Advice to avoid public Wi-Fi is mostly out of date • Hacker News Board

Re: Advice to avoid public Wi-Fi is mostly out of date

#11

Post by knute » Thu, Jan 30, 2020, 1:48 PM UTC

ben_w wrote: post #8

mping wrote: post #5

Err, no it is not safe unless you trust the app you are running to validate the certificate chain. Not so long ago, I found out my bank's app didn't validate the cert and I could happily put a proxy and intercept all calls.

That’s an interesting point. As an app developer, I’d assumed that would be handled automatically by the OS. What’s the best way to test for certificate validity? (In my case I’m interested in iOS, but the same concern must exist on all platforms).

In my experience, the OS _does_ handle that automatically. If the app isn't verifying it, it's because they went out of their way to disable certificate validation.

Which is alarming.

Re: Advice to avoid public Wi-Fi is mostly out of date

#12

Post by estel » Thu, Jan 30, 2020, 1:49 PM UTC

ben_w wrote: post #8

mping wrote: post #5

Err, no it is not safe unless you trust the app you are running to validate the certificate chain. Not so long ago, I found out my bank's app didn't validate the cert and I could happily put a proxy and intercept all calls.

That’s an interesting point. As an app developer, I’d assumed that would be handled automatically by the OS. What’s the best way to test for certificate validity? (In my case I’m interested in iOS, but the same concern must exist on all platforms).

On iOS certificates will be validated by CFNetwork provided you haven't disabled ATS.

Re: Advice to avoid public Wi-Fi is mostly out of date

#13

Post by zzzcpan » Thu, Jan 30, 2020, 1:52 PM UTC

resoluteteeth wrote: post #6

kevinsimper wrote: post #4

Earlier quoted context omitted.

You would have to trust a root certificates from your mitm attacker, so it is not a problem.

When you first access a site, unless the site is using HSTS you are going to go to an insecure version so a mitm can proxy the request and remove tls or redirect you to another site. This is what is known as "https stripping."

You are talking about "HSTS Preload", HSTS doesn't do anything on first access.

Re: Advice to avoid public Wi-Fi is mostly out of date

#14

Post by swiley » Thu, Jan 30, 2020, 1:56 PM UTC

mping wrote: post #5

Err, no it is not safe unless you trust the app you are running to validate the certificate chain. Not so long ago, I found out my bank's app didn't validate the cert and I could happily put a proxy and intercept all calls.

While you’re probably not going to be instantly attacked, I still wouldn’t do online banking on a public network.

Re: Advice to avoid public Wi-Fi is mostly out of date

#15

Post by tsukurimashou » Thu, Jan 30, 2020, 1:56 PM UTC

Don't most of public Wifi (airports especially) have their own CA to MiTM SSL connections just like most companies do to inspect HTTPS traffic?

Re: Advice to avoid public Wi-Fi is mostly out of date

#16

Post by iso1631 » Thu, Jan 30, 2020, 1:57 PM UTC

knute wrote: post #11

ben_w wrote: post #8

Earlier quoted context omitted.

That’s an interesting point. As an app developer, I’d assumed that would be handled automatically by the OS. What’s the best way to test for certificate validity? (In my case I’m interested in iOS, but the same concern must exist on all platforms).

In my experience, the OS _does_ handle that automatically. If the app isn't verifying it, it's because they went out of their way to disable certificate validation. Which is alarming.

What's the odds that the corporate network the developers are on does MITM https interception, and the only way they could get their app to work was to remove certificate validation

Re: Advice to avoid public Wi-Fi is mostly out of date

#17

Post by iso1631 » Thu, Jan 30, 2020, 1:58 PM UTC

tsukurimashou wrote: post #15

Don't most of public Wifi (airports especially) have their own CA to MiTM SSL connections just like most companies do to inspect HTTPS traffic?

No, because that will simply fail.

I did see it once on a train in the UK, but that's the only time I've seen https MITM.

Re: Advice to avoid public Wi-Fi is mostly out of date

#18

Post by fulafel » Thu, Jan 30, 2020, 1:59 PM UTC

tsukurimashou wrote: post #15

Don't most of public Wifi (airports especially) have their own CA to MiTM SSL connections just like most companies do to inspect HTTPS traffic?

This only works if your mitm ca is preinstalled in the client device.

Re: Advice to avoid public Wi-Fi is mostly out of date

#19

Post by numpad0 » Thu, Jan 30, 2020, 2:02 PM UTC

swiley wrote: post #14

mping wrote: post #5

Err, no it is not safe unless you trust the app you are running to validate the certificate chain. Not so long ago, I found out my bank's app didn't validate the cert and I could happily put a proxy and intercept all calls.

While you’re probably not going to be instantly attacked, I still wouldn’t do online banking on a public network.

Every commercial network is a public network in a sense

Re: Advice to avoid public Wi-Fi is mostly out of date

#20

Post by iso1631 » Thu, Jan 30, 2020, 2:09 PM UTC

kevinsimper wrote: post #4

resoluteteeth wrote: post #2

Passive interception is less of an issue because so many sites are using tls, but in the case of a mitm attack isn't https stripping still a problem unless the site is using hsts?

You would have to trust a root certificates from your mitm attacker, so it is not a problem.

Block outgoing connections on port 443. MITM anything on port 80 which forwards to the server on port 443.

Your browser then loads www.whatever.com as http, even if the server doesn't allow http.

HSTS means if you've been to www.whatever.com before you'll be blocked. If you've never been before that doesn't help though.

In that fashion, typing www.mybank.com could redirect you to http://www.mybank.com (mitm) then to https://www.mybank.com-login.com/, where you get a green padlock.