51–60 of 76 posts
SSH, with SOCKS tunneling (and the FoxyProxy extension with Firefox, although I normally use Google Chrome). Works on Windows/Mac OS X/Linux. Note that this doesn't necessarily fix DNS sniffing and whatnot. If I was paranoid, I'd bother to set up a VPN and use that. If I'm extremely paranoid, I use Tor (which may have some security concerns).
Set network.proxy.socks_remote_dns to true in about:config for Firefox to do DNS requests over SOCKS.
For more robust solutions I set up my own openvpn instance on a home server which I can use that from any coffee shop and I have a Witopia account (which I use when abroad as they have servers all over the world which speeds things up a bunch). I make the greatest use of Witopia from within China as they have servers in Hong Kong.
Easy, I open up a terminal and type: start_vpn It's a script which fires up an openvpn connection to a vps I have. Getting openvpn working took about a day of hacking around on my vps and my mac. (just read the openvpn tutorial and follow the steps.) I still haven't gotten openvpn working on Windows but it's not something I've never needed.
I don't host my own server though, I use http://witopia.net I think I pay like $50-60/yr. But they give you a bunch of servers to connect to worldwide: http://cl.ly/2zEY
Very similar to ax0ns setup.
Earlier quoted context omitted.
In Linux, most applications respect the http_proxy environment variable. It's the closest thing Linux has to a system-wide proxy setting as found in the more mainstream platforms.
This is actually how I use Chromium with a proxy right now, but it requires that I launch it from the command line and manually specify the http_proxy (and https_proxy) variables (/usr/bin/env http_proxy=" http://127.0.0.1:8080 https_proxy=" https://127.0.0.1:8080 /usr/bin/chromium). I suppose I could set up some kind of script to launch Chromium (and all other applications) that would check if I'm on my home network…
For remote access and Internet access over wifi for non-SOCKSable stuff I use Strongswan. I have a small scale darknet set up with it (just me and a few friends) so it's already there for me, but I wouldn't recommend it unless you know your stuff.
Earlier quoted context omitted.
In Linux, most applications respect the http_proxy environment variable. It's the closest thing Linux has to a system-wide proxy setting as found in the more mainstream platforms.
This is actually how I use Chromium with a proxy right now, but it requires that I launch it from the command line and manually specify the http_proxy (and https_proxy) variables (/usr/bin/env http_proxy=" http://127.0.0.1:8080 https_proxy=" https://127.0.0.1:8080 /usr/bin/chromium). I suppose I could set up some kind of script to launch Chromium (and all other applications) that would check if I'm on my home network…
I guess my question would be: What additional threat do you thing public wifi poses, as opposed to any other internet access? IMHO, you have to assume that any unencrypted traffic over the internet could be sniffed, etc. The only additional threats I can see would be threats against your PC directly, rather than your traffic. Am I wrong?
As I understand it unsecured public WiFi is significantly more threatening when compared to standard hard-wired Ethernet as all your traffic is visible to any other user connected to the same network with a packet sniffer. It's much, much harder (but not impossible) to do this on a hard-wired connection - there's a useful discussion as to why here: http://news.ycombinator.com/item?id=1828201
That's why I said that the only additional risks I can see of an public Wifi is local attacks directly against your machine such as someone port scanning your laptop to look for vulnerable service or open fileshares, etc.
My long answer is here: http://www.h-i-r.net/2008/08/defcon-paranoia.html The short answer: I back up my data. I encrypt all sensitive data on my laptop and don't access it in uncontrolled environments. I tunnel everything (usually with OpenSSH Dynamic Proxy) and then I run a firewall ruleset on my laptop that: 1) Permits tunneling to my server, 2) Permits anything on localhost, 3) Blocks all other incoming or outgoi…
Is there any way to do this at the network device level (on Linux) so that individual applications don't have to be configured to use the proxy? That's the main source of my reluctance to do this.