Hotel WiFi security

scooter100_2

Currently using hotel in Turkey for web browsing using WiFi.Can anything i do using the hotel WiFi be monitored or hacked into whilst using WiFi eg anything i log into, passwords etc.
TIA.

[Deleted User]

scooter100 wrote: »

Currently using hotel in Turkey for web browsing using WiFi.Can anything i do using the hotel WiFi be monitored or hacked into whilst using WiFi eg anything i log into, passwords etc.
TIA.

Yes, it can.

I avoid them for anything more than basic web browsing, certainly wouldn't even consider doing anything that involved logging into anything.

DCFC79

I wouldnt use the wifi to access bank accounts as you cnat be too sure of the security the hotel has or even if they have any in place, id only use it to check say the weather, check mse, check the sport news or the news

macman

If it's an open connection, yes. If you had to connect via WEP or WPA encryption, then it's reasonably secure.

Jakg

While it might be secure to the outside world, your still sending all these packets via the hotels equipment...

amcluesent

>Can anything i do using the hotel WiFi be monitored or hacked into whilst using WiFi eg anything i log into, passwords etc.<

Once you've connected to encrypted page using HTTPS/ then the data can't be sniffed by the hotel.

sharkie

If i remember correctly TOR encrypts on your end - but will decrypt somewhere else - on the final output which in itself is a theoretical hazard, but it probably much safer than you currently are.

What you are looking for is either tunnelling, or secure shell. This can be either set up on your home pc, or you could purchase an online account. While the Hotel will see you connected to the tunnel, all the traffic will be encrypted.

If you want to use your home pc as a server/storage area then a VPN tunnel is for you, just for web browsing then ssh is probably easier

http://www.ssh.com/support/documentation/online/ssh/winhelp/32/Tunneling_Explained.html
http://thedaneshproject.com/posts/ssh-tunneling-with-putty-linux/
OR pay £6.50 per month http://www.vpnuk.info/shared-ip.html

Since your PC is on the hotel network, it is also open to being hacked too, This is very popular around hotels near airports/tourist areas. All one needs to do once is put a keylogger on your PC that emails out the result, and your computer keep mailing out your ccards etc. from that day until the keylogger is finally removed - seen it done! this is often not protected by VPN's or tunnels. Also any information on your hard disk might be accessible.

JasX

macman wrote: »

If it's an open connection, yes. If you had to connect via WEP or WPA encryption, then it's reasonably secure.

To clarify 'reasonably' I believe WEP/WPA generally takes about 6-26 ish seconds for someone to hack with widely available software but they'd have to be trying. Personally I'd still be cautious.

sharkie

JasX wrote: »

To clarify 'reasonably' I believe WEP/WPA generally takes about 6-26 ish seconds for someone to hack with widely available software but they'd have to be trying. Personally I'd still be cautious.

The issue is that even if the hotel are using wep/wpa, all the punters, staff and some causal visitors know and have the same key/passphrase - which is probably the hotel name. In your home where you have your own key only known to you and possibly your household know the key/passphrase.

Without knowing the passphrase, I can 'hack' a wep link in about 20 mins - tried it on my own router which has a good few random hex digits, rather than a known word. I have not tried wpa yet as I do not know how to get in, and have little time to put that way at the moment.

timbim_2

Anything sent by https is totally secure. I know for a fact that gmail has an option for all data to be sent via https and therefore be secure and unreadable by anyone sniffing on the network.

[Deleted User]

timbim wrote: »

Anything sent by https is totally secure. I know for a fact that gmail has an option for all data to be sent via https and therefore be secure and unreadable by anyone sniffing on the network.

That's not entirely correct. While SSL encryption will generally secure your connection from most people, there are various software programs that can quite happily sit on a network and analyse everything that passes through it including the ability to decrytp SSL packets.

Obviously, the latter is rather complex to set up and run, but if you think of the demographic that will be staying in a hotel then you have people staying for no more than a few nights who'll be checking online banking and credit cards details. It'd be quite a lucrative catch with a reduced risk of being caught, if you were that way inclined.