5 added 108 characters in body
source | link

Public WiFi is still insecure, and it will always be if not used together with something like a VPN.

  • Many websites use HTTPS, but not nearly all. In fact, more than 30 percent don't.
  • Only around 5 percent of websites use HSTS. And it's still trust on first use. If the max age is short, that first use can be quite often. Let's face it, even if you are a security pro chances are that you would fall for SSL strip anyway. I know I would.
  • Just because you use HTTPS doesn't mean you do it right. There's still lot of mixed content out there. Many clients still support old versions with known vulnerabilitites, so an attack doesn't have to be a zero day to be successful.
  • Even if you use HTTPS, you leak a lot of of information anyway, such as the domain you visit, all your DNS traffic, etc.
  • A computer or phone uses the internet for more than just browsing:
    • All it takes is one app that has bad (or no) crypto for its update function and you are owned.
    • All those apps you gave permission to access all sorts of personal data... They are phoning home constantly and you probably have no idea what data they are sending and what if any crypto they use.
    • Dancrumb has more examples in his great answer.
  • Defense in depth.

A VPN is cheap and it is still a low hanging fruit when it comes to security.

Public WiFi is still insecure, and it will always be if not used together with something like a VPN.

  • Many websites use HTTPS, but not nearly all. In fact, more than 30 percent don't.
  • Only around 5 percent of websites use HSTS. And it's still trust on first use. If the max age is short, that first use can be quite often. Let's face it, even if you are a security pro chances are that you would fall for SSL strip anyway. I know I would.
  • Just because you use HTTPS doesn't mean you do it right. There's still lot of mixed content out there. Many clients still support old versions with known vulnerabilitites, so an attack doesn't have to be a zero day to be successful.
  • Even if you use HTTPS, you leak a lot of of information anyway, such as the domain you visit, all your DNS traffic, etc.
  • A computer or phone uses the internet for more than just browsing:
    • All it takes is one app that has bad (or no) crypto for its update function and you are owned.
    • All those apps you gave permission to access all sorts of personal data... They are phoning home constantly and you probably have no idea what data they are sending and what if any crypto they use.
  • Defense in depth.

A VPN is cheap and it is still a low hanging fruit when it comes to security.

Public WiFi is still insecure, and it will always be if not used together with something like a VPN.

  • Many websites use HTTPS, but not nearly all. In fact, more than 30 percent don't.
  • Only around 5 percent of websites use HSTS. And it's still trust on first use. If the max age is short, that first use can be quite often. Let's face it, even if you are a security pro chances are that you would fall for SSL strip anyway. I know I would.
  • Just because you use HTTPS doesn't mean you do it right. There's still lot of mixed content out there. Many clients still support old versions with known vulnerabilitites, so an attack doesn't have to be a zero day to be successful.
  • Even if you use HTTPS, you leak a lot of of information anyway, such as the domain you visit, all your DNS traffic, etc.
  • A computer or phone uses the internet for more than just browsing:
    • All it takes is one app that has bad (or no) crypto for its update function and you are owned.
    • All those apps you gave permission to access all sorts of personal data... They are phoning home constantly and you probably have no idea what data they are sending and what if any crypto they use.
    • Dancrumb has more examples in his great answer.
  • Defense in depth.

A VPN is cheap and it is still a low hanging fruit when it comes to security.

4 It's means “it is”; its is the pronoun.
source | link

Public WiFiPublic WiFi is still insecure, and it will always be if not used together with something like a VPN.

  • Many websites use HTTPS, but not nearly all. In fact, more than 30 percent don't.
  • Only around 5 percent of websites use HSTS. And it's still trust on first use. If the max age is short, that first use can be quite often. Let's face it, even if you are a security pro chances are that you would fall for SSL strip anyway. I know I would.
  • Just because you use HTTPS doesn't mean you do it right. There's still lot of mixed content out there. Many clients still support old versions with known vulnerabilitites, so an attack doesn't have to be a zero day to be successful.
  • Even if you use HTTPS, you leak a lot of of information anyway, such as the domain you visit, all your DNS traffic, etc.
  • A computer or phone uses the internet for more than just browsing:
    • All it takes is one app that has bad (or no) crypto for it'sits update function and you are owned.
    • All those apps you gave permission to access all sorts of personal data... They are phoning home constantly and you probably have no idea what data they are sending and what if any crypto they use.
  • Defense in depth.

A VPN is cheap and it is still a low hanging fruit when it comes to security.

Public WiFi is still insecure, and it will always be if not used together with something like a VPN.

