Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you secure yourself on public WiFi?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 76 posts

Re: Ask HN: How do you secure yourself on public WiFi?

#41

Post by w1ntermute »

ax0n wrote: post #27
w1ntermute wrote: post #21

Earlier quoted context omitted.

Is there any way to do this at the network device level (on Linux) so that individual applications don't have to be configured to use the proxy? That's the main source of my reluctance to do this.

In Linux, most applications respect the http_proxy environment variable. It's the closest thing Linux has to a system-wide proxy setting as found in the more mainstream platforms.

This is actually how I use Chromium with a proxy right now, but it requires that I launch it from the command line and manually specify the http_proxy (and https_proxy) variables (/usr/bin/env http_proxy="http://127.0.0.1:8080 https_proxy="https://127.0.0.1:8080 /usr/bin/chromium). I suppose I could set up some kind of script to launch Chromium (and all other applications) that would check if I'm on my home network and launch all apps with that variable if not, but that seems like a really ugly hack.

Re: Ask HN: How do you secure yourself on public WiFi?

#42

Post by w1ntermute »

mukyu wrote: post #36
w1ntermute wrote: post #21

Earlier quoted context omitted.

Is there any way to do this at the network device level (on Linux) so that individual applications don't have to be configured to use the proxy? That's the main source of my reluctance to do this.

https://help.ubuntu.com/community/SSH_VPN

That seems like a lot of work. Not that I'm opposed to doing it if necessary, but an automated solution (even if it were graphical) would be wonderful. In fact, it would be great if Wicd could somehow handle all this.

Re: Ask HN: How do you secure yourself on public WiFi?

#43

Post by _cbsz »

whyleyc wrote: post #26
theBobMcCormick wrote: post #23

I guess my question would be: What additional threat do you thing public wifi poses, as opposed to any other internet access? IMHO, you have to assume that any unencrypted traffic over the internet could be sniffed, etc. The only additional threats I can see would be threats against your PC directly, rather than your traffic. Am I wrong?

As I understand it unsecured public WiFi is significantly more threatening when compared to standard hard-wired Ethernet as all your traffic is visible to any other user connected to the same network with a packet sniffer. It's much, much harder (but not impossible) to do this on a hard-wired connection - there's a useful discussion as to why here: http://news.ycombinator.com/item?id=1828201

Your personal machine isn't going to be connected through "modern enterprise-grade switches like you would find in a data center," so ARP spoofing is a totally legitimate attack.

Re: Ask HN: How do you secure yourself on public WiFi?

#45

Post by runjake »

SSH, with SOCKS tunneling (and the FoxyProxy extension with Firefox, although I normally use Google Chrome). Works on Windows/Mac OS X/Linux. Note that this doesn't necessarily fix DNS sniffing and whatnot.

If I was paranoid, I'd bother to set up a VPN and use that.

If I'm extremely paranoid, I use Tor (which may have some security concerns).

Re: Ask HN: How do you secure yourself on public WiFi?

#46

Post by fragmede »

theBobMcCormick wrote: post #23

I guess my question would be: What additional threat do you thing public wifi poses, as opposed to any other internet access? IMHO, you have to assume that any unencrypted traffic over the internet could be sniffed, etc. The only additional threats I can see would be threats against your PC directly, rather than your traffic. Am I wrong?

Yes. For an active attack, see airpwn - http://www.evilscheme.org/defcon/ If you think that's rather benign, consider the ssl cert checking flaw (http://hackaday.com/2009/07/29/black-hat-2009-breaking-ssl-w...). Put the two together, with a bit of paranoia, and the result is I never surf unsecured wifi without some sort of protection.

Re: Ask HN: How do you secure yourself on public WiFi?

#47

Post by [deleted] »

runjake wrote: post #45

SSH, with SOCKS tunneling (and the FoxyProxy extension with Firefox, although I normally use Google Chrome). Works on Windows/Mac OS X/Linux. Note that this doesn't necessarily fix DNS sniffing and whatnot. If I was paranoid, I'd bother to set up a VPN and use that. If I'm extremely paranoid, I use Tor (which may have some security concerns).

[deleted]

Re: Ask HN: How do you secure yourself on public WiFi?

#48

Post by fragmede »

runjake wrote: post #45

SSH, with SOCKS tunneling (and the FoxyProxy extension with Firefox, although I normally use Google Chrome). Works on Windows/Mac OS X/Linux. Note that this doesn't necessarily fix DNS sniffing and whatnot. If I was paranoid, I'd bother to set up a VPN and use that. If I'm extremely paranoid, I use Tor (which may have some security concerns).

Set

  network.proxy.socks_remote_dns to true
in about:config for Firefox to do DNS requests over SOCKS.

Re: Ask HN: How do you secure yourself on public WiFi?

#49

Post by scraplab »

I use an L2TP/IPSEC VPN on a Linode VPS. It works great with OS X and iOS devices - I've not tried anything else. There's a simple toggle switch on iOS in Settings to activate the VPN, or a one-click menu item in OSX.

It's pretty easy to set up, if you're comfortable with Linux. I'm using it on Ubuntu 9.10, and I followed the guide here:

http://riobard.com/blog/2010-04-30-l2tp-over-ipsec-ubuntu/

Post reply on HN