Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Want to use my wifi?

thejh.net

Post reply on HN
Print view View original

11–20 of 57 posts

Re: Want to use my wifi?

#11

Post by tlrobinson »

IgorPartola wrote: post #4

Using a browser in incognito mode does none of the sort. You can still enter your password into it and it can be stolen just as easily. The true solution is to only browse over HTTPS, connect to a VPN or not use untrusted networks. Note that if I can spoof an IP address, I can send you bogus DNS replies, and send you to a web server that impersonates Google/Facebook/etc. but does not require HTTPS (unless they use th…

I assumed the author meant you should only use incognito mode AND only browse public (non-login) sites or HTTPS sites.

Re: Want to use my wifi?

#12

Post by IgorPartola »

tlrobinson wrote: post #11
IgorPartola wrote: post #4

Using a browser in incognito mode does none of the sort. You can still enter your password into it and it can be stolen just as easily. The true solution is to only browse over HTTPS, connect to a VPN or not use untrusted networks. Note that if I can spoof an IP address, I can send you bogus DNS replies, and send you to a web server that impersonates Google/Facebook/etc. but does not require HTTPS (unless they use th…

I assumed the author meant you should only use incognito mode AND only browse public (non-login) sites or HTTPS sites.

Heh, well what's the fun in that? Plus their remarks make it seem that it can somehow prevent passwords from being seen which is what got me to comment in the first place.

Re: Want to use my wifi?

#13

Post by tcas »

culturestate wrote: post #10
malandrew wrote: post #9

Earlier quoted context omitted.

How easy is it to fully automate VPN only computer usage so that everything I do comes out of a machine at Amazon EC2 for example? I've never set it up and was curious what others have done to make it as invisible as possible.

If you're on a Mac, it's nearly plug-and-play — I use a small menubar app called sidestep[1] that automatically tunnels over SSH, but there are also a few (Viscosity comes to mind) that work in a similar fashion with OpenVPN. There may be similar bits available for Windows, but I haven't looked into it there in some time. 1. https://github.com/chetan51/sidestep

Haven't used sidestep, but sshuttle [1] is a nice command line utility that does the same, just not automatically.

Much easier than setting up a VPN server.

[1] https://github.com/apenwarr/sshuttle

Re: Want to use my wifi?

#14

Post by chrissnell »

I've been thinking about the possibility of injecting a JavaScript bitcoin miner into every page loaded through my access point. Imagine the possibilities for an open AP that's located in a very public place, like Times Square, or near a busy Starbucks (where access is slow and unreliable).

If you really wanted to take this to the evil next level, you'd just break one (or several) WPA keys on nearby APs and have your rouge injector AP act as both an open AP (to unsuspecting users) and a client (using cracked keys) to other APs, thus avoiding having to actually buy internet access for this spot. You'd essentially just need to find a place to hide and power your evil AP.

Re: Want to use my wifi?

#16

Post by MichaelGG »

chrissnell wrote: post #14

I've been thinking about the possibility of injecting a JavaScript bitcoin miner into every page loaded through my access point. Imagine the possibilities for an open AP that's located in a very public place, like Times Square, or near a busy Starbucks (where access is slow and unreliable). If you really wanted to take this to the evil next level, you'd just break one (or several) WPA keys on nearby APs and have your…

Is that even remotely lucrative? As I understand, even a $300 GPU is orders of magnitude more powerful than any CPU miner, let alone a JavaScript based one. And even a single GPU isn't remotely competitive these days compared to the GPU farms and now ASIC setups. So you'd need to inject JS into, I dunno, a million, devices to make anything worthwhile.

Re: Want to use my wifi?

#17

Post by MichaelGG »

malandrew wrote: post #9
IgorPartola wrote: post #4

Using a browser in incognito mode does none of the sort. You can still enter your password into it and it can be stolen just as easily. The true solution is to only browse over HTTPS, connect to a VPN or not use untrusted networks. Note that if I can spoof an IP address, I can send you bogus DNS replies, and send you to a web server that impersonates Google/Facebook/etc. but does not require HTTPS (unless they use th…

How easy is it to fully automate VPN only computer usage so that everything I do comes out of a machine at Amazon EC2 for example? I've never set it up and was curious what others have done to make it as invisible as possible.

If you really want to make it safe, I'd suggest using something with virtual networking (e.g. VMware) and configure a small VM to be your gateway. That way you can have a stripped down, firewalled configuration, with nearly no possibility that a local accident or compromise can evade your traffic policies. Otherwise, if your VPN drops, you run the risk that the system might just start sending traffic out over the public Internet (after all, it has to do so to connect to the VPN).

Re: Want to use my wifi?

#18

Post by jzzskijj »

IgorPartola wrote: post #12
tlrobinson wrote: post #11

Earlier quoted context omitted.

I assumed the author meant you should only use incognito mode AND only browse public (non-login) sites or HTTPS sites.

Heh, well what's the fun in that? Plus their remarks make it seem that it can somehow prevent passwords from being seen which is what got me to comment in the first place.

You're not following:

"If you have saved your login data on any plain-HTTP site that the attacker knows of, he can use his JS shell in the news site to load the site with the login form in an iframe, then inject another JS shell into the iframe and use that to read the password that the browser fills in."

As far as I know incognito mode wont autofill those saved credentials. I think that was the point how incognito mode prevents this kind of attack.

In this attack the user doesn't have to access those HTTP sites with stored credentials by themselves while being connected to the evil network, because the injected script does that for you behind the scenes.

Re: Want to use my wifi?

#19

Post by dave1010uk »

MichaelGG wrote: post #16
chrissnell wrote: post #14

I've been thinking about the possibility of injecting a JavaScript bitcoin miner into every page loaded through my access point. Imagine the possibilities for an open AP that's located in a very public place, like Times Square, or near a busy Starbucks (where access is slow and unreliable). If you really wanted to take this to the evil next level, you'd just break one (or several) WPA keys on nearby APs and have your…

Is that even remotely lucrative? As I understand, even a $300 GPU is orders of magnitude more powerful than any CPU miner, let alone a JavaScript based one. And even a single GPU isn't remotely competitive these days compared to the GPU farms and now ASIC setups. So you'd need to inject JS into, I dunno, a million, devices to make anything worthwhile.

You could probably use WebCL, Flash or Silverlight to use the user's GPU. A quick Google shows this has been done with WebCL already: http://webcl.nokiaresearch.com/jsoclbm/

Re: Want to use my wifi?

#20

Post by loser777 »

Situations like these are how I justify keeping a low power 24/7 box on at home. In situations where I don't have my own (trusted) connection, I'll just ssh tunnel a SOCKS5 proxy to my home server. I only have a residential internet connection at home, but 2mbps is surprisingly snappy for casual or emergency on the go web browsing. With boxes out there (e.g. rPi) that push power consumption far south of 10W, it makes even more sense to do this now.

Of course, it also doubles as an IRC idler/whatever else you can think of.

Post reply on HN