Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have access in my neighborhood to an open, unencrypted WiFi signal but I am leery of using it because of security reasons.

I don't want to let my username, passwords or credit card numbers available over an open , unencrypted WiFi signal.

My question is this, I purchased a router that has the ability to "Bridge" to this open WiFi signal and it creates a new "Access Point" that requires a password and provides encryption.

Is this router actually providing security with the new "Access Point" that "Bridges" to the open signal? Is the data passing through the air to the original WiFi AP now encrypted because the 2nd "Bridge" router is using encryption.

Thanks for any feedback!

share|improve this question

3 Answers 3

This would provide no additional security unfortunately.

If you use the new AP as a bridge you would not then be able to connect to it via WiFi, you would connect to it via Ethernet. It effectively connects your wired network to the WiFi network.

That aside because the network is open anyone can join the network. Once on the network (even if the AP bridge did offer you protection) they could still gain access to your traffic using a MiTM (man in the middle) attack like ARP Cache Poisoning. I've written a few articles on my blog about Session Hijacking and Code Injection which are a couple of attacks you would be vulnerable to.

share|improve this answer

Your "bridge" AP will offer no additional protection for any traffic going to/from the Internet. However, depending on how you have your network configured, it may be able to provide protection for local traffic between your own devices.

As it stands, your path to the Internet is this:

You --> Open WiFi --> Internet

You're proposing some sort of configuration that changes the path to this:

You --> Secure Bridge --> Open WiFi --> Internet

As you can see, your traffic is still passing through the Open (and insecure) WiFi network. Traffic flowing between your devices and the Secure Bridge will be encrypted and therefore protected from eavesdropping. But any traffic that is internet-bound will have to be sent across the Open WiFi network in the clear* - otherwise the Open WiFi network wouldn't know how to handle it.

*Note: Here, "in the clear" is referring only to the physical layer of the transmission. Your traffic may be protected by encryption at higher layers (e.g.: HTTPS) in certain applications.

The only protection added is for local traffic sent between your own devices which are connected to your Secure Bridge. That is, traffic passing between your devices that does not need to be routed through the Internet (e.g.: file transfers via network share). Since this traffic is not Internet-bound, it will never need to be sent over the Open WiFi and therefore will be protected by the encryption your Secure Bridge uses even if it is not encrypted at a higher layer.

The only way to keep your traffic secure when there is an untrusted network in your path is to make sure it is all encrypted at a higher layer. Typically, this is done via VPN tunneling (e.g.: Tor). VPN tunneling effectively changes your network path to this:

You --> VPN Provider --> Internet

Of course you still need an existing network, such as the Open Wifi, to connect. But, with all your traffic passing through a VPN, nobody on that network will be able to casually eavesdrop on your transmissions. You also need to bear in mind that the VPN provider will have just as much access to your traffic as if it was being sent over an Open WiFi network, as will anyone along the path from the VPN provider to the Internet endpoint - endpoint included.

For any data you want truly protected in transit, you need end-to-end encryption at the highest layer possible. This is usually done via application-level protocols like HTTPS, SSH, and PGP.

share|improve this answer
    
Unless you firewall the other network you're just as vulnerable to ARP cache poisoning and the attacker can still very easily access your traffic. Even local traffic on your AP that doesn't go to the Internet. You're all still on the same network so it makes no difference. –  Scott Helme Oct 8 '13 at 8:57

You need to consider the following:

  1. Your new AP that you are planning to configure in bridge mode would simply extend the original signal to you and you will still have the unencrypted WIFI signal to connect to on the new AP.
  2. Suppose that you were able to connect the new AP to the open AP as a client, since you have no access to the open AP's configuration (I assume), you will have to connect it with open WIFI signal (AP to AP connection). Now even if you use another signal band on your new AP that is encrypted and secure, all your traffic between the new AP and the Open AP will still be unsecure even though the connection between you and the new AP was secure.

The short answer to your question is NO.

share|improve this answer
    
I think you're thinking of repeater mode. Bridge mode does not extend the range of the original AP, it simply connects to it and provides access via the LAN. Some APs can support bridge mode and wireless clients though, but not usually in my experience. –  Scott Helme Oct 8 '13 at 8:59
    
You can do AP mesh networking using the bridging of APs. Usually one wireless band is reserved for uplinks and the other for clients. I do not mean repeaters. –  AdnanG Oct 8 '13 at 10:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.