Live data from Hacker News

FBI is warning people against using public phone-charging stations

schneier.com

21–30 of 328 posts

Re: FBI is warning people against using public phone-charging stations

#21

There are USB "condom" cables available which do not have data wire. https://www.zdnet.com/article/protect-your-data-with-a-usb-c... I don't have those; I just charge my portable battery first and then charge my devices from the battery.

I haven't seen many of those data blockers that support quick charge and thats pretty important when using some kind of public charging station.

I, like you, charge a portable battery that can refill my phone 2-3x without issue.

Re: FBI is warning people against using public phone-charging stations

#23
post #18

I'v been wondering about the implications of free wifis within airports or such - how much that would be of a worry given you connect only to TLS secured services (and hopefully the phone does it too for every service it connects to in background)

Personally...I run a Linode VPN with openvpn on it listening on port 443.

Anytime I am on an public wifi or untrusted network (including the occaisonal time at my job with a personal device), i connect to that. Since its 443, its generally not blocked, even through the TLS connection is not "standard" because it uses a 2048 bit PSK to as a pre-cursor to start a connection, then a certificate based auth to establish the tunnel.

Its a full tunnel as well so all traffic runs through it. Google/Youtube will sometimes pitch fits and make me do captchas but otherwise its an easier way to shield from stuff like that.

All the wifi provider sees in that case is a single connection to my linode.

Admittedly this is a pretty technical solution though and requires some configuring. Mullvad would probably be an easier option with plenty of endpoints to jump through. Or you can run Tailscale and use SSH/socks proxies, though things like DNS leakage can still occur there.

I will use SSH tunnels and socks proxies for certain browsers that are configured to not store any data locally as well (ie: Firefox). I justify it easily in that I am constantly testing services and sometimes its best to rule out routing, BGP or other low level network issues and using ssh -D 12345 somethign@someplace allows me to do just that in isolated circumstances.

Re: FBI is warning people against using public phone-charging stations

#24

This might be a big advantage for wireless charging. Although it can be slower than a USB charger, there is no risk that it will be doing something other than charging.

Only need a 6 hour layover to take full advantage.

Re: FBI is warning people against using public phone-charging stations

#26

This might be a big advantage for wireless charging. Although it can be slower than a USB charger, there is no risk that it will be doing something other than charging.

Or just replace them with electrical outlets. Why we are using high-risk systems in public infrastructures when low-tech, low-risk systems exist is beyond me.

Re: FBI is warning people against using public phone-charging stations

#28
post #18

I'v been wondering about the implications of free wifis within airports or such - how much that would be of a worry given you connect only to TLS secured services (and hopefully the phone does it too for every service it connects to in background)

in 2023 : none

sites are protected not only wity TLS but also HSTS and the list goes on.

Wi-Fi doesn't include sturdy security mecanisms anyway, so wifi is never safe.

Companies that are serious about network security are recommended to use a second factor, like a VPN, especially on their company network (because they always have ressources that lack protection)

For customers and individuals like us, sites are safe enough not to do that (unless you host your own services)

So the only thing PPL can do on public networks is maybe fingerprinting, and tracking the whereabouts of your devices accross the place (Especially in airports like Istanbul where you need to swipe your passport in a machine to get a wifi code)

But that doesn't prevent me from going to Discord and HN and do banking over public networks.

Re: FBI is warning people against using public phone-charging stations

#29

This might be a big advantage for wireless charging. Although it can be slower than a USB charger, there is no risk that it will be doing something other than charging.

Additional advantage is you can warm your coffee by putting the cup on the phone, for all the hours it will take.

Re: FBI is warning people against using public phone-charging stations

#30
post #2

Just FYI: this is referring to USB charging stations, not EV stations. This advice has been standard in cybersecurity training for a long time now and frankly I'm surprised that this is the first time the FBI has felt the need to issue an advisory on the subject.

I have been somewhat curious if/when this will occur with EV stations as well. What controls might one gain over a car from the charging port on the assorted makes/models? Even hacking aside I am curious what PII, telemetry and tracking data could be pulled from the charge port.

Even if it's not available via the charger they'll just do this with ALPR or their proprietary apps. Gotta love surveillance capitalism.
Post reply on HN