Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What we give away when we log on to a public Wi-Fi network

decorrespondent.nl

Post reply on HN
Print view View original

21–30 of 112 posts

Re: What we give away when we log on to a public Wi-Fi network

#21

Post by micampe »

HorizonXP wrote: post #12
xamolxix wrote: post #10

Considering how ridiculously cheap an anonymous VPN service is these days I am surprised how many people do not use them.

Because it's difficult to setup and configure for most people? People struggle with connecting their laptops/tablets to WiFi. Expecting them to configure a VPN on their own is a stretch. You could start a small SaaS business that could make "lifestyle business" type money if you did this well.

It's not difficult. I use Cloak https://www.getcloak.com you install the app and you are done.

People are just not aware of these problems, and when you tell them they often downplay them, because they seem far away and until something goes wrong they think it can't happen to them. Also, it's not easy to convince people to pay for prevention rather than to fix an existing issue.

Re: What we give away when we log on to a public Wi-Fi network

#22

Post by bdg »

victorvation wrote: post #15
fredsted wrote: post #4

Are my devices really broadcasting the SSIDs they have been connecting to?

Yep. Whenever wifi is enabled, your device is sending out probe request frames, which includes your list of preferred networks/networks you've connected to before.

Wow... And I was thinking that using my phone to hotspot in cafes was mitigating things like that. Thanks for sharing!

Re: What we give away when we log on to a public Wi-Fi network

#24

Post by MisterNegative »

lucb1e wrote: post #19
xamolxix wrote: post #13

Earlier quoted context omitted.

I suspect it's not plain old sniffing. He might give fake DNS records to point to his own phishing site (facebook clone). It's trivial to re-post the credentials to the real facebook check the password and then actually log them in. curl can be used to do this, as I am sure many others. Edit: SSL does not have to be used on the clone. Most people will not notice/care.

You can't spoof a certificate with DNS. Even if you spoofed a DNS response and made facebook.com point to 192.168.1.2 then the server at 192.168.1.2 (which could be yours) would still need a valid certificate for facebook.com. The only way to have done this is by having the user click "continue" or "ignore" or something on an ssl error page. I know from experience that a company full of programmers will happily do th…

If you don't type the https url, you start by visiting the http website. Normally the http version will redirect to https, but a man in the middle can easily prevent this.

Re: What we give away when we log on to a public Wi-Fi network

#25

Post by lucb1e »

MisterNegative wrote: post #24
lucb1e wrote: post #19

Earlier quoted context omitted.

You can't spoof a certificate with DNS. Even if you spoofed a DNS response and made facebook.com point to 192.168.1.2 then the server at 192.168.1.2 (which could be yours) would still need a valid certificate for facebook.com. The only way to have done this is by having the user click "continue" or "ignore" or something on an ssl error page. I know from experience that a company full of programmers will happily do th…

If you don't type the https url, you start by visiting the http website. Normally the http version will redirect to https, but a man in the middle can easily prevent this.

Yes! I just thought of this and was going to edit it in, but you are quicker. Many websites still don't use HSTS, and in any case this article is from a few months ago (I remember reading it) and HSTS is pretty new.

Re: What we give away when we log on to a public Wi-Fi network

#26

Post by poopchute »

xamolxix wrote: post #18
HorizonXP wrote: post #12

Earlier quoted context omitted.

Because it's difficult to setup and configure for most people? People struggle with connecting their laptops/tablets to WiFi. Expecting them to configure a VPN on their own is a stretch. You could start a small SaaS business that could make "lifestyle business" type money if you did this well.

Private internet access (dot com) provide a point and click interface for windows and mac os x. On linux one has to manually config but it's not that hard. I have had non-technical people use it with no issues. I am sure there are others out there. I am not associated with them in any way.

I use that on my desktop and laptop but trying to get it to connect on my nexus 5 was a nightmare - I eventually gave up.

Re: What we give away when we log on to a public Wi-Fi network

#27

Post by lucb1e »

xamolxix wrote: post #10

Considering how ridiculously cheap an anonymous VPN service is these days I am surprised how many people do not use them.

> Considering how ridiculously cheap an anonymous VPN service is

You're already paying for your Internet connection at home, why bother getting another VPN service? At least in our FritzBox (free from the ISP) you can configure VPN. And besides, I trust the established ISPs here more than RandomSuperVPN Inc.

Re: What we give away when we log on to a public Wi-Fi network

#28

Post by iancarroll »

MisterNegative wrote: post #24
lucb1e wrote: post #19

Earlier quoted context omitted.

You can't spoof a certificate with DNS. Even if you spoofed a DNS response and made facebook.com point to 192.168.1.2 then the server at 192.168.1.2 (which could be yours) would still need a valid certificate for facebook.com. The only way to have done this is by having the user click "continue" or "ignore" or something on an ssl error page. I know from experience that a company full of programmers will happily do th…

If you don't type the https url, you start by visiting the http website. Normally the http version will redirect to https, but a man in the middle can easily prevent this.

https://hstspreload.appspot.com/ says they don't use HSTS as a preload. They should...

Re: What we give away when we log on to a public Wi-Fi network

#29

Post by lucb1e »

tcdent wrote: post #5
fredsted wrote: post #4

Are my devices really broadcasting the SSIDs they have been connecting to?

You could brute force it by using common network names and seeing which ones get bites. Take it a step further and generate expected patterns ie. "2WIRE123". I'd expect "linksys" alone would grab a surprising amount to start, though.

> using common network names

Exactly, even if it's not broadcasting network names, almost every student in the Netherlands will have the train's WiFi hotspot in their list of networks.

One thing I still want to check out is whether the laptop will connect to an open network with the same name as a known network that was password protected.

Re: What we give away when we log on to a public Wi-Fi network

#30

Post by johnthedebs »

nandhp wrote: post #23
tcdent wrote: post #17

Earlier quoted context omitted.

Hardware ID/MAC address, for example.

And how would you verify the MAC address of the router at the coffeeshop/train station/bus?

You would have it stored from a prior connection to the network. Of course, it's trivial to spoof that too so the additional check doesn't do any good.
Post reply on HN