Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What we give away when we log on to a public Wi-Fi network

decorrespondent.nl

Post reply on HN
Print view View original

41–50 of 112 posts

Re: What we give away when we log on to a public Wi-Fi network

#41

Post by chimeracoder »

poopchute wrote: post #26
xamolxix wrote: post #18

Earlier quoted context omitted.

Private internet access (dot com) provide a point and click interface for windows and mac os x. On linux one has to manually config but it's not that hard. I have had non-technical people use it with no issues. I am sure there are others out there. I am not associated with them in any way.

I use that on my desktop and laptop but trying to get it to connect on my nexus 5 was a nightmare - I eventually gave up.

Both Private Internet Access[0] and VyprVPN[1] have apps on the Play store, which are completely plug-and-play.

[0] https://play.google.com/store/apps/details?id=com.privateint...

[1] https://play.google.com/store/apps/details?id=com.goldenfrog...

Re: What we give away when we log on to a public Wi-Fi network

#42

Post by goblin89 »

I wonder if it's true that iOS 8 only randomizes device's MAC when the SIM cart is not installed[0]. Was stoked to learn about this feature, too bad it apparently doesn't work as you'd expect it to.

[0] http://9to5mac.com/2014/09/26/more-details-on-how-ios-8s-mac...

Re: What we give away when we log on to a public Wi-Fi network

#43

Post by userbinator »

victorvation wrote: post #15
fredsted wrote: post #4

Are my devices really broadcasting the SSIDs they have been connecting to?

Yep. Whenever wifi is enabled, your device is sending out probe request frames, which includes your list of preferred networks/networks you've connected to before.

It's called "active scan", and it's one of the default behaviours that I'd really like an option to disable, since (unless you hide the SSID) APs will broadcast beacon frames announcing their presence anyway.

At least for Android, someone else agrees: http://code.google.com/p/android/issues/detail?id=65890

Re: What we give away when we log on to a public Wi-Fi network

#44

Post by leepowers »

sktrdie wrote: post #6

How was the hacker able to get Facebook credentials? Facebook uses HTTPS and so does Live.com. Even if I'm connected to a malicious router, only me and Facebook know about the data we're sending each other. Am I missing something or should the author of this article provide more evidence on the type of attack?

If an attacker controls the access point he could do the following:

* Redirect all HTTPS traffic to an HTTP spoof site. Many users probably wouldn't notice.

* If the attacker has access to a short, 2-3 character domain, they could redirect to a wildcard HTTPS connection like, https://facebook.aa.com/ - again, many users wouldn't notice. They'd see "facebook" and the lock icon and assume they're ok.

* In either case the attacker could simply proxy all HTTP requests from victim to Facebook (or any other site). So the user's browsing experience remains the same but all passwords, cookies and personal info are logged. Scary stuff!

Re: What we give away when we log on to a public Wi-Fi network

#45

Post by HorizonXP »

chimeracoder wrote: post #41
poopchute wrote: post #26

Earlier quoted context omitted.

I use that on my desktop and laptop but trying to get it to connect on my nexus 5 was a nightmare - I eventually gave up.

Both Private Internet Access[0] and VyprVPN[1] have apps on the Play store, which are completely plug-and-play. [0] https://play.google.com/store/apps/details?id=com.privateint... [1] https://play.google.com/store/apps/details?id=com.goldenfrog...

The names of those apps are totally unfriendly and off-putting.

TBH, this is a combination of being a usability issue (solvable) and marketing/branding issue (solvable, but not as easily.)

Re: What we give away when we log on to a public Wi-Fi network

#46

Post by tim333 »

byoung2 wrote: post #38

All names in this article are fictitious, except for Wouter Slotboom’s I thought for sure that name was fake!

Wouter is easy to google. You can see him and his black box here (although the sound is in Dutch)

http://www.rtlnieuws.nl/editienl/betrapt-door-wifi-ik-ga-vre...

Re: What we give away when we log on to a public Wi-Fi network

#47

Post by tim333 »

HorizonXP wrote: post #12
xamolxix wrote: post #10

Considering how ridiculously cheap an anonymous VPN service is these days I am surprised how many people do not use them.

Because it's difficult to setup and configure for most people? People struggle with connecting their laptops/tablets to WiFi. Expecting them to configure a VPN on their own is a stretch. You could start a small SaaS business that could make "lifestyle business" type money if you did this well.

hotspotshield.com is pretty easy and can be free if you are willing to put up with a bunch of annoying advertising

Re: What we give away when we log on to a public Wi-Fi network

#48

Post by jMyles »

Here's what I wrote last time this was posted (https://news.ycombinator.com/item?id=8457167), with some edits to respond to other comments made in this thread:

An interesting read, but sparse enough on details to be basically useless. Additionally, there's nothing that I can discern to be new here. The following is demonstrated, all of which are known (and in fact obvious) to people with even an elementary understanding of how wifi and TLS work:

* That wifi probes are public

* That wifi devices, by default, expose reasonably reliable evidence about their type and origin via their MAC address

* That many OS's automatically connect to 'trusted' wifi networks, regardless of their apparent physical location

* That many websites don't have TLS by default (or at all)

* That, if a user connects to a network you control and requests a URL not beginning with "https," it is trivial to present them with a fake page looking like the one to which they thought they were browsing (of course they won't see a lock) --(note: if the website has HTTP Strict Transport Security enabled and the user has previous visited that website with a supporting browser, then this part is non-trivial)

* That, if a user transmits unencrypted plain text over a wifi network to which you have access, it's trivial to glean the content of their transmission.

None of this is news, and it's all that this article seems to point out. Even more bizarre is that, almost without exception, it merely leaves these items implied, failing to describe the mechanism of action.

Re: What we give away when we log on to a public Wi-Fi network

#49

Post by janinge »

userbinator wrote: post #43
victorvation wrote: post #15

Earlier quoted context omitted.

Yep. Whenever wifi is enabled, your device is sending out probe request frames, which includes your list of preferred networks/networks you've connected to before.

It's called "active scan", and it's one of the default behaviours that I'd really like an option to disable, since (unless you hide the SSID) APs will broadcast beacon frames announcing their presence anyway. At least for Android, someone else agrees: http://code.google.com/p/android/issues/detail?id=65890

For iOS you can use iPhone Configuration Utility or similar to add profiles for WiFi-networks, and set their SSIDs to be always broadcasting. That option should make it so that those names aren't included in the active scans, if it is to make any sense.
Post reply on HN