Security of unencrypted wireless networks with authentication page

Question

Some wireless networks, such as those offered by hotels and hotspots, are not encrypted (they don't require a pass phrase to connect) but have an authentication web page. For example, you connect to an unsecured airport network, and it asks you to login using the credentials you were given when you paid with your credit card.

How secure are these type of networks? I would imagine that, since the connection between the client and router is not encrypted, and since authentication does not mean encryption, it would be entirely possible to sniff the data exchange. But if it's unsecured, why do so many universities, hotels, and airport hotspots use this system?

Answer 1

The page where you enter your login details is probably secured with HTTPS. As long as the HTTPS isn't compromised, the login data itself should be fairly secure. If there is no HTTPS to be found, I would definitely not give credit card details or anything similar (although a throwaway login code bought at the hotel lobby is hardly a big risk - worst case, you lose part of the credit you bought).

Note that wireless encryption by itself doesn't provide much security in this scenario - WPA2 and its siblings are intended to prevent unauthorized access to the network, but since the access credentials are the same for all machines, and there is no reliable way of allowing individual machines selectively (MAC addresses can easily be spoofed), your credentials on an encrypted hotel network would still be visible to everyone else on the same wireless network. It would keep a silent (passive) eavesdropper from outside the network from listening in on your conversation.

Answer 2

You'd be correct in thinking that an unencrypted connection allowing login over wireless networks is very likely to be insecure.

As to why they do it, I'd say it could well be a combination of lack of awareness of the risks posed, with lack of incentives to implement mitigations, with low potential impact of a breach.

For example if we say that the credentials provided by the institution are valid only for that purpose (using purchased wireless access), then if an attacker compromises them, the likely limit of the loss is that wireless access, not necessarily a large amount. If it happens infrequently then the overall potential cost could well be lower than the cost to implement the counter-measure (encryption).

If they institution had a large number of incidents to the point where legitimate users started complaining (assuming that the compromise causes them to lose access), then they would likely have an incentive to provide encryption to protect credentials over the wireless network.