Wi-Fine
wifine.gitlab.io
wifine.gitlab.io
In WPA and WPA2 the password means network use is encrypted, which means a completely passive adversary can't just snoop the network so long as there's a password.
But in WPA3 even without a password everything is encrypted anyway, your station says "Hey, I'm joining this network here's a number" and the AP says "Welcome aboard, here's a different number" and now you've got encrypted networking. Obviously with no password the AP could be an imposter, but passive snooping is impossible.
On the other hand, if you're dead set on identifying users, there's no substitute for the Enterprise WiFi behaviour all the way from WPA onwards where users have a username and password, doing this locally for your home WiFi is very annoying, but at scale it's convenient yet able to be responsible. The entire world's academic community have a single such network EduROAM, if you're an MIT student and you happen to be in the library of a Polish university, your WiFi just works, or if you're a Cambridge professor giving a talk at the University of Sydney in Australia, same deal. The institution where you're a guest knows your identity (often email address), but doesn't see your credentials (password in most cases), it's trusting your home institution to validate that identity.
I especially like it when I open up my laptop at a new coffee shop and discover it's already connected to eduroam—in the city I live in (Edinburgh) there are enough university buildings scattered around that a surprising percentage of the city center is covered. The National Library also uses eduroam.
... it also raises questions about what would be so hard to just distribute WiFi access to all citizens.
The identity in the outer EAP does not have to be your real identity, just the realm (@domain.dom) must be correct so the radius proxying can be routed appropriately. E.g., anonymous@example.edu in the outer EAP will work fine for the user, jdoe@example.edu.
I’m going crazy every time. I use a lot this network.
Can some mod or the OP that submitted this post change the title to "Wi-Fine: it is fine to use public Wi-Fi"? The current one is not very descriptive.
Also, let me know if any of you have comments to me specifically.
Not all web traffic is HTTPS, way too much of it still isn't. Not everything is HTTP(S) even, some nastiness comes from other protocols. DNS is still rarely encrypted. NTP basically* isn't encrypted. And all those combined allow a lot of privacy-invasive profiling to be done. Without WPA3 public, it's also passive and you have no clue.
Although with use of social engineering, you can set up a gateway page that says something like "Log in to Facebook for free wifi", bypassing the need for any exploits.
Even with 802.11w it's easy to impersonate APs, 802.11w doesn't protect against evil twins. I find it a massive pity that we can't freeload off of web PKI to authenticate AP's.
Has OP never heard of responder? Things other than browsers are actively making and accepting network requests all the time. Plenty of sites by default have port 80 open and redirect to 443 (can be intercepted).
Please do not spread harmful information. Never (ever) use an open wifi without a VPN.
Edit: My favorite APT that abuses this: https://www.kaspersky.com/resource-center/threats/darkhotel-...
Oh, and if you have corporate VPN make sure there is no split tunneling. And even with a good VPN, make sure to set explicit restrictive host firewall rules. As in no traffic allowed to the public wifi interface subnet aside from captive portal and dhcp (e.g.:wpad)
MUAs are. There's no MUA-STS, the user interaction required to accept an insecure connection is often too trivial, the authentication methods allow easy credential theft and prolonged reuse.
However, there’s still a privacy risk on a public wifi, correct? As in your neighbor can see the DNS requests (as those are generally unencrypted).
If you use a VPN, cool, but now your “free VPN” gets to see that.
The only other issues I could think of were ARP poisoning / spoofing and maybe local phishing redirects
I still see a good amount of clear text web traffic when I do packet captures in airports and the like.
Usually image or media files, but the odd time I see some badly conceived automatic update process pulling an exe or msi over plaintext HTTP.
Of all the places I'd avoid packet sniffing, that's high on the list.
In the real world is it embarrassing to have Emacs installed? Or KDE? Or even Tux Racer ? Probably not. But all things being equal we'd rather the program just kept this to itself right?
Not to mention the additional possibility of exploiting apt itself vs. having to exploit the TLS stack (which goes trough a lot more scrutiny).
HSTS helps with local phishing redirects, as the browser ought not load a 3xx request over http for sites with HSTS enabled.
Yes, you're exposing yourself to some random people on the network who may try to attack your laptop or phone, but as long as you enable your firewall you're Probably Fine (TM).
I'd avoid using public WiFi if you're a government agent or working with highly sensitive data just in case. In all other cases (i.e. 99% of people using their laptop in public) it's perfectly safe if you just don't disable your device's security mechanisms.
Disclaimer: I'm exploring an open source, community VPN called OpenRelay here: https://github.com/triumphantomato/openrelay
I figure if you connect to an open Wi-fi and then to a VPN endpoint, you're put on some government list.
If people around you tend to have a profile like HN users yes they of course know what they're dealing with.
Bur for the rest of the non-techie 99% of the world, public Wi-Fi is perfectly fine.
When would one need the coffee shop wifi, especially non-techies that go there just to have a coffee, not to work? Honest question.
And also with closed Wi-Fi could be dangerous.
I use always my home WireGuard tunnel when I’m with with an unknown Wi-Fi access.
The point is not the Wi-Fi, but what to do with it. If you want to browse Instagram on a public Wi-Fi there’re issues but I wouldn’t buy plane tickets on a public Wi-Fi or browse my online banking account (without a trusted VPN).
> When times change, the wisdom from that past era tends to stay around for a longer while.
And while technically true, I could technically run an old http only site and you might happen to be on the same network as a hacker using the decades old Firesheep, so yeah technically that could happen, but it's just so disingenuous when they come out and hammer that point home.
Anyways rant over.
looooooooooooool
Turns out, that was a lie
Or do you mean that downgrade attacks are still easy to deploy? Under what circumstances?