Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it safe to log into my bank website over a public wifi (like a coffee shop)?

I apologize if this is a really dumb question. I realize that the connection between the browser and bank servers should be encrypted, however I'm wondering if there are any other "gotchas".

Thanks so much!

share|improve this question
    
threats over public wifi here security.stackexchange.com/questions/34764/… –  BlueBerry - vignesh4303 Apr 25 '13 at 13:54
add comment

2 Answers

If your bank Web site uses HTTPS, and you dutifully check that the server name in the URL is indeed the expected name, and you don't disregard warnings about unverified or expired certificates, then yes, it is safe.

If these conditions are not met, then no, it is not safe -- but it would not be safe from anywhere else either. Public WiFi is not special in that matter.

What may make public WiFi especially unsafe is that public WiFi occurs in public areas. Public areas are full of strangers. When you enter your bank password, you don't want weird people to spy on your keyboard or tablet screen. That kind of physical security is quite harder to achieve in a park or a restaurant, than in the privacy of your home.

share|improve this answer
add comment

Connecting to your bank over any WiFi that you do not absolutely trust is a mistake (in case you have a lot of money, of course). While in theory checking the URL and warnings does provide a level of assurance that you're not being MITM-ed (traffic is not intercepted), there are tools that work most of the time by utilising, for example, homonymic domain names.

Example: http://www.thoughtcrime.org/software/sslstrip/

There are also tools that will fake any BSSID (wifi station ID) that your wireless device is looking for, and then do their interception.

Example: http://wifipineapple.com/

P.S. In theory, theory and practice are the same. In practice, they are different.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.