OpenVPN on Android can block internet traffic until the tunnel has been established, very handy. e.g. http://img.nux.ro/4nV-openvpn_seamless.png
But wouldn't that prevent the portal itself from loading? Kind of a chicken and egg situation.
Even with a VPN, open Wi-Fi exposes users
21–30 of 44 posts
Re: Even with a VPN, open Wi-Fi exposes users
#22Year after year, decade after decade, all manner of security problems are avoided by running (al)pine on a remote server that I ssh to.
Also, use is about ten times faster than a web client.
Re: Even with a VPN, open Wi-Fi exposes users
#23Tunnelbear[0] has Vigilant mode[1] that blocks all outgoing connections until you have connected to the VPN server. It was one of the main reasons to start using it. [0] https://www.tunnelbear.com [1] https://www.tunnelbear.com/updates/vigilant/
I requested this feature from the current maintainer of sshuttle ... I think I referred to it as "failsafe" mode, meaning that if sshuttle crashes or has not yet started, the default firewall rules that it installed allow no traffic to flow.
Not sure if it's been acted on.
Re: Even with a VPN, open Wi-Fi exposes users
#24Tunnelbear[0] has Vigilant mode[1] that blocks all outgoing connections until you have connected to the VPN server. It was one of the main reasons to start using it. [0] https://www.tunnelbear.com [1] https://www.tunnelbear.com/updates/vigilant/
I love Tunnelbear, but I assure you their vigilant mode is far from perfect. In particular, I take a train to and from work. When the network goes down, and it goes down several times every trip, sometimes Tunnelbear goes into vigilant mode, but it frequently doesn't - i.e. I can absolutely connect to sites from the open wifi while the Tunnelbear icon is spinning up a fresh connection but before it has fully secured…
I looked at PDANet and I don't realy understand... My Android phone (galaxy s6) can do all that by default under Settings->Tethering and Hotspot.
I do live in Europe though and I've never heard about a "tether plan". Is that some American weirdness maybe?
Re: Even with a VPN, open Wi-Fi exposes users
#25That is one of the nice thins about the VPN provider I use - not only do they not keep any logs, but all you have to do is click a single checkbox and then you have no internet unless the vpn is connected.
Which provider is that? Are you using their app or something built into the OS?
Re: Even with a VPN, open Wi-Fi exposes users
#26I'm not sure how Cloak (getcloak.com) isolates captive portals, but one of their features blocks http traffic (but allows https traffic) until a tunnel is up. Granted, this doesn't help for things like unencrypted SMTP, but it's a step in the right direction.
Re: Even with a VPN, open Wi-Fi exposes users
#27TL;DR: You usually first have to accept the WiFi network's terms of service on a special page (called a captive portal) before you get Internet access. Until you do that, VPN doesn't work, and by then your email program (or anything else) may already have checked for new messages. If you have a password for your email account (which surely you do), it may have been sent unencrypted, open for anyone nearby to see.
It gets worse. Some VPN providers, in order to save money on bandwidth will implement split-tunneling where they route HTTPS traffic out the hostile side of the connection rather than via the VPN tunnel with the assumption that since it's HTTPS it will be protected. A shockingly high number of applications including more than two dozen banking apps I've reviewed in the last 18 months fail to properly validate the public certificate provided by the server during the TLS handshake and allow self-signed certs like those generated by SSLSplit. In the context of free WiFi and a VPN provider that routes HTTPS traffic out the hostile side of the connection in a split-tunneling model it is possible for a man in the middle (MitM) to have full control over the HTTPS application traffic.
One of the first things you should do if you have a VPN solution is to make sure, via HTTPS that your IP address is the actual IP address of the VPN provider:
https://www.google.com/?gws_rd=ssl#safe=off&q=what+is+my+ip+...
Re: Even with a VPN, open Wi-Fi exposes users
#28AFAIK this behaviour is caused by VPNs appearing to the OS like another network interface next to the existing "real" one, and applications usually don't give you the option of forcing them to bind to a specific interface. Otherwise they'd just behave like there was no connection before the VPN establishes one.
Re: Even with a VPN, open Wi-Fi exposes users
#29This problem goes back to the STU-III telephone where Soviets said best attack was listening to what was said between opening the line and going secure. The lesson learned was we have two choices: (a) device is secured the moment you activate it; (b) the interface between trusted and untrusted (Red/Black separation) blocks as much data is needed until the secure link is established then forces everything over it. The latter is the solution here and their recommendations are pretty good.
There's another risk, though: the WiFi layer and TCP/IP stacks themselves. These might be hacked and WiFi is regularly by NSA per leaks. This is why high assurance wireless VPN's they endorse use a dedicated device for secure wifi connections. It works as follows: a device/chip for trusted data with a physical connection to PC; a secure chip in middle for crypto & control logic; a device/chip for untrusted code (esp Wifi driver) and data with connection to antenna. Some use separation kernels instead of different chips these days. The device is programmed to not let "trusted" data through until (a) untrusted chip says wireless is working and (b) VPN is established in middle chip. It can be modified to deal with captive portals although that creates potential covert channels or attacks. Maybe one can tie a sandboxed browser to the untrusted chip for approving the terms. It and the channel are killed the moment Internet is reachable. More work needs to be done in this area.
Regular setups not worried about targeted hacks will probably be fine following the advice in the article. People worried about targeted attacks rarely use Windows anyway haha.
Re: Even with a VPN, open Wi-Fi exposes users
#30Year after year, decade after decade, all manner of security problems are avoided by running (al)pine on a remote server that I ssh to. Also, use is about ten times faster than a web client.
Web clients are no less secure, since browsers actually check the certificates. It's native (desktop & mobile) apps using unauthenticated IMAP or POP3 connections that are vulnerable.
That said, I use the exact same approach; and Alpine is actually pretty usable even from an Android tablet, especially since JuiceSSH lets you create shortcuts that automatically connect to the server and run "exec alpine".