Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What we give away when we log on to a public Wi-Fi network

decorrespondent.nl

Post reply on HN
Print view View original

71–80 of 112 posts

Re: What we give away when we log on to a public Wi-Fi network

#71

Post by xorcist »

keeperofdakeys wrote: post #56
RexRollman wrote: post #34

Earlier quoted context omitted.

What's the point of that? To speed up reconnection?

It also allows APs to be "hidden", by not broadcasting its own SSID, but relying on devices to send out a probe to ask if it's there. Of course, it's not hidden from packet sniffers if it's talking to someone.

That might just be the most stupid misfeature in the history of IT.

Not only is a "hidden" AP not really hidden at all, it makes a lot of functionality much more difficult, such as channel choosing and reconnect.

Re: What we give away when we log on to a public Wi-Fi network

#72

Post by zobzu »

andrewstuart2 wrote: post #63
eli wrote: post #31

Earlier quoted context omitted.

How sure are you that your cheap anonymous VPN isn't malicious and hasn't been hacked? Is that more or less likely than an attacker being on the same physical wireless network as you?

Well, 'cuz I set it up myself? Mine is running on a home server but it would be just as easy to set up a $5/mo. VPS and set up OpenVPN.

obviously people able to setup their own VPN arent the target. even when connecting on open wifi without vpn im pretty you would spot anything suspicious

Re: What we give away when we log on to a public Wi-Fi network

#73

Post by xorcist »

xamolxix wrote: post #10

Considering how ridiculously cheap an anonymous VPN service is these days I am surprised how many people do not use them.

If I wanted to skim personal data like described in the article, I would start a cheap anonymous VPN provider.

Re: What we give away when we log on to a public Wi-Fi network

#74

Post by mattmanser »

lucb1e wrote: post #19
xamolxix wrote: post #13

Earlier quoted context omitted.

I suspect it's not plain old sniffing. He might give fake DNS records to point to his own phishing site (facebook clone). It's trivial to re-post the credentials to the real facebook check the password and then actually log them in. curl can be used to do this, as I am sure many others. Edit: SSL does not have to be used on the clone. Most people will not notice/care.

You can't spoof a certificate with DNS. Even if you spoofed a DNS response and made facebook.com point to 192.168.1.2 then the server at 192.168.1.2 (which could be yours) would still need a valid certificate for facebook.com. The only way to have done this is by having the user click "continue" or "ignore" or something on an ssl error page. I know from experience that a company full of programmers will happily do th…

Perhaps you haven't seen the certificate errors for quite a while, but they are now quite forceful about you not clicking OK. The Ok is hidden.

Re: What we give away when we log on to a public Wi-Fi network

#75

Post by xtian »

colinbartlett wrote: post #16
HorizonXP wrote: post #12

Earlier quoted context omitted.

Because it's difficult to setup and configure for most people? People struggle with connecting their laptops/tablets to WiFi. Expecting them to configure a VPN on their own is a stretch. You could start a small SaaS business that could make "lifestyle business" type money if you did this well.

PrivateInternetAccess.com gives you an installer with all the credentials in it ready to go. It was so easy my dad could do it. I don't think ease is a barrier anymore. I think it's just lack of education about how necessary these measures are.

PIA gets a lot of recommendations but no one ever mentions that a great number of sites prevent you from using them from the PIA addresses. I've had a lot of trouble with financial and e-commerce sites in particular (which are also the situations I really care about using a VPN).

I think it might be that PIA is frequently used for DDOS and abuse since it's so inexpensive.

Just something I wish I had known before signing up.

Re: What we give away when we log on to a public Wi-Fi network

#76

Post by ris »

cbsmith wrote: post #65
JoshGlazebrook wrote: post #50

I've read about this kind of thing before, so when I'm in public, or even at school I prefer to fire up my phone's personal hotspot instead of using any public wifi available.

That's good, because now you are just broadcasting your phone's SSID & MAC everywhere. ;-) Seriously, just VPN over the hotspot.

You have too much trust in your VPN provider.

Re: What we give away when we log on to a public Wi-Fi network

#78

Post by Maxnuf »

sktrdie wrote: post #6

How was the hacker able to get Facebook credentials? Facebook uses HTTPS and so does Live.com. Even if I'm connected to a malicious router, only me and Facebook know about the data we're sending each other. Am I missing something or should the author of this article provide more evidence on the type of attack?

In the original Dutch article (https://decorrespondent.nl/845/Dit-geef-je-allemaal-prijs-al...) the author explained in the comments that they used SSLstrip for facebook and live.com So, the connection was over HTTP and not HTTPS. They added a padlock favicon.ico image to give the impression the site was secure

Re: What we give away when we log on to a public Wi-Fi network

#79

Post by k_bx »

Maxnuf wrote: post #78
sktrdie wrote: post #6

How was the hacker able to get Facebook credentials? Facebook uses HTTPS and so does Live.com. Even if I'm connected to a malicious router, only me and Facebook know about the data we're sending each other. Am I missing something or should the author of this article provide more evidence on the type of attack?

In the original Dutch article ( https://decorrespondent.nl/845/Dit-geef-je-allemaal-prijs-al... ) the author explained in the comments that they used SSLstrip for facebook and live.com So, the connection was over HTTP and not HTTPS. They added a padlock favicon.ico image to give the impression the site was secure

Ah. I wonder how hard would it be to extend protocol to let Facebook, for example, state that they will never go https again, so that browser would scream.

Re: What we give away when we log on to a public Wi-Fi network

#80

Post by MichaelApproved »

victorvation wrote: post #15
fredsted wrote: post #4

Are my devices really broadcasting the SSIDs they have been connecting to?

Yep. Whenever wifi is enabled, your device is sending out probe request frames, which includes your list of preferred networks/networks you've connected to before.

Could it be used as a sort of fingerprint to identify phones? I'm imagining using a scanner to create a list of phones in the area. You walk through the halls of congress to compile a list of devices. Do this every few days or over the course of a month, to eliminate visitors.

Now that you have your fingerprint, you can leave a few scanners around where you're trying to track the congressmen. IE, if you want to blackmail, put it around strip clubs.

Seems like a major security hole to me.

Post reply on HN