Even with a VPN, open Wi-Fi exposes users • Hacker News Board

Re: Even with a VPN, open Wi-Fi exposes users

#31

Post by icebraining » Sat, Jun 13, 2015, 4:03 PM UTC

kijin wrote: post #12

> Do you use a POP3 or IMAP e-mail client? If they check automatically, that traffic is out in the clear for all to see, including potentially the login credentials. Other programs, like instant messaging client, may try to log on. That sounds overly pessimistic. Most POP3/IMAP email services nowadays support TLS, and some don't even work unless you use TLS. Most email clients, likewise, are designed to use TLS by de…

Most POP3/IMAP email services nowadays support TLS, and some don't even work unless you use TLS. Most email clients, likewise, are designed to use TLS by default when you first set up an account. If yours isn't, complain to the developer(s).

Using TLS isn't enough, the clients needs to check the certificate. I know that K-Mail does, but I wouldn't bet on every mail client out there doing so.

Re: Even with a VPN, open Wi-Fi exposes users

#32

Post by icebraining » Sat, Jun 13, 2015, 4:03 PM UTC

tomjen3 wrote: post #17

That is one of the nice thins about the VPN provider I use - not only do they not keep any logs, but all you have to do is click a single checkbox and then you have no internet unless the vpn is connected.

That is one of the nice thins about the VPN provider I use - not only do they not keep any logs

How do you know?

Re: Even with a VPN, open Wi-Fi exposes users

#33

Post by We2soRae » Sat, Jun 13, 2015, 4:32 PM UTC

It's fairly easy with Little Snitch to prevent internet access for most apps until VPN is on. Oldie but goodie: http://asciithoughts.com/posts/2014/02/15/using-little-snitc...

Re: Even with a VPN, open Wi-Fi exposes users

#34

Post by click170 » Sat, Jun 13, 2015, 5:01 PM UTC

walterbell wrote: post #2

Always-on VPN (which blocks non-VPN connections) seems to be possible on iOS if the device is supervised/managed and connected to an IKEv2 VPN, http://www.howtogeek.com/218851/how-to-enable-always-on-vpn-...

Android also has an AlwaysOnVPN option which I understand also mitigates this.

The VPN simply won't connect if there is a portal because non VPN connections (eg to the portal) are forbidden, and the device won't allow any network traffic until the tunnel is up and established.

Its quite nice actually, and if you're worried about speed issues, host the server on a VPS you trust.

Re: Even with a VPN, open Wi-Fi exposes users

#35

Post by click170 » Sat, Jun 13, 2015, 5:06 PM UTC

wtbob wrote: post #19

> The Wi-Fi Alliance has had a solution for this problem nearly in place for years, called Passpoint. The Passpoint protocol was created to allow for Wi-Fi "roaming" by creating a way for access points to grant access by way of a third-party credential, such as your Google ID or your ISP account. Ummm, seems like the cure is worse than the disease. So, the suggested response to leaking information via HTTP (and what…

That's why I don't wonder why this hasn't been adopted yet. I dont know what the target demographic for the feature is but it really doesn't seem like it was intended for public WiFi hotspots, instead maybe it was for corporate guest networks or something that wants above average accountability.

I'm certainly not going to let Google or my ISP know which WiFi hotspots I connect from though. Thanks to always on VPN they only see my VPN server IP.

Re: Even with a VPN, open Wi-Fi exposes users

#36

Post by walterbell » Sat, Jun 13, 2015, 5:45 PM UTC

lucb1e wrote: post #16

TL;DR: You usually first have to accept the WiFi network's terms of service on a special page (called a captive portal) before you get Internet access. Until you do that, VPN doesn't work, and by then your email program (or anything else) may already have checked for new messages. If you have a password for your email account (which surely you do), it may have been sent unencrypted, open for anyone nearby to see.

On a laptop which frequently faces this threat, network access can be restricted to VMs which are isolated by use case:

  - host outbound traffic disabled except security updates & VMs
  - non-persistent "browser VM" for captive portal login
  - non-persistent VPN VM
  - user data VM(s), virtual NIC routed only to VPN VM

This can be done with VMware, Parallels, Qubes, Xen, KVM, etc.

Re: Even with a VPN, open Wi-Fi exposes users

#37

Post by gwu78 » Sat, Jun 13, 2015, 6:07 PM UTC

steckerbrett wrote: post #7

zimbatm wrote: post #4

Windows is a step ahead of OSX with it's Private/Public networks distinction. Having little snitch installed on OSX it's staggering to see how many core services are trying to access external services, most of them on port 80. In both cases we're still lacking good representations of network traffic. If things didn't happen in the dark in the background users would probably be more concerned and watchful.

Little Snitch is one of my favorite pieces of software, it is truly amazing how noisy most software is. Without it, your ISP knows even what programs you have open because they call home every 15 minutes for stupid reasons.

"... stupid reasons."

Do you think developers assume you will not notice or will not care?

In my experience, most if not all of this software uses DNS for the attempted dial outs. Running my own DNS makes blocking easy.

Re: Even with a VPN, open Wi-Fi exposes users

#38

Post by rsync » Sat, Jun 13, 2015, 6:46 PM UTC

icebraining wrote: post #30

rsync wrote: post #22

Year after year, decade after decade, all manner of security problems are avoided by running (al)pine on a remote server that I ssh to. Also, use is about ten times faster than a web client.

Web clients are no less secure, since browsers actually check the certificates. It's native (desktop & mobile) apps using unauthenticated IMAP or POP3 connections that are vulnerable. That said, I use the exact same approach; and Alpine is actually pretty usable even from an Android tablet, especially since JuiceSSH lets you create shortcuts that automatically connect to the server and run "exec alpine".

"Web clients are no less secure, since browsers actually check the certificates."

Only if you're pinning the cert...

ssh does not rely on a hazy collection of 500+ middlemen that includes several rogue governments and very poorly behaved corporations to give you the "lock icon". In ssh, the key matches perfectly or it doesn't.

SSL ? Not so much ...

Re: Even with a VPN, open Wi-Fi exposes users

#39

Post by mingabunga » Sat, Jun 13, 2015, 11:05 PM UTC

HideAway from www.firetrust.com is an always connected vpn, so gets around this issue. It offers rules for websites and applications so can always be on

Re: Even with a VPN, open Wi-Fi exposes users

#40

Post by metasean » Sun, Jun 14, 2015, 1:13 AM UTC

tokenizerrr wrote: post #24

metasean wrote: post #10

Earlier quoted context omitted.

I love Tunnelbear, but I assure you their vigilant mode is far from perfect. In particular, I take a train to and from work. When the network goes down, and it goes down several times every trip, sometimes Tunnelbear goes into vigilant mode, but it frequently doesn't - i.e. I can absolutely connect to sites from the open wifi while the Tunnelbear icon is spinning up a fresh connection but before it has fully secured…

I looked at PDANet and I don't realy understand... My Android phone (galaxy s6) can do all that by default under Settings->Tethering and Hotspot. I do live in Europe though and I've never heard about a "tether plan". Is that some American weirdness maybe?

I wasn't aware that it was an American weirdness, but phone carriers here can, and mostly do, charge us to tether our phone to another device [1]. There is at least one legal exception, where consumers whose data is transmitted via the 700 MHz frequency band can not be charged for tethering [2]

[1] https://en.wikipedia.org/wiki/Tethering#United_States_of_Ame... ; It looks like the U.K. has similar tethering charges

[2] https://en.wikipedia.org/wiki/United_States_2008_wireless_sp...