certificate? HTTPS is epic fail.
https://news.netcraft.com/archives/2014/02/12/fake-ssl-certificates-deployed-across-the-internet.html
If I use a public WiFi, the very first thing I do is start a VPN connection up. ( My own server at home )
If the WiFi disallows it, I disconnect.
Easy.
Of course in my case it's because I tether via phone instead of using airport or hotel WiFi.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Msmash, by your comments and the fact that your passing this as safe, if I get hacked this season, are you willing to take the liability?
And if not for me, anyone else?
So HTTPS is a new thing now?
Seriously, 2000, you can stop now.
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
"A lot of the former risks, the reasons we used to warn people, those things are gone now,"
What the fuck is this idiot smoking? Did he check week old news about pwn2own exploiting phones via captive portal page? HTTPS my ass.
"so-called man-in-the-middle efforts that tricked you into entering your passwords"
What...?
What the...?
No. Just, no.
can you litterly see the crap as it falls from your mouth?
msMash, you are doing this community a disservice now..
you are promoting methods that are severely compromised.
Your conveyance of this info is flawed to a HUGE degree. /. are you willing to take responsibility and or liability for the crap that falls outta her mouth??
Your lacking in the context of your own articles, seems to know no bounds..
The fact that your willing to promote an activity by people in your community that is fundamentally flawed exposes your lacking of understanding of the situation and how to promote a leadership role to resolve it, not to mention the liability carried by said comments..
Really is she that worth it?
I am also reminded of a Sketch or Skit from the OLD saturdaynight live Crew Dan Akaroid and Jayne Curtain.
Point/Counterpoint on the News segment in the middle of the show. I wont sink to the level and go through the description, but is is on youtube.
Perhaps those whom decide to check it out for themselves could possibly draw the parallels, connect the Dots, and come to their own INFORMED conclusion..
No it hasn't, if your “computer” can still be compromised by opening an email or clicking on a weblink.
This just makes me wish there were more ways to get premium WiFi access. I waited on hold so long I went over my plan and the hold music stopped and I was prompted to get another plan. So now I have no plan and I pay roaming fees whenever I make a call. But then I saw a new all access plan from Verizon that comes with the iPhone SXY with the new AI smart logic so I am in line right now. The only problem is I have to pay these kids to go get me food across the street at the cart vendor.
Someday I will take my new phone to a Chinese factory and I will learn to make a case for it an extra special case with little soarkles and stripes. But now I am roaming again so I must stop posting
Who wanted to mitm DNS, inject ads, and throttle random protocols? Hint; not the people who live and die by actual reviews of the quality of their service.
That is, given appropriate safety measures, like using secure shell or a VPN tunnel. You cannot and never could trust the network.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Done correctly, it should not be necessary to trust intermediate third parties, in order to have a secure connection. Who knows who is carrying your packets between here and Romania! Who even knows if your packets are going through Romania, on their way to Texas! This is the nature of the internet.
Make it possible to establish a secure connection between two parties, and it doesn't matter whether you are using Joe Shmo's cell phone hotspot with an SSID of Denver International WiFi.
A lot of corporate laptops leak information when connected to other networks, they try to connect to various internal resources and in doing so disclose either the ip addresses or the dns names.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Except at work of course where they use Bluecoat, Redcloak and Cylance to decrypt https with impunity. Workers rights zero as usual
|[]|
|[]|
|[]|
|[]| flashing in middle of frame
I think the report misses the point. It's a bit like saying because more people are getting the flu shot these days, we don't need to wash our hands as much. The opportunity for attack over a public network has only increased. Sure HTTPS has reduced a subset, but it is far from an absolute cure-all. The folks most likely to trust a public access point are also the people most likely to ignore a certificate error for example. WPA2-PSK was designed to be used in a trusted environment (i.e. a home network). It was not designed where strangers would share the same the network - as it is done in every coffee shop, conference, etc. Off the bat, the moment you are on a shared network, you expose your device to scanning and attack. More you cannot know whether you have connected to a real access point or an attacker's laptop - unless you are talking certain WPA2-Enterprise options, there is no mutual authentication. Even when seeming to use HTTPS, there can be plenty of non-HTTPS packets/data that will leak. Further HTTPS is not like a VPN encrypting all network traffic. It just handles a specific browser-to-server subset. Yes, on one hand things are better, but on the other, WiFi is so much more prevalent today - we have WiFi enabled diapers for cripes sake - that the overall vulnerability of the average wireless user has only increased.
I used to travel 9 months out of the year and stayed in motels continuously. I remember many times when first connecting to motel wifi system, a message would popup saying that I needed to install some software to use it. I was always suspicious of that and never did. Just after canceling the requirement request, I would be connected to the wifi system anyway. This fake software install requirement ended up being a worm that had been installed on many motel wifi computers.