  • Many websites use HTTPS, but not nearly all. In fact, more than 30 percent don't.
  • Only around 5 percent of websites use HSTS. And it's still trust on first use. If the max age is short, that first use can be quite often. Let's face it, even if you are a security pro chances are that you would fall for SSL strip anyway. I know I would.
  • Just because you use HTTPS doesn't mean you do it right. There's still lot of mixed content out there. Many clients still support old versions with known vulnerabilitites, so an attack doesn't have to be a zero day to be successful.
  • Even if you use HTTPS, you leak a lot of of information anyway, such as the domain you visit, all your DNS traffic, etc.
  • A computer or phone uses the internet for more than just browsing:
    • All it takes is one app that has bad (or no) crypto for it's update function and you are owned.
    • All those apps you gave permission to access all sorts of personal data... They are phoning home constantly and you probably have no idea what data they are sending and what if any crypto they use.
  • Defense in depth.

A VPN is cheap and it is still a low hanging fruit when it comes to security.

Public WiFi is still insecure, and it will always be if not used together with something like a VPN.

  • Many websites use HTTPS, but not nearly all. In fact, more than 30 percent don't.
  • Only around 5 percent of websites use HSTS. And it's still trust on first use. If the max age is short, that first use can be quite often. Let's face it, even if you are a security pro chances are that you would fall for SSL strip anyway. I know I would.
  • Just because you use HTTPS doesn't mean you do it right. There's still lot of mixed content out there. Many clients still support old versions with known vulnerabilitites, so an attack doesn't have to be a zero day to be successful.
  • Even if you use HTTPS, you leak a lot of of information anyway, such as the domain you visit, all your DNS traffic, etc.
  • A computer or phone uses the internet for more than just browsing:
    • All it takes is one app that has bad (or no) crypto for its update function and you are owned.
    • All those apps you gave permission to access all sorts of personal data... They are phoning home constantly and you probably have no idea what data they are sending and what if any crypto they use.
  • Defense in depth.

A VPN is cheap and it is still a low hanging fruit when it comes to security.

3 spelling fixes
source | link

Public wifiWiFi is still insecure, and it will always be if not used toghethertogether with something like a VPN.

  • Many websites usesuse HTTPS, but not nearly all. In fact, more than 30 percent don't.
  • Only around 5 percent of websites use HSTS. AnAnd it's still trust on first use. If the max age is short, that first use can be quite often. Let's face it, even if you are a security pro chanseschances are that you would fall for SSL strip anyway. I know I would.
  • Just because you use HTTPS doesn't mean you do it right. There's still lot of mixed content out there. Many clients still support old versions with known vulnerabilitites, so an attack doesn't have to be a zero day to be successful.
  • Even if you use HTTPS, you leak a lot of of information anyway, such as the domain you visit, all your DNS traffic, etc.
  • A computer or phone uses the internet for more than just browsing:
    • All it takes is one app that has bad (or no) crypto for it's update function and you are owned.
    • All those apps you gave permission to access all sorts of personal data... They are phoning home constantly and you probably have no idea what data they are sending and what if any crypto they use.
  • DefenceDefense in depth.

A VPN is cheap and it is still a low hanging fruit when it comes to security.

Public wifi is still insecure, and it will always be if not used toghether with something like a VPN.

  • Many websites uses HTTPS, but not nearly all. In fact, more than 30 percent don't.
  • Only around 5 percent of websites use HSTS. An it's still trust on first use. If the max age is short, that first use can be quite often. Let's face it, even if you are a security pro chanses are that you would fall for SSL strip anyway. I know I would.
  • Just because you use HTTPS doesn't mean you do it right. There's still lot of mixed content out there. Many clients still support old versions with known vulnerabilitites, so an attack doesn't have to be a zero day to be successful.
  • Even if you use HTTPS, you leak a lot of of information anyway, such as the domain you visit, all your DNS traffic, etc.
  • A computer or phone uses the internet for more than just browsing:
    • All it takes is one app that has bad (or no) crypto for it's update function and you are owned.
    • All those apps you gave permission to access all sorts of personal data... They are phoning home constantly and you probably have no idea what data they are sending and what if any crypto they use.
  • Defence in depth.

A VPN is cheap and it is still a low hanging fruit when it comes to security.

Public WiFi is still insecure, and it will always be if not used together with something like a VPN.

  • Many websites use HTTPS, but not nearly all. In fact, more than 30 percent don't.
  • Only around 5 percent of websites use HSTS. And it's still trust on first use. If the max age is short, that first use can be quite often. Let's face it, even if you are a security pro chances are that you would fall for SSL strip anyway. I know I would.
  • Just because you use HTTPS doesn't mean you do it right. There's still lot of mixed content out there. Many clients still support old versions with known vulnerabilitites, so an attack doesn't have to be a zero day to be successful.
  • Even if you use HTTPS, you leak a lot of of information anyway, such as the domain you visit, all your DNS traffic, etc.
  • A computer or phone uses the internet for more than just browsing:
    • All it takes is one app that has bad (or no) crypto for it's update function and you are owned.
    • All those apps you gave permission to access all sorts of personal data... They are phoning home constantly and you probably have no idea what data they are sending and what if any crypto they use.
  • Defense in depth.

A VPN is cheap and it is still a low hanging fruit when it comes to security.

2 added 155 characters in body
source | link
1
source | link