free wi fi hotspots and vpn

mrs_baggins

should I be worried about using free wireless hotspots? I vaguely understand (v vagely) and that by using these potentially any local hacker can look at my emails (which would be v boring ) and personal data.

I dont really understand what the hackers do and i think its beyond me but is the reality of it happening a likely?

also I was looking at VPN networks to use in these hotspots and they start from about £5 a month. From an individuals point of view who doesnt use social network is this sort of thing overkill?

Fightsback

It's not overkill at all, it's good security practice.

patman99

With a VPN (even the free ones), the data is fully-encrypted from PC to PC, so cannot be easily viewed by a hacker.

Babbawah

The reality of it happening is VERY real and you should assume that whenever you're connected on a free WiFi then at least 1 person is monitoring EVERY keystroke.

[Deleted User]

I don't use free wifi hotspots.

I carry my own wifi hotspot with me.

securityguy

Conversely, at a recent event I attended where most of the attendees were government, academic and industry cyber security researchers, no-one had the slightest hesitation in using the hotel WiFi.

No-one has ever presented a mechanism for the alleged "free wifi intercepting all your keystrokes" which doesn't rely on one or both of a very stupid user or a very, very badly configured (and usually obsolete) laptop. Simply controlling the access point just isn't enough.

If you're sufficiently negligent that you would be vulnerable when using a free WiFi, you're vulnerable anywhere. I'm perfectly happy to work, do banking and generally live my online life when using free WiFi, and I've never met a serious security researcher who disagrees. I do occasionally use a VPN, but mostly to bypass ludicrous content restrictions on wireless networks on trains. On the other hand "Free WiFi is really dangerous" is a standard meme on places like MSE. I wonder which group of people is more likely to know what they're talking about?

I_have_spoken

From an individuals point of view who doesnt use social network is this sort of thing overkill?

Yes .

Fightsback

I_have_spoken wrote: »

Yes .

Want to get pineappled ?

http://www.flashrouters.com/blog/2011/05/19/the-dangers-of-the-pineapple-using-public-wi-fi-connections/

Babbawah

securityguy wrote: »

Conversely, at a recent event I attended where most of the attendees were government, academic and industry cyber security researchers, no-one had the slightest hesitation in using the hotel WiFi.

No-one has ever presented a mechanism for the alleged "free wifi intercepting all your keystrokes" which doesn't rely on one or both of a very stupid user or a very, very badly configured (and usually obsolete) laptop. Simply controlling the access point just isn't enough.

If you're sufficiently negligent that you would be vulnerable when using a free WiFi, you're vulnerable anywhere. I'm perfectly happy to work, do banking and generally live my online life when using free WiFi, and I've never met a serious security researcher who disagrees. I do occasionally use a VPN, but mostly to bypass ludicrous content restrictions on wireless networks on trains. On the other hand "Free WiFi is really dangerous" is a standard meme on places like MSE. I wonder which group of people is more likely to know what they're talking about?

I know what I'm talking about m8y.

I soldered up my Z80 after badgering me dad to pay for it. I also spent many an hour in the first internet cafe' within a 100 mile radius of home . . . simply 'cos I couln't persuade me dad to pay the astronomical fee to connect from home.

I also made the presentation to the board of directors of a company called DSG Ltd that gave birth to an ISP called "Freeserve".

I went on to create many more wonderfull things, many of which you could never comprehend.

This all stemmed from the imagination of a 6yr old !

If I were a black hat, I'd hack the WiFi of your imaginary seminar . . . and cancel all of your hotel reservations, your CC's as well as your planned method of getting home. Moby's are soo easy to hack that I'm gobsmacked that you even mentioned them.

Confidence in using the hotels WiFi would be the last of your worries.

That is if I were a black hat . . . . but wait, perhaps my white hat can find just cause in seriously screwing up your day, even if only to make a point !

RobTang

Babbawah wrote: »

I know what I'm talking about m8y.

I soldered up my Z80 after badgering me dad to pay for it. I also spent many an hour in the first internet cafe' within a 100 mile radius of home . . . simply 'cos I couln't persuade me dad to pay the astronomical fee to connect from home.

I also made the presentation to the board of directors of a company called DSG Ltd that gave birth to an ISP called "Freeserve".

I went on to create many more wonderfull things, many of which you could never comprehend.

This all stemmed from the imagination of a 6yr old !

If I were a black hat, I'd hack the WiFi of your imaginary seminar . . . and cancel all of your hotel reservations, your CC's as well as your planned method of getting home. Moby's are soo easy to hack that I'm gobsmacked that you even mentioned them.

Confidence in using the hotels WiFi would be the last of your worries.

That is if I were a black hat . . . . but wait, perhaps my white hat can find just cause in seriously screwing up your day, even if only to make a point !

The problem with giving the example of key logging over wifi, is that is extremely unlikely even then you need some stupidity and you just using it to scare, its like saying if you go into the woods you'll might get attacked by a bear (in the UK is just not going to happen).


Where as there are plenty of risks associated with using untrusted wifi, which are just as scary and are much more likely that people should be aware of but ob cant really be condensed into a pretty sentence.


As for VPNs unless you or a fully trusted company is running that VPN server you are at the same severity of risk as with the wifi network, except your exposure is just to the VPN company and not everyone that runs a wifi hotspot ie both can intercept your unsecured traffic.

patman99

Securityguy, there are huge risks taken when using open non-secure public WiFi hotspots & I would like to hazard a guess that a large number of those attending that conference would have been savvy-enough to be using VPN to connect to the www.

I ussed to work in QC for a major multi-national & my line manager used to work from home during the evenings using a works laptop. This used a VPN to connect at all times, as this was the company policy.

At a guess, I'd say most businesses will have the same sort of policy in place. After all, it would be embarassing for the company secrets to be made public.

Also, a lot of hotels and conference centres have invested in leak-proofing rooms, or, indead, the whole building in order to stop the WiFi signal going beyond the walls. This is done to stop people not using the facility from using the WiFi.