Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you secure yourself on public WiFi?

news.ycombinator.com

Post reply on HN
Print view View original

71–76 of 76 posts

Re: Ask HN: How do you secure yourself on public WiFi?

#71

Post by evgen »

grotos wrote: post #19

I own iPod Touch and I often check my email at university (through both Safari and Mail.app). Is there any good solution for iOS devices?

iOS supports L2TP VPN tunelling, so if you can get to a box that will provide this for you everything will be fine. Setting the server end up on Linux and OS X is pretty easy, the bit that trips up most people when they first try this is making sure that the access point or router that is upstream from your VPN endpoint knows to pass the IPsec packets straight through.

Re: Ask HN: How do you secure yourself on public WiFi?

#72

Post by fragmede »

mikeyur wrote: post #54
epochwolf wrote: post #10

Easy, I open up a terminal and type: start_vpn It's a script which fires up an openvpn connection to a vps I have. Getting openvpn working took about a day of hacking around on my vps and my mac. (just read the openvpn tutorial and follow the steps.) I still haven't gotten openvpn working on Windows but it's not something I've never needed.

I just use Viscosity which is a menubar app that lets you easily connect to an OpenVPN connection (you punch in the address, authentication type, etc and it lets you just click the server name from your menubar to connect). I don't host my own server though, I use http://witopia.net I think I pay like $50-60/yr. But they give you a bunch of servers to connect to worldwide: http://cl.ly/2zEY

There's also Tunnelblick as a free and open source alternative to Viscosity - http://code.google.com/p/tunnelblick/

Re: Ask HN: How do you secure yourself on public WiFi?

#73

Post by pak »

theBobMcCormick wrote: post #59
whyleyc wrote: post #26

Earlier quoted context omitted.

As I understand it unsecured public WiFi is significantly more threatening when compared to standard hard-wired Ethernet as all your traffic is visible to any other user connected to the same network with a packet sniffer. It's much, much harder (but not impossible) to do this on a hard-wired connection - there's a useful discussion as to why here: http://news.ycombinator.com/item?id=1828201

Much of that discussion is crap. They're wasting effort bikeshedding about local network sniffing. You have to assume that anything of value sent over the internet might be sniffed or at least could be sniffed by a well placed attacker. The last hop connection between your PC and the AP is hardly the only point at which your data is vulnerable. To assume otherwise is foolhardy. That's why I said that the only additio…

It's much more unlikely that there is a sniffer between your ISP's routers and the target servers for interesting traffic than an attacker listening to your AP traffic. Your ISPs have a vested, primary business interest in keeping their network and peer traffic secure. The coffee shop could care less if people hack each other's Twitter over their AP.

Think about it, say you want to grab somebody's credentials for a popular website. Do you a) hack into their ISP or b) follow them to a coffeeshop and open up Firesheep. What's the easiest angle you are going to take? Local network sniffing isn't the trivial example of sniffing, it's the most vulnerable and probably most exploited target. (Just ask Google.)

Re: Ask HN: How do you secure yourself on public WiFi?

#74

Post by karatchov »

chip wrote: post #22

For those who don't want to setup their own vpn, you can try hotspotshield. It's free but they display a ad frame as you browse. I setup vpn on my dd-wrt router.

I'm sure this is not the perfect answer since hotspotshield redirect somehow google search pages and force ads on every page. But you can get the ads away with a simple rule in .hosts file. Privoxy can add another layer of ad protection.

Re: Ask HN: How do you secure yourself on public WiFi?

#75

Post by whyleyc »

theBobMcCormick wrote: post #65
fragmede wrote: post #46

Earlier quoted context omitted.

Yes. For an active attack, see airpwn - http://www.evilscheme.org/defcon/ If you think that's rather benign, consider the ssl cert checking flaw ( http://hackaday.com/2009/07/29/black-hat-2009-breaking-ssl-w... ). Put the two together, with a bit of paranoia, and the result is I never surf unsecured wifi without some sort of protection.

I guess I don't so much disagree with the idea of being careful on an unsecure public wifi, as I am concerned that so many people seem to think they only have to concerned about the unsecured wifi, not all the other hops on their connection. You know what I mean?

I don't think people here are suggesting that this is the only vector of attack against your system, rather that given the proliferation of unsecured WiFi networks it's just one of the more common.

When someone brings out the "ARP poisoning" add-on for Firefox maybe it will fuel debate on other types of attack :)

Re: Ask HN: How do you secure yourself on public WiFi?

#76

Post by mukyu »

w1ntermute wrote: post #41
ax0n wrote: post #27

Earlier quoted context omitted.

In Linux, most applications respect the http_proxy environment variable. It's the closest thing Linux has to a system-wide proxy setting as found in the more mainstream platforms.

This is actually how I use Chromium with a proxy right now, but it requires that I launch it from the command line and manually specify the http_proxy (and https_proxy) variables (/usr/bin/env http_proxy=" http://127.0.0.1:8080 https_proxy=" https://127.0.0.1:8080 /usr/bin/chromium). I suppose I could set up some kind of script to launch Chromium (and all other applications) that would check if I'm on my home network…

chromium --proxy-server=socks5://127.0.0.1:8080 is what I use, but chromium can also use your desktop environment's settings. On my laptop it allows me to make different proxy settings an define 'locations' that are easy to switch between.
Post reply on HN