Way OT: WIFI Hotspot Security?

News & General Discussion
1

I know this is way off topic, but since we’ve got so many smart and talented folk here I thought I’d ask the group:

Are there any special precautions I should be taking when I access my email and other websites when using a free WIFI hotspot? I will be doing a fair bit of traveling over the next 40 days and will be relying on WIFI hotspots at hotels and coffee shops to check emails and handle my personal affairs. Any advice?

2

Yeah… you really have no idea how many people could get into your system, and they don’t even necessarily need to be computer savy… the tools to steal information like this are pretty common. Avoid public WiFi as much as possible.

3

Unfortunately that is easier said than done when traveling. :frowning:

4

I think it’s fine to use, just don’t access anything critical like your bank account while at Starbucks or wherever. If you are paying for access at your hotel that should be secure enough (as much as your home based wireless connection is, at least).

5

Ok, I’m a network-noob, but why accessing a bank (via SSL) would be insecure on a public network?

6

Haven’t had too much time to post lately and everyone else does such a great job with the Unity related questions, but couldn’t leave this one dangling…

On a public wi-fi network you are probably statistically fairly safe, but an easy target for that n-percent chance there’s a reasonably decent hacker sitting around waiting.

The quick things I personally do while traveling:

  • turn off ALL services in your Network->Sharing preferences
  • turn on the firewall
  • shutdown any non-essential services that you start manually (other apache installations, network servers, etc)
  • keep Rendezvous-enabled apps in check (know what personal tastes you’re broadcasting to other people (iTunes playlists, etc))

I also set up an ssh tunnel through my computer at home and redirect (port-forward) all services through that when I’m on the road. You can learn all about this on various Linux-related sites. It takes a little while to get your head around it but its well worth the effort spent.

I’ve implemented some SSL protected network applications before, and I’d trust a banking site through a well-known browser to be secure (without tunneling), though you’d be surprised at how easy it is to make SSL inneffective through poor implementation (in other words, don’t trust an application to be secure JUST because it says it uses encryption). Also realize that if you are not on a switched network (I don’t think there is such a thing as a switched wifi network?), even ecrypted data’s endpoints (website URLs, mail servers contacted, etc) is just wafting through the air to be grabbed by anyone that cares (perhaps for a little social engineering).

Ssh tunneling will slow down your speeds significantly, but its worth learning about for the peace of mind it can bring.

It might sound a little paranoid, but I suppose it all depends on your needs. To determine appropriate levels of paranoia, ask yourself a theoretical question: If your laptop were stolen, would it upset you more that you have to buy a new one or because of the data it contains?

You have to put some amount of trust in some segment of any network you’re connecting through. I put mine in my ISP and the servers that I connect to, but I have more difficulty placing trust in hotels, public (open) network providers, etc. Its not that I believe the people who pay for and operate those services are not trust-worthy, but I don’t believe for a second that most of them spend their free time reading about network security issues. Sure they probably pay someone else to do it all but there are no meaningful measures of competence there, either.