Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Some wireless networks, such as those offered by hotels and hotspots, are not encrypted (they don't require a pass phrase to connect) but have an authentication web page. For example, you connect to an unsecured airport network, and it asks you to login using the credentials you were given when you paid with your credit card.

How secure are these type of networks? I would imagine that, since the connection between the client and router is not encrypted, and since authentication does not mean encryption, it would be entirely possible to sniff the data exchange. But if it's unsecured, why do so many universities, hotels, and airport hotspots use this system?

share|improve this question

2 Answers 2

The page where you enter your login details is probably secured with HTTPS. As long as the HTTPS isn't compromised, the login data itself should be fairly secure. If there is no HTTPS to be found, I would definitely not give credit card details or anything similar (although a throwaway login code bought at the hotel lobby is hardly a big risk - worst case, you lose part of the credit you bought).

Note that wireless encryption by itself doesn't provide much security in this scenario - WPA2 and its siblings are intended to prevent unauthorized access to the network, but since the access credentials are the same for all machines, and there is no reliable way of allowing individual machines selectively (MAC addresses can easily be spoofed), your credentials on an encrypted hotel network would still be visible to everyone else on the same wireless network. It would keep a silent (passive) eavesdropper from outside the network from listening in on your conversation.

share|improve this answer
    
What if the HTTPS page is self signed? –  jldugger Oct 25 '11 at 19:16
    
"wireless encryption by itself doesn't provide much security" unless it is correctly done. –  curiousguy Oct 31 '11 at 22:21
    
@curiousguy: Even if WPA2 is enabled and configured correctly, you still have a local network that is, at best, as secure as a wired LAN. Unless you use encryption between the client and the destination server, you are still vulnerable to eavesdropping. –  tdammers Nov 1 '11 at 20:46
    
It sill is insecure. A person on the wifi network could just preform a mitm attack also known as arp cache poisoning. The the attacker could setup a ssl proxy and hijack your encrypted session. –  Tim Williams Apr 2 at 17:19

You'd be correct in thinking that an unencrypted connection allowing login over wireless networks is very likely to be insecure.

As to why they do it, I'd say it could well be a combination of lack of awareness of the risks posed, with lack of incentives to implement mitigations, with low potential impact of a breach.

For example if we say that the credentials provided by the institution are valid only for that purpose (using purchased wireless access), then if an attacker compromises them, the likely limit of the loss is that wireless access, not necessarily a large amount. If it happens infrequently then the overall potential cost could well be lower than the cost to implement the counter-measure (encryption).

If they institution had a large number of incidents to the point where legitimate users started complaining (assuming that the compromise causes them to lose access), then they would likely have an incentive to provide encryption to protect credentials over the wireless network.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.