Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Dangers of Unsecured WiFi?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 42 posts

Re: Ask HN: Dangers of Unsecured WiFi?

#21

Post by frogsRnice »

teekert wrote: post #19

Hmm, my father in law refuses to use WiFi outside his house, afraid of them hackers, since he has no mobile internet he is often off line for long periods. I always tell him he is being paranoid, because every app, especially the ones het finds important (like banking) encrypt their traffic. So who cares if the WiFi layer is encrypted or not. For the people that do use WiFi away from home: It's easy to create an acce…

There have been cases of applications not performing chain validation - see the paper Spinner: semi automatic detection of pinning without hostname verification (in particular page 8)

While it may be paranoid, there are still risks involved with connecting a device to an untrusted network

Re: Ask HN: Dangers of Unsecured WiFi?

#22

Post by globular-toast »

Appsmith wrote: post #13
raxxorraxor wrote: post #5

Earlier quoted context omitted.

Ironically because MITM attacks for corporate security are that common, a lot of developer tools are configured to just ignore TLS checks instead of importing the correct root certificate. In case of an unsecured WiFi connection this is of course much more dangerous even.

Wow! Didn’t know this! I would’ve thought they would let devs handle it because if anything they’re more capable of these kinds of things (not counting myself ofc :-))

There are whole swathes of developers these days who don't even know what a network stack is, much less understand how HTTPS works. I expect these people were gumming up the bug trackers so they dumbed down the dev tools.

Fwiw, though, when I used Python behind a corporate proxy some 5-6 years ago nothing was configured to ignore the HTTPS warnings.

Re: Ask HN: Dangers of Unsecured WiFi?

#23

Post by bugtodiffer »

frogsRnice wrote: post #21
teekert wrote: post #19

Hmm, my father in law refuses to use WiFi outside his house, afraid of them hackers, since he has no mobile internet he is often off line for long periods. I always tell him he is being paranoid, because every app, especially the ones het finds important (like banking) encrypt their traffic. So who cares if the WiFi layer is encrypted or not. For the people that do use WiFi away from home: It's easy to create an acce…

There have been cases of applications not performing chain validation - see the paper Spinner: semi automatic detection of pinning without hostname verification (in particular page 8) While it may be paranoid, there are still risks involved with connecting a device to an untrusted network

There have been cases? I see this kind of stuff all the time. I once saw an app that had a popup warning me that the TLS cert is wrong but still let me connect...

Re: Ask HN: Dangers of Unsecured WiFi?

#25

Post by jesseendahl »

Appsmith wrote: post #9
cssanchez wrote: post #7

There is a CVE issued a week ago for all Apple OSs that are not on the latest update (Mac iOS, etc). Maybe you were affected. https://www.cisa.gov/news-events/alerts/2024/09/18/apple-rel...

Thank you! Yes I’m still 2 OS versions back.

You are living very dangerously and running 2 whole major versions back. The only Apple Operating Systems (macOS, iOS, etc.) that have both the latest Platform Security features and get 100% of security patches is the very latest version.

This is well known within both the security community and Mac Sys Admin community.

Re: Ask HN: Dangers of Unsecured WiFi?

#26

Post by rerdavies »

solardev wrote: post #14
Appsmith wrote: post #13

Earlier quoted context omitted.

Wow! Didn’t know this! I would’ve thought they would let devs handle it because if anything they’re more capable of these kinds of things (not counting myself ofc :-))

I think developers are especially at risk, because we all think we know the risks and can manage them better... yeah, right lol. It's like how doctors and nurses are notoriously bad at getting their own health checkups. They're experts, they know better! Pfft. How many of us actually spend time (and have the knowledge for) auditing the security of our OS, cert chains, HTTPS setup, etc.? I've seen experienced senior d…

I was amused by a prompt I received from Android Studio, requesting permissions to turn off anti-virus scanning for development directories. Which, of course, speeds up compile time dramatically (4 or 5x faster? A seriously non-trivial amount). Development directories, and SDK directories (including SDK binaries).

No more anti-virus protection for the directories that you as a developer should be most concerned about. What could possibly go wrong?

I'd be more concerned if I hadn't already done that, I suppose. Because compiles run so much faster when you do. But I was amused, nonetheless. :-/

Re: Ask HN: Dangers of Unsecured WiFi?

#27

Post by oulipo »

BTW always wondered... often docs show that a wifi with a password uses encryption, and wifi without password are not encrypted, I'm wondering why that is?

Is it for backward compatibility with old devices?

Why isn't the standard that when connecting to a wifi without password, everything would be just like if there was a (fake) "public password" like the string "password", so that traffic is still encrypted?

Re: Ask HN: Dangers of Unsecured WiFi?

#28

Post by frogsRnice »

bugtodiffer wrote: post #23
frogsRnice wrote: post #21

Earlier quoted context omitted.

There have been cases of applications not performing chain validation - see the paper Spinner: semi automatic detection of pinning without hostname verification (in particular page 8) While it may be paranoid, there are still risks involved with connecting a device to an untrusted network

There have been cases? I see this kind of stuff all the time. I once saw an app that had a popup warning me that the TLS cert is wrong but still let me connect...

Haha thats terrifying! I was just trying to point out that assuming that apps do this correctly is a bad idea; but my experience echoes yours, its a common mistake - even just browsing stack overflow people give some pretty gnarly advice.

Unless I’ve looked at the app myself i wouldnt touch public wifi - even then there are other risks to consider

Re: Ask HN: Dangers of Unsecured WiFi?

#29

Post by teekert »

frogsRnice wrote: post #28
bugtodiffer wrote: post #23

Earlier quoted context omitted.

There have been cases? I see this kind of stuff all the time. I once saw an app that had a popup warning me that the TLS cert is wrong but still let me connect...

Haha thats terrifying! I was just trying to point out that assuming that apps do this correctly is a bad idea; but my experience echoes yours, its a common mistake - even just browsing stack overflow people give some pretty gnarly advice. Unless I’ve looked at the app myself i wouldnt touch public wifi - even then there are other risks to consider

Would you do it with a VPN? (I would, just checking)

Re: Ask HN: Dangers of Unsecured WiFi?

#30

Post by AStonesThrow »

Your question is meaningless and context-free.

The only difference with "unsecured WiFi" is its lack of key and encryption.

You've said nothing about who provided that WiFi service, where it was, or anything. Plenty of reputable and well-managed WiFi networks are unsecured these days. Even my ISP runs them; they're perfectly safe. I don't use a VPN.

We're not your tech support department, and it's impossible for us to troubleshoot your bugs with so little information. Your local machine got messed up somehow. It sounds like PEBKAC. What leads you to believe that the WiFi network was to blame? No, I don't care.

Take your machine to an Apple store or something. Contact the administrator of the WiFi network. Go to Geek Squad. Factory reset and reinstall your computer. Who knows how you've shot yourself in the foot?

Post reply on HN