The London underground now provides mobile connectivity. I have a gut feeling that that is more secure, but probably costly and bureaucratic.
I hear you!
I really need to let go of these self-sabotage tendencies fast!!
Ask HN: Dangers of Unsecured WiFi?
11–20 of 42 posts
Re: Ask HN: Dangers of Unsecured WiFi?
#12unless you accepted an invalid https certified popup, its not possible, even on public wifi. or maybe you still type: http:// instead of https:// , and then is easy to fake a dns response to point to a clone site
Thanks, that makes me feel a little better because I did use the https bookmark I had and didn’t type in the addr.
Re: Ask HN: Dangers of Unsecured WiFi?
#13unless you accepted an invalid https certified popup, its not possible, even on public wifi. or maybe you still type: http:// instead of https:// , and then is easy to fake a dns response to point to a clone site
Ironically because MITM attacks for corporate security are that common, a lot of developer tools are configured to just ignore TLS checks instead of importing the correct root certificate. In case of an unsecured WiFi connection this is of course much more dangerous even.
Wow! Didn’t know this!
I would’ve thought they would let devs handle it because if anything they’re more capable of these kinds of things (not counting myself ofc :-))
Re: Ask HN: Dangers of Unsecured WiFi?
#14Earlier quoted context omitted.
Ironically because MITM attacks for corporate security are that common, a lot of developer tools are configured to just ignore TLS checks instead of importing the correct root certificate. In case of an unsecured WiFi connection this is of course much more dangerous even.
Wow! Didn’t know this! I would’ve thought they would let devs handle it because if anything they’re more capable of these kinds of things (not counting myself ofc :-))
I think developers are especially at risk, because we all think we know the risks and can manage them better... yeah, right lol.
It's like how doctors and nurses are notoriously bad at getting their own health checkups. They're experts, they know better!
Pfft. How many of us actually spend time (and have the knowledge for) auditing the security of our OS, cert chains, HTTPS setup, etc.? I've seen experienced senior devs share private keys over Slack for the whole team to reuse, manually disable HTTPS checks with a comment like "too much trouble", etc. It's pretty scary.
Re: Ask HN: Dangers of Unsecured WiFi?
#15[My works-on-my-machine]
By default, I tether my phone. In the places that's not possible, the public WiFi is typically part of large scale infrastructure like an airport.
The biggest practical advantage of tethering is not security. It's repeatability. Sure security matters and I trust my phone's security. But not having to navigate other people's ideas of internet access is why I tether.
Good luck.
Re: Ask HN: Dangers of Unsecured WiFi?
#16[deleted]
Re: Ask HN: Dangers of Unsecured WiFi?
#17Earlier quoted context omitted.
Wow! Didn’t know this! I would’ve thought they would let devs handle it because if anything they’re more capable of these kinds of things (not counting myself ofc :-))
I think developers are especially at risk, because we all think we know the risks and can manage them better... yeah, right lol. It's like how doctors and nurses are notoriously bad at getting their own health checkups. They're experts, they know better! Pfft. How many of us actually spend time (and have the knowledge for) auditing the security of our OS, cert chains, HTTPS setup, etc.? I've seen experienced senior d…
That does sound very familiar!
Re: Ask HN: Dangers of Unsecured WiFi?
#18[My works-on-my-machine] By default, I tether my phone. In the places that's not possible, the public WiFi is typically part of large scale infrastructure like an airport. The biggest practical advantage of tethering is not security. It's repeatability. Sure security matters and I trust my phone's security. But not having to navigate other people's ideas of internet access is why I tether. Good luck.
Thanks, makes sense!
Re: Ask HN: Dangers of Unsecured WiFi?
#19Hmm, my father in law refuses to use WiFi outside his house, afraid of them hackers, since he has no mobile internet he is often off line for long periods.
I always tell him he is being paranoid, because every app, especially the ones het finds important (like banking) encrypt their traffic. So who cares if the WiFi layer is encrypted or not.
For the people that do use WiFi away from home: It's easy to create an access-point that is malicious and has wpa2. Also, wpa2 isn't that great anymore, right?
I could tell him to just use a (trustworthy) free vpn (ie protonvpn, or just pay for mullvad) if he really needs to connect. That would take care of his concerns.
Am I wrong?
Re: Ask HN: Dangers of Unsecured WiFi?
#20unless you accepted an invalid https certified popup, its not possible, even on public wifi. or maybe you still type: http:// instead of https:// , and then is easy to fake a dns response to point to a clone site
[deleted]