Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What we give away when we log on to a public Wi-Fi network

decorrespondent.nl

Post reply on HN
Print view View original

101–110 of 112 posts

Re: What we give away when we log on to a public Wi-Fi network

#101

Post by voltagex_ »

lucb1e wrote: post #27
xamolxix wrote: post #10

Considering how ridiculously cheap an anonymous VPN service is these days I am surprised how many people do not use them.

> Considering how ridiculously cheap an anonymous VPN service is You're already paying for your Internet connection at home, why bother getting another VPN service? At least in our FritzBox (free from the ISP) you can configure VPN. And besides, I trust the established ISPs here more than RandomSuperVPN Inc.

Depending on where you are in the world, home/SoHo broadband might not have enough upstream (1 megabit is common in Australia) to support a VPN - however it might be enough to do your banking or whatever. Now to make it user friendly.

Re: What we give away when we log on to a public Wi-Fi network

#102

Post by uberneo »

lucb1e wrote: post #19
xamolxix wrote: post #13

Earlier quoted context omitted.

I suspect it's not plain old sniffing. He might give fake DNS records to point to his own phishing site (facebook clone). It's trivial to re-post the credentials to the real facebook check the password and then actually log them in. curl can be used to do this, as I am sure many others. Edit: SSL does not have to be used on the clone. Most people will not notice/care.

You can't spoof a certificate with DNS. Even if you spoofed a DNS response and made facebook.com point to 192.168.1.2 then the server at 192.168.1.2 (which could be yours) would still need a valid certificate for facebook.com. The only way to have done this is by having the user click "continue" or "ignore" or something on an ssl error page. I know from experience that a company full of programmers will happily do th…

SSL Strip does works here

Re: What we give away when we log on to a public Wi-Fi network

#103

Post by eeZi »

voltagex_ wrote: post #98
jMyles wrote: post #48

Here's what I wrote last time this was posted ( https://news.ycombinator.com/item?id=8457167 ), with some edits to respond to other comments made in this thread: An interesting read, but sparse enough on details to be basically useless. Additionally, there's nothing that I can discern to be new here. The following is demonstrated, all of which are known (and in fact obvious) to people with even an elementary understa…

Without setting up an evil-twin network, if the wifi network has client isolation turned on (i.e clients are only able to speak to the router), is it possible to perform ARP spoofing still?

Client isolation means, in most cases, that the router drops incoming packets on the wifi interface with a destination MAC address which is known to be on the same interface, effectively preventing wireless clients from communicating with each other. This prevents ARP spoofing if it's properly implemented.

This only help against MitM attacks, though. An attacker can still passively sniff traffic.

Re: What we give away when we log on to a public Wi-Fi network

#104

Post by eeZi »

ambrop7 wrote: post #68

Most people don't understand the WPA PSK security model and its insufficiency for anything but private networks where every device is trusted. When you give someone the PSK, you give them the capability to impersonate the access point. That being said, is there any better solution for public networks? One where giving someone a password doesn't let them impersonate you. I'm not sure how good support for EAP-TLS is on…

> When you give someone the PSK, you give them the capability to impersonate the access point.

And to passively decrypt all network traffic.

Re: What we give away when we log on to a public Wi-Fi network

#105

Post by eli »

andrewstuart2 wrote: post #63
eli wrote: post #31

Earlier quoted context omitted.

How sure are you that your cheap anonymous VPN isn't malicious and hasn't been hacked? Is that more or less likely than an attacker being on the same physical wireless network as you?

Well, 'cuz I set it up myself? Mine is running on a home server but it would be just as easy to set up a $5/mo. VPS and set up OpenVPN.

That doesn't sound like an "anonymous" vpn

Re: What we give away when we log on to a public Wi-Fi network

#106

Post by jMyles »

malandrew wrote: post #96
jMyles wrote: post #48

Here's what I wrote last time this was posted ( https://news.ycombinator.com/item?id=8457167 ), with some edits to respond to other comments made in this thread: An interesting read, but sparse enough on details to be basically useless. Additionally, there's nothing that I can discern to be new here. The following is demonstrated, all of which are known (and in fact obvious) to people with even an elementary understa…

Seems like the moment a trusted wifi network is connected to, the system should try to geolocate itself and figure out if it is likely to be the same network. Knowing what other networks are around is another approach. e.g. if I connect to network A, when networks B, K, L, T, U and X are all visible, the next time I connect to A, I can be reasonably certain that A is the same A as before if I see at least xx% of the…

Agreed. This seems like a good basis for a warning at the OS UI level.

Re: What we give away when we log on to a public Wi-Fi network

#107

Post by andrewstuart2 »

eli wrote: post #105
andrewstuart2 wrote: post #63

Earlier quoted context omitted.

Well, 'cuz I set it up myself? Mine is running on a home server but it would be just as easy to set up a $5/mo. VPS and set up OpenVPN.

That doesn't sound like an "anonymous" vpn

True. But I'm able to send all traffic through an encrypted tunnel so that nobody listening locally can get their hands on it. And if I wanted to, I could then tunnel all traffic over some other service to anonymize it.

Re: What we give away when we log on to a public Wi-Fi network

#108

Post by cbsmith »

ris wrote: post #76
cbsmith wrote: post #65

Earlier quoted context omitted.

That's good, because now you are just broadcasting your phone's SSID & MAC everywhere. ;-) Seriously, just VPN over the hotspot.

You have too much trust in your VPN provider.

Considering I look at his face in the mirror every morning when I get up, I feel like that trust is justified.

Re: What we give away when we log on to a public Wi-Fi network

#109

Post by iancarroll »

ma2rten wrote: post #66
iancarroll wrote: post #28

Earlier quoted context omitted.

https://hstspreload.appspot.com/ says they don't use HSTS as a preload. They should...

Google.com also doesn't seem to have it.

Google only uses a certificate pin and doesn't force SSL. Sadly.

Re: What we give away when we log on to a public Wi-Fi network

#110

Post by collyw »

colinbartlett wrote: post #16
HorizonXP wrote: post #12

Earlier quoted context omitted.

Because it's difficult to setup and configure for most people? People struggle with connecting their laptops/tablets to WiFi. Expecting them to configure a VPN on their own is a stretch. You could start a small SaaS business that could make "lifestyle business" type money if you did this well.

PrivateInternetAccess.com gives you an installer with all the credentials in it ready to go. It was so easy my dad could do it. I don't think ease is a barrier anymore. I think it's just lack of education about how necessary these measures are.

As a developer, I would actually have to read up to know exactly what a VPN is and what I can do with it. I have a rough idea, but as it has never been something I have worked with, I have little knowledge of them. Now how would you expect the general public to manage, without someone giving them a decent explanation of them.
Post reply on HN