Advice to avoid public Wi-Fi is mostly out of date • Hacker News Board

Re: Advice to avoid public Wi-Fi is mostly out of date

#21

Post by atonse » Thu, Jan 30, 2020, 2:12 PM UTC

giancarlostoro wrote: post #9

kevinsimper wrote: post #3

The EFF is awesome with Let's Encrypt! It was really a dreadful task to buy and renew certificates, especially as out infrastructure back then wasn't that automated. I think this article is a response to all those ads from VPN companies. They do try to scare people about public WiFi's.

One thing I would love to see in the future is the addition of LetsEncrypt support for major web servers like Nginx and Apache. I think this could go a long way. In the case of Apache it would be one of those "mod" type of packages. Someone feel free to let me know if this is already the case though, I would love to make note of it. Edit: Looks like Apache has one called 'md': https://httpd.apache.org/docs/trunk/mod/…

Really what we need is what Caddy ended up being. Best practices rolled in as defaults.

That’s why I use caddy just about everywhere that isn’t a load balancer.

Re: Advice to avoid public Wi-Fi is mostly out of date

#22

Post by moviuro » Thu, Jan 30, 2020, 2:14 PM UTC

GlitchMr wrote: post #7

Unfortunately, while HTTPS is very common, this isn't really the case with HSTS Preload, so active MitM attacks are still a threat.

Even just HSTS is not widely deployed. Here in France for instance:

* top 1 banking, top 18 FR https://www.ssllabs.com/ssltest/analyze.html?d=labanqueposta... no HSTS

* top 2 banking, top 20 FR https://www.ssllabs.com/ssltest/analyze.html?d=credit-agrico... no HSTS

* top 1 taxes, top 30 FR https://www.ssllabs.com/ssltest/analyze.html?d=www.impots.go... with CAA, HSTS (not preload), OCSP Must-Staple! (that's a surprise)

* top 3 banking, top 45 FR https://www.ssllabs.com/ssltest/analyze.html?d=caisse%2depar... no HSTS

Hopefuly, by 2030 banks will have caught up to the 2018 standard for "secure".

Re: Advice to avoid public Wi-Fi is mostly out of date

#23

Post by brlewis » Thu, Jan 30, 2020, 2:16 PM UTC

mping wrote: post #5

Err, no it is not safe unless you trust the app you are running to validate the certificate chain. Not so long ago, I found out my bank's app didn't validate the cert and I could happily put a proxy and intercept all calls.

People who think app store approval is a reliable quality gate, please take note.

Re: Advice to avoid public Wi-Fi is mostly out of date

#24

Post by PaulHoule » Thu, Jan 30, 2020, 2:23 PM UTC

I remember in 2005 when you could just start up Ethereal, run it for a minute, and get many people's email passwords, email, everything...

I think Wi-Fi security is going to be a major FUD talking point for the telecoms as they try to justify high prices, 5G, and the rest of their trip.

5G as it exists now does little to compete with WiFi because (in the millimeter wave form) it doesn't pass through walls. The overwhelming majority of data consumption happens indoors, so it can't make for a revolution in the market unless you get a huge number of antennas and/or cells installed indoors.

That's immensely problematic because building managers aren't going to want to have Verizon, AT&T, T-Mobile and maybe someday Dish Network stomp through their buildings, drill holes, do damage, etc.

There has been talk of wholesale access networks, which would be a great idea (e.g. a neutral vendor installs indoor infrastructure that gets rented by the carriers...) but the carriers are dead set against it.

Re: Advice to avoid public Wi-Fi is mostly out of date

#25

Post by zzzcpan » Thu, Jan 30, 2020, 2:23 PM UTC

giancarlostoro wrote: post #9

kevinsimper wrote: post #3

The EFF is awesome with Let's Encrypt! It was really a dreadful task to buy and renew certificates, especially as out infrastructure back then wasn't that automated. I think this article is a response to all those ads from VPN companies. They do try to scare people about public WiFi's.

One thing I would love to see in the future is the addition of LetsEncrypt support for major web servers like Nginx and Apache. I think this could go a long way. In the case of Apache it would be one of those "mod" type of packages. Someone feel free to let me know if this is already the case though, I would love to make note of it. Edit: Looks like Apache has one called 'md': https://httpd.apache.org/docs/trunk/mod/…

> One thing I would love to see in the future is the addition of LetsEncrypt support for major web servers like Nginx and Apache. I think this could go a long way.

This is not as useful as you think. In nginx you only need a couple of extra lines of configuration to let an external program issue and renew certificates independently from nginx, without reloads, etc. Definitely not worth developing a C nginx module that starts a helper process that does that just so that a few people who run nginx on a single server could get their certificates issued with only one line of configuration.

Re: Advice to avoid public Wi-Fi is mostly out of date

#26

Post by hannob » Thu, Jan 30, 2020, 2:24 PM UTC

mping wrote: post #5

Err, no it is not safe unless you trust the app you are running to validate the certificate chain. Not so long ago, I found out my bank's app didn't validate the cert and I could happily put a proxy and intercept all calls.

If your app does that then it's not particularly safe over an encrypted wifi either.

The solution is to fix that app, not to rely on a very weak defense that may help you in a fraction of the possible attack scenarios.

Re: Advice to avoid public Wi-Fi is mostly out of date

#27

Post by IshKebab » Thu, Jan 30, 2020, 2:25 PM UTC

GlitchMr wrote: post #7

Unfortunately, while HTTPS is very common, this isn't really the case with HSTS Preload, so active MitM attacks are still a threat.

I wrote a wifi hotspot app for Android that could MitM HTTPS requests as you suggest about 8 years ago. Even back then it didn't work very well because even without HSTS preload, most people aren't visiting new websites for the first time on your free public Wifi.

Re: Advice to avoid public Wi-Fi is mostly out of date

#28

Post by IshKebab » Thu, Jan 30, 2020, 2:27 PM UTC

resoluteteeth wrote: post #2

Passive interception is less of an issue because so many sites are using tls, but in the case of a mitm attack isn't https stripping still a problem unless the site is using hsts?

Not really because most sites you visit you've already visited before. HTST preload only helps for the first visit to a site. After that it makes no difference.

Re: Advice to avoid public Wi-Fi is mostly out of date

#29

Post by Maximus9000 » Thu, Jan 30, 2020, 2:27 PM UTC

tsukurimashou wrote: post #15

Don't most of public Wifi (airports especially) have their own CA to MiTM SSL connections just like most companies do to inspect HTTPS traffic?

> airports especially

Indeed, lets not forget what the Snowden leaks said about airports:

https://www.cbc.ca/news/politics/csec-used-airport-wi-fi-to-...

Re: Advice to avoid public Wi-Fi is mostly out of date

#30

Post by IshKebab » Thu, Jan 30, 2020, 2:28 PM UTC

tsukurimashou wrote: post #15

Don't most of public Wifi (airports especially) have their own CA to MiTM SSL connections just like most companies do to inspect HTTPS traffic?

I've never seen this. They usually just block all HTTPS connections and rely on automatic captive portal detection in modern OSes. Occasionally I've had wifi that had a captive HTTP portal but would allow HTTPS through anyway.