Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you secure yourself on public WiFi?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 76 posts

Re: Ask HN: How do you secure yourself on public WiFi?

#31

Post by ax0n »

theBobMcCormick wrote: post #23

I guess my question would be: What additional threat do you thing public wifi poses, as opposed to any other internet access? IMHO, you have to assume that any unencrypted traffic over the internet could be sniffed, etc. The only additional threats I can see would be threats against your PC directly, rather than your traffic. Am I wrong?

You're over-simplifying a bit. Public WiFi is a bit more risky, though, because the barrier to entry for sniffing last-mile infrastructure is so low that anyone can do it.

At my home and office you have to contend with WPA2-Enterprise (it's easy to set up at home, so I did). You'd need to get hard-wired access to my home, and pull some ARP trickery to sniff my last-mile infrastructure. We have 802.1x on the Ethernet ports at the office, so no dice there.

You're right, to a point. And the effective response is to make sure you're always protected as well as you can, instead of going into a "shields up!" situation only when your perceived risk is higher.

Re: Ask HN: How do you secure yourself on public WiFi?

#32

Post by ax0n »

jsz0 wrote: post #30

Usually I just avoid using public wifi. Tethering is practical enough these days. Worse case I have a few VPN endpoints to fall back on but if I'm going to be using HTTPS sites I don't even bother connecting.

I also tether a lot. Usually, the speed is better and more reliable than the over-crowded crap provided by businesses. The added layer of protection is just icing on the cake most of the time.

Re: Ask HN: How do you secure yourself on public WiFi?

#35

Post by ez77 »

Conceptually, why do all options involve a server? If I somehow can securely "tunnel" to my server, I first have to tunnel through the WiFi hotspot, right? Am I not free to browse, safely, after securing this first step? (Sorry for the vagueness... This is as far as I understand these concepts.)

Re: Ask HN: How do you secure yourself on public WiFi?

#36

Post by mukyu »

w1ntermute wrote: post #21
ax0n wrote: post #14

My long answer is here: http://www.h-i-r.net/2008/08/defcon-paranoia.html The short answer: I back up my data. I encrypt all sensitive data on my laptop and don't access it in uncontrolled environments. I tunnel everything (usually with OpenSSH Dynamic Proxy) and then I run a firewall ruleset on my laptop that: 1) Permits tunneling to my server, 2) Permits anything on localhost, 3) Blocks all other incoming or outgoi…

Is there any way to do this at the network device level (on Linux) so that individual applications don't have to be configured to use the proxy? That's the main source of my reluctance to do this.

https://help.ubuntu.com/community/SSH_VPN

Re: Ask HN: How do you secure yourself on public WiFi?

#37

Post by staktrace »

ez77 wrote: post #35

Conceptually, why do all options involve a server? If I somehow can securely "tunnel" to my server, I first have to tunnel through the WiFi hotspot, right? Am I not free to browse, safely, after securing this first step? (Sorry for the vagueness... This is as far as I understand these concepts.)

The original problem is that sending HTTP requests and such directly on the WiFi hotspot connection sends it as plaintext. Thus it readable by anybody. With an SSH tunnel, all that plaintext is actually encrypted before it sent out over the WiFi hotspot, which protects it from eavesdroppers over that segment of the connection.

Re: Ask HN: How do you secure yourself on public WiFi?

#38

Post by _b8r0 »

JoeBracken wrote: post #28
carbon8 wrote: post #11

For the past 4 or 5 years I've been using SSH tunneling. I set up a location in OS X network preferences using the exact technique described in this comment http://news.ycombinator.com/item?id=1828631 . I usually tunnel through my router at home which runs DD-WRT. I use SSH Tunnel manager to manage the tunnel http://projects.tynsoe.org/en/stm/ . Once it's set up, all you need to do is switch your network location to…

I've got a similar setup using SSH Tunnel Manager to tunnel to a co-located Linux machine running squid proxy. All my applications used the proxy connection via the tunnel (browsers, IM clients, etc.). Took some initial configuration time to get things setup but now its just one click in the SSH Tunnel Manager widget to get things going anytime I'm working remote. VPN may be easier but an SSH tunnel gets it done.

You don't need to run squid to use an SSH tunnel as a proxy. If you set up a dynamic tunnel (not sure how to do this in SSH Tunnel Manager but it's fairly straightforward in putty) you point your clients at the local side and use it as a SOCKS proxy.

Re: Ask HN: How do you secure yourself on public WiFi?

#39

Post by ez77 »

staktrace wrote: post #37
ez77 wrote: post #35

Conceptually, why do all options involve a server? If I somehow can securely "tunnel" to my server, I first have to tunnel through the WiFi hotspot, right? Am I not free to browse, safely, after securing this first step? (Sorry for the vagueness... This is as far as I understand these concepts.)

The original problem is that sending HTTP requests and such directly on the WiFi hotspot connection sends it as plaintext. Thus it readable by anybody. With an SSH tunnel, all that plaintext is actually encrypted before it sent out over the WiFi hotspot, which protects it from eavesdroppers over that segment of the connection.

Thank you for the explanation!

Re: Ask HN: How do you secure yourself on public WiFi?

#40

Post by EvanK »

I don't do anything unencrypted (no sites that don't support ssl, no ftp or telnet, etc). If I absolutely have to do something potentially insecure, I set up an ssh tunnel through my vps slice...I tend to avoid this if possible, because its both a pain-in-the-ass and very slow.
Post reply on HN