Advice to avoid public Wi-Fi is mostly out of date
1–10 of 117 posts
Re: Advice to avoid public Wi-Fi is mostly out of date
#2Passive interception is less of an issue because so many sites are using tls, but in the case of a mitm attack isn't https stripping still a problem unless the site is using hsts?
Re: Advice to avoid public Wi-Fi is mostly out of date
#3The EFF is awesome with Let's Encrypt! It was really a dreadful task to buy and renew certificates, especially as out infrastructure back then wasn't that automated.
I think this article is a response to all those ads from VPN companies. They do try to scare people about public WiFi's.
Re: Advice to avoid public Wi-Fi is mostly out of date
#4Passive interception is less of an issue because so many sites are using tls, but in the case of a mitm attack isn't https stripping still a problem unless the site is using hsts?
You would have to trust a root certificates from your mitm attacker, so it is not a problem.
Re: Advice to avoid public Wi-Fi is mostly out of date
#5Err, no it is not safe unless you trust the app you are running to validate the certificate chain. Not so long ago, I found out my bank's app didn't validate the cert and I could happily put a proxy and intercept all calls.
Re: Advice to avoid public Wi-Fi is mostly out of date
#6Passive interception is less of an issue because so many sites are using tls, but in the case of a mitm attack isn't https stripping still a problem unless the site is using hsts?
You would have to trust a root certificates from your mitm attacker, so it is not a problem.
When you first access a site, unless the site is using HSTS you are going to go to an insecure version so a mitm can proxy the request and remove tls or redirect you to another site. This is what is known as "https stripping."
Re: Advice to avoid public Wi-Fi is mostly out of date
#7Unfortunately, while HTTPS is very common, this isn't really the case with HSTS Preload, so active MitM attacks are still a threat.
Re: Advice to avoid public Wi-Fi is mostly out of date
#8Err, no it is not safe unless you trust the app you are running to validate the certificate chain. Not so long ago, I found out my bank's app didn't validate the cert and I could happily put a proxy and intercept all calls.
That’s an interesting point. As an app developer, I’d assumed that would be handled automatically by the OS.
What’s the best way to test for certificate validity? (In my case I’m interested in iOS, but the same concern must exist on all platforms).
Re: Advice to avoid public Wi-Fi is mostly out of date
#9The EFF is awesome with Let's Encrypt! It was really a dreadful task to buy and renew certificates, especially as out infrastructure back then wasn't that automated. I think this article is a response to all those ads from VPN companies. They do try to scare people about public WiFi's.
One thing I would love to see in the future is the addition of LetsEncrypt support for major web servers like Nginx and Apache. I think this could go a long way. In the case of Apache it would be one of those "mod" type of packages. Someone feel free to let me know if this is already the case though, I would love to make note of it.
Edit:
Looks like Apache has one called 'md':
https://httpd.apache.org/docs/trunk/mod/mod_md.html
Your move Nginx? :)
Re: Advice to avoid public Wi-Fi is mostly out of date
#10Err, no it is not safe unless you trust the app you are running to validate the certificate chain. Not so long ago, I found out my bank's app didn't validate the cert and I could happily put a proxy and intercept all calls.
That’s an interesting point. As an app developer, I’d assumed that would be handled automatically by the OS. What’s the best way to test for certificate validity? (In my case I’m interested in iOS, but the same concern must exist on all platforms).
Unless the libraries you are using are fubar then you normally have to explicitly tell it to ignore certificate chain errors i.e. requests.get(..., verify=False)