Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stunnel and Airline Wi-Fi

potatofrom.space

Post reply on HN
Print view View original

111–120 of 239 posts

Re: Stunnel and Airline Wi-Fi

#111

Post by ThrowawayR2 »

spydum wrote: post #59
NKosmatos wrote: post #8

Nice post and well written. I’ll have to try something similar with stunner for my office connection (heavily filtered and firewalled), to allow me to reach my raspberry back home.

not sure office == work place, but most workplaces have policies around intentionally bypassing network security/firewall rules. If your workplace has any kind of security operations/threat detection, you could find yourself explaining why exactly your host is reaching out over suspiciously encrypted channels?

Specifically, https://en.wikipedia.org/wiki/Egress_filtering. If the OP's company has restrictive firewalling and filtering already, they also probably have egress filtering and monitoring as well.

Re: Stunnel and Airline Wi-Fi

#112

Post by rebuilder »

judge2020 wrote: post #52
pessimizer wrote: post #23

Earlier quoted context omitted.

I was just bypassing a some trivial key check on the door. To say I was "messing with the door" is FUD, and whether I was breaking and entering is a question for lawyers and a judge.

The owner gave me a key to the lobby so I could pay to get an all-access key. As it turns out, I can just walk past the lobby and that key actually opens all doors in the building. Whether or not it's illegal to use it to access whatever I want is a question for lawyers and a judge.

That's not what's happening here. This is more like trying the key on every door, finding a cleaning closet unlocked and crawling through the ventilation ducts to get in.

Re: Stunnel and Airline Wi-Fi

#113

Post by makefu »

I was pleasantly surprised to see the appropriate NixOS configuration in the middle of the article. NixOS stream-lines the whole configuration process to a couple of lines of configuration which can be copy-pasted without changing anything.

Re: Stunnel and Airline Wi-Fi

#114

Post by MereInterest »

kemitche wrote: post #44
tomxor wrote: post #34

Earlier quoted context omitted.

> However the CFAA simply doesn't work that way. "Authorisation" is what the designers intended, and the initial paywall made that intention perfectly clear. That might be the case but it's also nuts. It encourages litigation over better design and makes public enemies out of security professionals, ultimately driving away those professionals from the US and making US developed tech weak.

It's not nuts when compared to non-tech laws. It's illegal to come into my house and take my stuff even if I forget to lock my back door. If we want to protect security professionals, we should write laws that do so.

I think the local culture needs to be taken into account. Suppose I walk onto your porch, see something I want, and take it with me. That's pretty plainly theft, right? Now suppose I am eight years old, taking candy from a bowl left out on Halloween. That's pretty plainly not theft. To somebody unfamiliar with the cultural practice of trick-or-treating, they might assume that it is theft.

The internet has different cultural norms than physical space. One-to-one analogies are useful for exploring those differences, but not for arguing what they should be. If I have a WiFi connection, leaving it without a password is implicit permission to use it. If I have a server that provides HTTP without authentication, that is implicit permission to access the contents.

That is not to say that people should take advantage of these social norms. If I find a bowl of car keys left on a front porch, even if it is Halloween, I should inform the owner of the house that they probably don't want to do that. If I find incremental IDs that lead to other customers' personal information, I should inform the company, and the other customers if necessary.

Re: Stunnel and Airline Wi-Fi

#115

Post by pmontra »

UperSpaceGuru wrote: post #80

Wow, this was an amusing read. I actually helped architect part of the system that was bypassed at LiveTV (now Thales). We had some serious hackers on the team and discussed how much probing & prodding it would take to find vulnerabilities like this, but made the conclusion anyone doing this should be worried about more serious consequences. I for one, wouldn’t attempt this myself on the aircraft. The hacker side of…

Definitely, but it's worth for them to defend against or go after the few people willing to use this method to get free Wi-Fi on planes? IMHO they'll spend more than what they'll gain.

Re: Stunnel and Airline Wi-Fi

#116

Post by ttul »

PaulAJ wrote: post #25

In the USA this would be a violation of the CFAA https://www.law.cornell.edu/uscode/text/18/1030 . Specifically, the router is a "protected computer" and the procedure described here is "exceeding authorised access" because it routes packets around a mechanism that was designed to stop them. Maximum penalty 5 years. (Some might argue that it was authorised because the computer let him do it. However the CFAA simply d…

Also, it’s plainly fraud.

Re: Stunnel and Airline Wi-Fi

#117

Post by xfitm3 »

UperSpaceGuru wrote: post #80

Wow, this was an amusing read. I actually helped architect part of the system that was bypassed at LiveTV (now Thales). We had some serious hackers on the team and discussed how much probing & prodding it would take to find vulnerabilities like this, but made the conclusion anyone doing this should be worried about more serious consequences. I for one, wouldn’t attempt this myself on the aircraft. The hacker side of…

We shouldn't let defense companies push around the general public. I'm glad that the author is willing to shoulder that risk, we need more people like them.

Re: Stunnel and Airline Wi-Fi

#119

Post by pmontra »

MereInterest wrote: post #105
eslaught wrote: post #95

Earlier quoted context omitted.

Is it though? The adblocker runs locally on your own computer; it certainly prevents the ads from doing what the designer intended, but it doesn't make the designer's computer (or any computer controlled by the ad network) do anything. Versus tracking does actually do something on your computer (e.g. running JS to discover fonts). Arguably that is a circumvention of the intentions of the user on their own hardware.

The problem is that the phrase "exceeds authorized access" does not distinguish between the access increasing beyond the authorization and the authorization decreasing below the current access. Suppose I put in my Terms of Service the phrase "Access to this system is contingent on running the delivered webpage, including all first-party and third-party Javascript, without modification." Now, whether or not the HTTP r…

Some adblockers work outside the browser. They block the hosts with custom /etc/hosts or by using a local proxy that filters out requests to ad servers.

All the js code runs but it doesn't download anything.

Obviously the Terms of Service could prohibit that too.

Re: Stunnel and Airline Wi-Fi

#120

Post by perl4ever »

ht85 wrote: post #69
cabaalis wrote: post #54

Earlier quoted context omitted.

> It's illegal to come into my house and take my stuff even if I forget to lock my back door. For some reason, on HN when I've made this argument before, the resulting comments have been that the internet is somehow different, and that real-world analogies don't exist. Using equipment that you don't own in a way the owners don't intend is apparently well-accepted.

Probably because this is a victimless crime... What he did would be more akin to someone entering your property, having their lunch in your garden and cleaning up before leaving.

Well, mentally ill people sometimes do break into houses and do harmless things, like making a sandwich or taking a shower, and this generally has severe consequences for them even though it was not malicious, and is of course experienced as a shock and/or violation by the owner who discovers it.

It's really weird that this is presented as normal so frequently in a virtual context.

Post reply on HN