Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Advice to avoid public Wi-Fi is mostly out of date

eff.org

Post reply on HN
Print view View original

51–60 of 117 posts

Re: Advice to avoid public Wi-Fi is mostly out of date

#51

Post by lukewink »

ceejayoz wrote: post #49
billyhoffman wrote: post #38

Earlier quoted context omitted.

Honest question... why not? Modern banks use HTTPS throughout. The banks I use all have HSTS and use preloading so no hijacking to a non-HTTPS site. I use a password manager so if somehow I do get hijacked and get sent to a phishing site, and even if that phishing site is using a Lets Encrypt cert to prevent the “Not Secure” banner in a modern browser, my password manager isn’t going to recognize the domain so it wou…

This comments thread literally starts with someone who discovered their bank's app wasn't validating the certificate, though.

In that case it wouldn't be safe to use the app on a private network either.

Re: Advice to avoid public Wi-Fi is mostly out of date

#52

Post by dkarras »

Amorymeltzer wrote: post #48

> So when you visit HTTPS sites, anyone along the communication path... can see their domain names (e.g. wikipedia.org) and when you visit them. But these parties can’t see the pages you visit on those sites (e.g. wikipedia.org/controversial-topic), your login name, or messages you send. I believe this is the reason Turkey blocked the entirety of Wikipedia[0], which was recently lifted[1]. They wanted to block specif…

Am Turkish, and not really. There is no evidence of Turkey caring about what the individual citizens visit (except in case of a crime investigation etc.) Bans in Turkey works like this: Turkey sees something they don't like on the Internet, Turkey reaches the company / individuals behind it (they can be anywhere in the world) and tells them "take it down or we will block your access to Turkish citizens and you'll lose revenue / traffic". If the site owners comply nothing happens. If site owners refuse for any reason, they block the site so it is not accessible from Turkey. In the older days, they used to do it through DNS but it was easy to circumvent. Now they use other methods so changing your DNS isn't enough, but a VPN works just fine.

This was also the case before https wasn't as common BTW. Turkey either didn't have the technical capability to block individual pages (even back then) or they were seeking to punish the site by blocking access in whole.

A site like wikipedia values integrity more so they don't take pages down without good reason. But companies seeing Turkish citizens as a revenue source generally comply. If you browse Twitter in Turkey, it is common to see tweets where it just says something like "this tweet is blocked in your country" - Turkey reaches twitter to mark the tweet invisible and that individual tweet goes away. IIRC it also applies to entire profiles - I'm not a frequent twitter user but I remember seeing entire profiles blocked by country.

Re: Advice to avoid public Wi-Fi is mostly out of date

#53

Post by air7 »

I think jumps the gun a little.

When sharing a network, there are other attack vectors into people's unhardened laptops except browser MITM. Do you have any unprotected shared folders? Can someone brute force your login via RDP? Can you account for all the listening ports running on your device?

A NAT provides strong protection by simply firewalling you from the outside world. It's so common that the focus (rightfully) zoomed in on MITM as that is the only thing "left", but in a shared network, the adversary may reside on the inside nulling that protection. Most users have not taken precautions against this.

Oh, and shoulder surfing.

Re: Advice to avoid public Wi-Fi is mostly out of date

#54

Post by acdha »

zzzcpan wrote: post #13
resoluteteeth wrote: post #6

Earlier quoted context omitted.

When you first access a site, unless the site is using HSTS you are going to go to an insecure version so a mitm can proxy the request and remove tls or redirect you to another site. This is what is known as "https stripping."

You are talking about "HSTS Preload", HSTS doesn't do anything on first access.

HSTS helps unless you are always on compromised networks or the site uses short TTLs. Even without preloading most people are probably not accessing their bank for the first time ever on a malicious network.

Re: Advice to avoid public Wi-Fi is mostly out of date

#55

Post by acdha »

tsukurimashou wrote: post #15

Don't most of public Wifi (airports especially) have their own CA to MiTM SSL connections just like most companies do to inspect HTTPS traffic?

I haven’t seen that in about 15 years: the experience is horrible and will get tons of complaints.

Re: Advice to avoid public Wi-Fi is mostly out of date

#56

Post by Kocrachon »

air7 wrote: post #53

I think jumps the gun a little. When sharing a network, there are other attack vectors into people's unhardened laptops except browser MITM. Do you have any unprotected shared folders? Can someone brute force your login via RDP? Can you account for all the listening ports running on your device? A NAT provides strong protection by simply firewalling you from the outside world. It's so common that the focus (rightfull…

Yeah this article is only covering a specific attack vector, to claim that public Wifi is nearly risk free because of HTTPS is a very dangerous statement to make. The risk of public wifi was far from just having your traffic spied on.

Re: Advice to avoid public Wi-Fi is mostly out of date

#57

Post by [deleted] »

atonse wrote: post #21
giancarlostoro wrote: post #9

Earlier quoted context omitted.

One thing I would love to see in the future is the addition of LetsEncrypt support for major web servers like Nginx and Apache. I think this could go a long way. In the case of Apache it would be one of those "mod" type of packages. Someone feel free to let me know if this is already the case though, I would love to make note of it. Edit: Looks like Apache has one called 'md': https://httpd.apache.org/docs/trunk/mod/…

Really what we need is what Caddy ended up being. Best practices rolled in as defaults. That’s why I use caddy just about everywhere that isn’t a load balancer.

[deleted]

Re: Advice to avoid public Wi-Fi is mostly out of date

#58

Post by RKearney »

iso1631 wrote: post #16
knute wrote: post #11

Earlier quoted context omitted.

In my experience, the OS _does_ handle that automatically. If the app isn't verifying it, it's because they went out of their way to disable certificate validation. Which is alarming.

What's the odds that the corporate network the developers are on does MITM https interception, and the only way they could get their app to work was to remove certificate validation

Very slim, as you can still verify the certificate chains up to a trusted root certificate and it’s trivial (and generally part of the enrollment process) to load the companies root CA on your device.

We MITM and certificate validation works correctly.

Re: Advice to avoid public Wi-Fi is mostly out of date

#59

Post by AWildC182 »

iso1631 wrote: post #16
knute wrote: post #11

Earlier quoted context omitted.

In my experience, the OS _does_ handle that automatically. If the app isn't verifying it, it's because they went out of their way to disable certificate validation. Which is alarming.

What's the odds that the corporate network the developers are on does MITM https interception, and the only way they could get their app to work was to remove certificate validation

Been there done that. Corporate IT often doesn't want to acknowledge that devs exist in the company because it's so much easier to just lock down the admin and marketing use cases.

It's fucking scary how far they're willing compromise security internally and externally to avoid extra work and maintain control.

Post reply on HN