Are these claims about public WiFi accurate?

Question

I received the following message from my bank:

Be careful when using wireless networks. Some wifi networks are unsecure, meaning that they may allow someone else to access information or files stored on your device. When you're out in a public place, it's best to stick with known sources for your internet connection, such as the Starbucks wifi, and not a random home network that happens to be open. It's always best when you're on the go to turn off your wifi, unless you absolutely need it. It's safer to use up some of your monthly data instead of connecting to a wifi network that could potentially allow hackers access to your device.

This seems like a really bad analysis of the risks of public WiFi to me. I've never heard anyone recommend using Starbucks WiFi for security reasons.

As a security-minded person, my advice to friends who ask has been to never connect to WiFi networks where you don't know the person responsible for it and all the other people who are connected without (1) a well configured firewall and (2) tunneling all traffic through a trusted, encrypted VPN. (Starbucks WiFi would of course fail this test.)

I understand that these might be out of reach for less tech-savvy people, but is it really good to suggest using public WiFi from "known sources"?

Some other thoughts:

• It seems like it would be relatively easy to set up a fake Starbucks access point.
• Attempting to contrast "unsecure wifi networks" (presumably unencrypted?) with "known sources" seems to be missing the whole point of the risks of public WiFi, as well as comparing orthogonal concepts.
• The one thing I agree with is their last recommendation to use cellular data rather than connecting to public WiFi.
• Overall, this seems like a rather self-contradictory recommendation.

Is my analysis of public WiFi completely off base? Does my bank have a good reason for making these recommendations to (presumably lay) users?

Answer 1

Is my analysis of public WiFi completely off base?

TL;DR - You analysis is not off. You are correct.

Does my bank have a good reason for making these recommendations to (presumably lay) users?

In my professional opinion, your bank is in error. While using Starbucks is safer than connecting to someone's home wifi, this can lull a client into a false sense of security. WPA-2 encryption has been proven to be vulnerable, and WEP and WPA encryption are child's play to crack. Once on a wifi network, a simple packet sniffer can capture all sorts of information unless other hosts are using a VPN.

It seems like it would be relatively easy to set up a fake Starbucks access point.

You are correct. They're called evil twin AP's. Besides hiding the hardware, they're relatively easy to set up and the kind of person who could detect it is not the kind of person to use free/public wifi.

Attempting to contrast "unsecure wifi networks" (presumably unencrypted?) with "known sources" seems to be missing the whole point of the risks of public WiFi, as well as comparing orthogonal concepts.

The only difference between a known and unknown network is familiarity. Technically speaking, knowing the barista does not make one's network more secure. Again, you are accurate. Your neighborhood friendly barista probably doesn't know if his/her network is compromised, so having the warm fuzzies about connecting provides no security.

Finally, your point (which was not chronologically last but an excellent summation anyway)

As a security-minded person, my advice to friends who ask has been to never connect to WiFi networks where you don't know the person responsible for it and all the other people who are connected without (1) a well configured firewall and (2) tunneling all traffic through a trusted, encrypted VPN. (Starbucks WiFi would of course fail this test.)

You are correct in your advice. Always use a VPN on Wifi, and ensure you have some sort of AV if you're running windows. (Linux machines, like the one I'm writing this on, have different set of "rules" for firewalls and you can simply change iptables).

Answer 2

When you're out in a public place, it's best to stick with known sources for your internet connection, such as the Starbucks wifi, and not a random home network that happens to be open.

Can be seen both ways. It does suggest to use cellular. And it's better (not best) to use a known public wi-fi than a random home network - you can at least ask the employees for which network is the official one. They could be mistaken, or the networks can be named the same, but that's still a bit more to go wrong before you're compromised.

A better way to phrase it would be to advice the users not to use wi-fi and turn it off for their bank connection unless completely necessary, and if necessary, only use secured wi-fi from known sources.

It's relatively trivial for a wi-fi network's owner or someone intercepting open wi-fi traffic to mount an attack. Other users connected to a secure network need to make more effort.

In my UX experience there are usually three ways non-skilled users react to such a message:

1. Disregard (obvious)
2. Read it as "wi-fi is dangerous". It's rare for people to make more than one perception adjustment from a single message.
3. Read it as "don't use this bank app on wi-fi". Again, one adjustment from the message, but this time a specific behavioral one.

The rest of the message about what kinds of wi-fi are more or less insecure would only reach people that already have a position an opinion and will mentally argue with the message. A direct statement "don't use wi-fi" could alienate them, while a wordy explanation allows them to take it as a Barnum statement supporting whatever their position is.