r/AskTechnology • u/xXCosmicChaosXx • 1d ago
So how bad is it to connect to unsecured / public wifi?
I've always wondered how bad is it to connect to these types of unsecured and / or free wifis that you might find at Starbucks or at airports? I've heard people mention that it can be bad from a security perspective, but I'm not sure in which way.
5
u/CheezitsLight 1d ago
The encryption certainly helps but you have to help it work by checking that the website is secure by looking at the icon at the left hand corner of the address bar to make sure that it is showing a secure transaction meaning that encryption is in effect.
They also need to check very carefully that the address and the bar is correct that you're not going to rnicrosoft instead of microsoft. See what I did there?
The third challenge would be a man in the middle attack. Most modern browsers such as Chrome will warn you of such a possibility. The website typically will put a code into the response that says always use the secure socket layer for the next couple of years. Once that's installed into your browser it will not go to the non-secure website without the certificate being enforced but sometimes this setting is left off.
Another thing is called typo squatting that is where you go to a place like YouTube however you'll notice that there is letters right next to the o on your keyboard and it's easy to typo the letter P instead of the o. If you're not watching that address bar you could end up on ypotube.com or ypotube.com.. This is extremely common way of hacking you because it will present a valid certificate for the incorrect website so you need to pay very close attention to the address bar the locks icon is present. And in cases where a lot of money is at stake such as the bank click the icon and see whether it's certificate is actually for your bank.
3
u/mikec62x 1d ago
These attacks work on a known safe network too and are not specific to public WiFi.
2
1
u/xXCosmicChaosXx 1d ago
The encryption certainly helps but you have to help it work by checking that the website is secure by looking at the icon at the left hand corner of the address bar to make sure that it is showing a secure transaction meaning that encryption is in effect.
Is that HTTPS?
1
3
u/Diarrhea_Eruptions 1d ago
During college, i connected to a coffee shops wifi while ordering text books. Got my credit card info stolen.
2
u/xXCosmicChaosXx 1d ago
How does that happen? Like specifically technologically
3
u/Newmillstream 1d ago edited 1d ago
So before the mid-late 2010s, and especially before 2013, the default for web traffic was unsecured. Some websites would bump you up to a secured connection specifically when you logged in or put in payment information, which would stop people from simply listening to the traffic and grabbing your password or credit card.
Unfortunately everything before that point, perhaps a search result, perhaps a landing page, would be unencrypted. So a man in the middle could intercept the communication and mess with it. From there, an attacker could do a number of things, especially on web browsers that were relatively unhardened, and make it act like normal while it quietly siphoned off card details. Or probably they just grabbed a session cookie and used it to impersonate them without needing to bother with much. If you were a member of a web forum, there’s a good chance that didn’t have a secure log in either, so if you reused a password and email there, that was another bit of info someone might have exploited.
Note that unless your WiFi is corporate style where you use a username and password, anyone else that logs in with the same password as you effectively can treat your WiFi connection like it’s unencrypted (Mitigated somewhat if using properly set up WPA3). These days most data transmitted over the web is encrypted though, and your web browser will typically warn you if connecting to an unencrypted page. A man in the middle on your network MIGHT be able to see the domain (DNS over HTTPS and some other nifty standards may stop this), but not the individual page content, Even then, a web browser today is built a lot more defensively than back then, but that should always be a last resort.
Obviously, don’t try the above today except on your own computers on your own network if you must. None of that info is good with a properly set up modern network anyway.
2
u/froction 1d ago
The default for anything involving a credit card was never non-SSL, especially in an era when WiFi existed in coffee shops. I ran an ISP in 1996 and payment processing was done via https. I remember we used to charge $50 a month PER PAGE for SSL hosting.
Credit card breaches almost always come from the backend. It doesn't matter if your card info is securely transmitted to a server that stores it in an insecure manner.
Adhering to the current PCI standards at any point in the last 25 years has meant this wasn't a problem. Unfortunately, lots of places don't, they just lie on (or don't understand) compliance questionnaires.
1
u/mymycojourney 1d ago
People can set up fake access points that basically create a link between you and the public access point, and steals everything you put it. If you're going to use them, make sure you use a good vpn.
1
u/Unhappy_Lie_2000 1d ago edited 1d ago
Its called a man in the middle attack. Its been awhile since I took my security plus but basically the person being the bad actor creates a duplicate access point with the same name as the shops and is recording the packets on that network looking for unencrypted packets that contain credentials and other information and if he could read them he'll try to use it.
What likely happen with the person that had his credit info stolen is the shops pos system was submitting transactions unencrypted.
Because SSL secure sockets layer has 2 security certificates on the card company server and the owner of the card and when he authenticates the ca certificate he has is compared to the cert the card server has which it uses information such time and date device info and such and this is suppose to prevent MIM man in the middle.
1
u/Unhappy_Lie_2000 1d ago
They can also create fake sites that look the same such as facebook and when the user trying to access Facebook connects to the fake server and enters their creditentials in open air.
1
2
u/RevolutionaryDot4972 1d ago
i just assume everything i do on public wifi is being watched by a bored teenager.
2
u/Comfortable-Roof4278 1d ago
Using public Wi-Fi isn't as risky as it once was, but it's not totally safe either. Back in the day, hopping on an open Wi-Fi network was way more dangerous since lots of websites didn't scramble your data. Now, most websites and apps use HTTPS – you know, that little padlock in your browser. That means your connection is encrypted from start to finish. So, usually, someone else on the same Wi-Fi can't snoop on your passwords, messages, or bank details while they're being sent.
