0

I don't really know anything about security certificates, and I tried reading about this, but couldn't find the answer.

Edit: The hotel I'm staying in uses a login page for the wifi connection that uses a self-signed security certificate. I'm hesitant to connect my laptop to it because of this. My wlan card isn't attached to the host machine, but rather a VM within it. The internet connection is passed to another VM that implements a firewall (from archlinux wiki on "Simple Stateful Firewall" page), which is then passed to a VM that handles my VPN connection, then to other VMs that actually use the connection for whatever. Would it be safe to use this wifi connection?

Improve this question
3
  • 2
    What is your threat model here?
    – Josef
    Commented Jan 29, 2019 at 15:49
  • At the very least, the hotel trying to capture people's information. I'm rather confident the page I'm seeing isn't from a state-level adversary, but I don't know if one could see information I'm sending/receiving over the internet in either case
    – user198122
    Commented Jan 29, 2019 at 16:04
  • Why would the hotel try to capture the Wifi login details? I assume they gave it to you, so they already know it? Or is the login for another service?
    – Josef
    Commented Jan 29, 2019 at 16:09

1 Answer 1

Reset to default
1

Summary:

A wifi network with a badly-configured CA certificate (or a CA certificate that they only give to employees) is no worse than an open network with no certificate.

Would you still connect if it was an open wifi? If yes, then don't worry about it.

I'm assuming you're talking about the certificate that the wifi presents during connection? Something like this?

CA Certificate config when connecting to a wifi network

My understanding is that this exists to prevent SSID spoofing (ie an attacker parks a van outside your house and broadcasts a network with the same SSID as yours). When you connect to a wifi network, it can present you a certificate that cryptographically proves that it is the network that it claims to be (provided that you trust the Certificate Authority that issued that cert -- hence the UI thing about whether you trust the CA).

Would you trust it if it was an open network?

It sounds like the hotel configured this with a self-signed certificate. Maybe that's so hotel employees, or hotel equipment can download the CA cert and be sure nobody is doing an SSID Spoofing attack on them.

To you as a hotel guest, a mangled wifi certificate config is no more dangerous than a wifi with no CA certificate. So the question to ask yourself is:

Would you still connect if it had been an open network with no certificate?

If the answer is Yes, then don't worry about it. If the answer is No, then you probably know something about this network and what cert it should be displaying, and wouldn't be asking this question in the first place.

Note: this is different from installing a root CA cert into your OS or browser

One last note: We are talking about trusting a CA to identify the SSID during wifi connection. Note that this is different than trusting a CA to identify a website in your browser. If they ask you to download a CA cert and install it into your operating system, that would be a red-flag, because now they can impersonate any website that you try to connect to.

Improve this answer
6
  • 1
    As Mike said, this setup is not worse than an open Wifi network. However, if OP really wanted to be sure about using the correct certificate, OP should be able to ask the hotel staff to send you the certificate and/or its fingerprint to install out of band.
    – Lie Ryan
    Commented Jan 29, 2019 at 22:23
  • Thank you Mike. So what you're saying, is that unless I install a CA certificate into my browser or OS, the only problem I might face is whether or not the SSID I'm connecting to is the one being broadcasted by the hotel itself?
    – user198122
    Commented Jan 30, 2019 at 5:03
  • @temporary Correct.
    – Mike Ounsworth
    Commented Jan 30, 2019 at 14:06
  • Wish there was a possibility to trust a single self-signed certificate and warn if it changes.
    – Esa Jokinen
    Commented Jan 30, 2019 at 18:23
  • @EsaJokinen Are you sure you can't? What happens if you download the self-signed server cert and give it to the OS in that "CA Certificate" drop-down?
    – Mike Ounsworth
    Commented Jan 30, 2019 at 18:26

You must log in to answer this question.