Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wi-Fine

wifine.gitlab.io

Post reply on HN
Print view View original

11–20 of 57 posts

Re: Wi-Fine

#11

Post by tialaramex »

roustem wrote: post #7
nibbleshifter wrote: post #4

Earlier quoted context omitted.

A fair amount (DNS, etc) is still in the clear, yes. I still see a good amount of clear text web traffic when I do packet captures in airports and the like. Usually image or media files, but the odd time I see some badly conceived automatic update process pulling an exe or msi over plaintext HTTP.

Would something like NextDNS help?

NextDNS offers DoH (DNS over HTTP) so yes, your DNS look ups are encrypted. But of course if an app developer clicked past all the "This is a terrible idea, just stop it" and added that code to download your porn over a plaintext HTTP 1.0 connection from their server this-is-literally-porn.example then NextDNS doesn't magically prevent that when you run their crappy porn app.

Re: Wi-Fine

#12

Post by closewith »

nibbleshifter wrote: post #4
throwoutway wrote: post #2

I was trying to explain this to someone recently and basically described the same. However, there’s still a privacy risk on a public wifi, correct? As in your neighbor can see the DNS requests (as those are generally unencrypted). If you use a VPN, cool, but now your “free VPN” gets to see that. The only other issues I could think of were ARP poisoning / spoofing and maybe local phishing redirects

A fair amount (DNS, etc) is still in the clear, yes. I still see a good amount of clear text web traffic when I do packet captures in airports and the like. Usually image or media files, but the odd time I see some badly conceived automatic update process pulling an exe or msi over plaintext HTTP.

> I still see a good amount of clear text web traffic when I do packet captures in airports and the like.

Of all the places I'd avoid packet sniffing, that's high on the list.

Re: Wi-Fine

#13

Post by tialaramex »

pydry wrote: post #10
nibbleshifter wrote: post #4

Earlier quoted context omitted.

A fair amount (DNS, etc) is still in the clear, yes. I still see a good amount of clear text web traffic when I do packet captures in airports and the like. Usually image or media files, but the odd time I see some badly conceived automatic update process pulling an exe or msi over plaintext HTTP.

I think debian does package updates over HTTP in the clear. It's not necessarily a problem if the package is signed and the signature is verified.

But you don't have privacy. If you didn't want anybody to know that you've got clown-fetish-program version 1.6.4 installed, then Debian's package upgrade code fetching clown-fetish-program version 1.6.4.1 update is a disappointing give away.

In the real world is it embarrassing to have Emacs installed? Or KDE? Or even Tux Racer ? Probably not. But all things being equal we'd rather the program just kept this to itself right?

Re: Wi-Fine

#14

Post by sph »

To me public Wi-Fi is pretty much a honeypot. Most people I know don't rely on it, especially with widespread 4G and mobile phones, so the only people using it are shady figures for whom open and public Wi-Fi is just another step in their OpSec.

I figure if you connect to an open Wi-fi and then to a VPN endpoint, you're put on some government list.

Re: Wi-Fine

#15

Post by Avamander »

Getting owned wise - maybe. Privacy wise - no.

Not all web traffic is HTTPS, way too much of it still isn't. Not everything is HTTP(S) even, some nastiness comes from other protocols. DNS is still rarely encrypted. NTP basically* isn't encrypted. And all those combined allow a lot of privacy-invasive profiling to be done. Without WPA3 public, it's also passive and you have no clue.

Re: Wi-Fine

#16

Post by jobigoud »

sph wrote: post #14

To me public Wi-Fi is pretty much a honeypot. Most people I know don't rely on it, especially with widespread 4G and mobile phones, so the only people using it are shady figures for whom open and public Wi-Fi is just another step in their OpSec. I figure if you connect to an open Wi-fi and then to a VPN endpoint, you're put on some government list.

But what would they put on that government list exactly? Your mac address?

Re: Wi-Fine

#17

Post by Avamander »

tialaramex wrote: post #13
pydry wrote: post #10

Earlier quoted context omitted.

I think debian does package updates over HTTP in the clear. It's not necessarily a problem if the package is signed and the signature is verified.

But you don't have privacy. If you didn't want anybody to know that you've got clown-fetish-program version 1.6.4 installed, then Debian's package upgrade code fetching clown-fetish-program version 1.6.4.1 update is a disappointing give away. In the real world is it embarrassing to have Emacs installed? Or KDE? Or even Tux Racer ? Probably not. But all things being equal we'd rather the program just kept this to itse…

It could also reveal information about your system that could be used for exploiting. E.g. you have a package installed that can be used for privilege escalation once compromised.

Not to mention the additional possibility of exploiting apt itself vs. having to exploit the TLS stack (which goes trough a lot more scrutiny).

Re: Wi-Fine

#18

Post by teddyh »

tialaramex wrote: post #13
pydry wrote: post #10

Earlier quoted context omitted.

I think debian does package updates over HTTP in the clear. It's not necessarily a problem if the package is signed and the signature is verified.

But you don't have privacy. If you didn't want anybody to know that you've got clown-fetish-program version 1.6.4 installed, then Debian's package upgrade code fetching clown-fetish-program version 1.6.4.1 update is a disappointing give away. In the real world is it embarrassing to have Emacs installed? Or KDE? Or even Tux Racer ? Probably not. But all things being equal we'd rather the program just kept this to itse…

https://tracker.debian.org/pkg/anarchism

Re: Wi-Fine

#19

Post by thenthenthen »

tialaramex wrote: post #8

In this space, if you have WPA3 then there's no benefit to having a "password" for WiFi which actually is public knowledge. In WPA and WPA2 the password means network use is encrypted, which means a completely passive adversary can't just snoop the network so long as there's a password. But in WPA3 even without a password everything is encrypted anyway, your station says "Hey, I'm joining this network here's a number…

Funny, when teaching networking we would be able to visit each others local webservers across multiple campuses and subnets (!) on EduRoam. Fun times.

Re: Wi-Fine

#20

Post by can16358p »

sph wrote: post #14

To me public Wi-Fi is pretty much a honeypot. Most people I know don't rely on it, especially with widespread 4G and mobile phones, so the only people using it are shady figures for whom open and public Wi-Fi is just another step in their OpSec. I figure if you connect to an open Wi-fi and then to a VPN endpoint, you're put on some government list.

Many people do rely on it, they don't probably even know what a password does vs an open network.

If people around you tend to have a profile like HN users yes they of course know what they're dealing with.

Bur for the rest of the non-techie 99% of the world, public Wi-Fi is perfectly fine.

Post reply on HN