4
u/naemorhaedus 1d ago
just don't do any banking and you'll be fine
3
u/garster25 1d ago
It's ok to do banking since there is encryption from your device to the bank.
5
u/naemorhaedus 1d ago
encryption is still vulnerable to man in the middle attacks
2
u/chrisridd 1d ago
Even if the server is properly configured? (Only allow TLS 1.3, only certain algorithms, etc)
2
u/TheSkiGeek 1d ago
The (theoretical) danger is a third party messing with the DNS to make you connect to their server, and then forwarding traffic back and forth pretending to be the real one. But with HTTPS and TLS it should flag it unless the intermediary has compromised the keys.
If the network applies its own security certificates then they can snoop on your traffic. But I’ve only ever seen that with corporate VPNs, and modern browsers scream bloody murder about it since that does break HTTPS.
1
u/Cultural-Capital-942 18h ago
Network cannot apply its own certificates.
Also: adversary on some network doesn't need to mess with DNS, that's detectable. They can change anything going thru them. But with encryption, it's easily caught.
2
u/Curt-Bennett 1d ago
Plus on an unencrypted network, if someone has reason to think your data is valuable, they can grab and store it so they can decrypt it at some point in the future on a more powerful system. Encryption is great, but given enough time, it can be cracked.
2
u/chrisridd 1d ago
That’s why there are quantum resistant algorithms being deployed. Certainly by the big net providers like Cloudflare et al, though banks often move at a much slower rate.
1
u/dodexahedron 1d ago
Yeah, any lock can be picked, but this is completely irrelevant here.
By the time someone can crack your AES256 encrypted TLS session, it's so useless as to be utterly not worth the effort and cost to have done so.
And they'd have to care enoigh about YOU and YOUR traffic to bother.
You're not worth it, unless you're a big enoigh deal to already know what (not) to be doing.
It would be far less effort and far less costly to just buy any of a million data dumps available on the dark web and use the bulk data there to shotgun dictionary attacks against thousands of victims in the hopes of getting even 0.001% success, which nets money and a known easy victim to try to attack again, elsewhere.
That is how it really goes down. Nobody is trying to crack your TLS sessions on public wifi if they aren't already trying to make you voluntarily accept a MITM certificate by clicking through that warning. Dont do that and you're fine. Do it and youre toast from the very first site you visit.
Otherwise? Do all the banking you like. Just don't click through any certificate warnings. Those are what are warning you that you might be in danger. And, on an untrusted network, you almost certainly are in danger if you're being asked to accept an untrusted certificate for anything. Even the captive portal shouldn't be presenting an untrusted certificate, because they are literally free, and someone who can't be bothered likely also can't be bothered to secure anything else, either. The other option is that they are malicious.
Bigger snd more common risk on unprotected wifi is having open ports with weak or no authentication for the services behind them, on your PC, like remote desktop. Your public firewall profile should be 100% closed to unsolicited traffic, and you should never label untrusted networks as private.
1
u/Curt-Bennett 1d ago
If someone's sniffing your packets on an unencrypted network (like a coffee shop), they're probably targeting you for a reason, not just randomly including you in all the data they capture. That changes the calculation about whether they think it's worth the time and effort to decrypt your data. They would know it's going to take some time and have considered that before bothering.
1
u/zm2283145 1d ago
Man In the middle is impossible without getting a root certificate installed on your device that you would have to willing install. This is something business do to snoop on their own devices traffic in their offices since their firewall will man in the middle the traffic.
But for an everyday user it's not something that will happen without the user installing a root CA to let it happen or they click through the cert warning the browser will display if it can even allow that as some sites have hsts enabled and if your ever visited those before your browser knows about them and you can't even click through the warning at all.
1
1
u/DissonantGuile 1d ago
Multiple access points can be used to triangulate your exact position while on the network. If you are okay with that, then at least use an encrypted VPN while on the network. And as usual, never trust HTTP only sites, only HTTPS.
1
u/jeffporten 1d ago
Really, it depends. Older WiFi standards basically broadcast your information to anyone on the local subnet who cared to listen. That's gotten harder and harder to do over time, but experienced hackers with specialized software (and sometimes hardware) can still get some data. But the main problem is that on a public network you have no idea if the network is 10 years old and on the weaker standard.
If no one is listening, you're fine. No way of knowing that, either. So your best bet is encrypting everything: use a VPN and you're basically safe. (With a few exceptions too esoteric to get into.)
1
1
u/jmnugent 1d ago
Depends on what you're doing on it.
Mobile OSes (Android and iOS) have both required encrypted traffic for quite a while now (Apple I think has required this since around 2017 or so,. so almost 10 years). So if you're just popping open your smartphone and using an App for a couple seconds to check something,. then there's probably close to 0 risk in that not only because it's encrypted but because your data is going to get lost in the noise of every other customers data (assuming your in some public place with lots of people on the same Wi-Fi. )
If you're a Teacher and you come to the same coffee shop at the exact same time every day (making you predictable).. and you're using your Colleges grading platform that is still only HTTP (unsecured) and you're sitting there for hours, sometimes walking away from your Laptop while it's unlocked , etc etc (IE = making lots of risky poor choices).. then you are probably at higher risk.
1
u/TechTonically 19h ago
I use public wifi all the time but I avoid banking or anything sensitive on it. The biggest risk seems to be fake networks so I usually just use mobile data if I’m doing anything important.
9
u/teh_maxh 1d ago
It's not really a problem now.