19

Our local train service has added free Wi-Fi.

I have been checking GMail and logging into a few apps. Then logging into websites using HTTPS. Is this secure, especially if done via app?

The network is stored in my Wi-Fi list and automatically picks it up when I get on the train.

  • You may also want to consider the aspect of exposure to network attacks (especially if you're using a computer instead of a phone) and the fact that some stupid apps will use/fallback to http connection. I have definitely heard of stupid Android apps trying to download updates in HTTP before Google tightened the rules in Google Play. – billc.cn Oct 19 '15 at 13:46
23

If you are not using a VPN, then every site you visit that sends or receives anything sensitive (especially passwords) should be HTTPS rather than just HTTP. The 's' in HTTPS stands for secure which is provided by TLS handshaking and encryption. In effect, when using TLS (i.e. HTTPS, which I refer to interchangeably here) you are effectively using a separate VPN for each site.

It might be worth adding a comment about why this is good practice. There are several concerns when using any public hotspot. The first is that some other Wi-Fi user has configured their device (laptop, phone, ...) to receive all the traffic being broadcasted from the nearby systems. This can also be prevented if the hotspot is properly configured to use encryption, but that is not wholly trustworthy since the older Wi-Fi encryption protocols are attackable.

The second risk is that the hotspot device itself has been compromised. There are several ways in which this can happen including from the wireless network, the wired network and physical access. Another attack is spoofing the hotspot so users connect to the attacker's system rather than the legitimate service.

Rather than trying to assess the security of each wireless environment, I recommend that you become aware of the security of communication to each of the Internet services you use and move to TLS for anything that communicates information you would not want publicly disclosed. This habit should be followed for both wireless and wired connection since it can also protect against the (generally rare) attacks that expose data from the wired Internet.

It occurred to me to add a couple of disclaimers:

This discussion is about data in transit. Do not assume that your data is well protected at the destination service just because it was encrypted during transmission. That protection is lost once it arrives at the destination and other protections must be in place for the processing and storage of sensitive data at the remote site.

ALSO, you may have seen headlines about problems with TLS. Those are about specific implementations or older versions of the protocol. If the service provider has properly updated and maintained their system and you are using modern, updated software (such as keeping you browser software updated), TLS is a very powerful and entirely reliable protocol.

  • 1
    Old habits die hard: I have repeatedly written SSL, but actually that standard is now deprecated. Its immediate successor is TLS. TLS version 1.0 and SSL 3.0 were nearly identical, but both are now considered vulnerable. Everyone should be using TLS 1.2. Throughout my post above, please read TLS 1.2 for SSL. – JaimeCastells Oct 18 '15 at 18:10
  • That's probably worth an edit – David Z Oct 18 '15 at 18:26
  • Thanks for the prompting! I've updated it but left the comment as an FYI for others. – JaimeCastells Oct 18 '15 at 18:36
  • 1
    Also, please don't use HTTPS and TLS interchangeably. They're not the same thing, and HTTP is not the only layer-seven protocol (or even the only widely-used one). – Blacklight Shining Oct 18 '15 at 19:55
  • 2
    I equivocate TLS and VPNs by analogy. Clearly there are many, even fundamental differences, but both are encrypted tunneling approaches to allowing private, bidirectional, real-time communication. As for using HTTPS and TLS interchangeably, I apologize. It can be difficult to find a balance between technically precise communication and clarity in these forums populated by individuals with the broadest range of technical background. Especially when answering such a broad question. – JaimeCastells Oct 18 '15 at 21:53
4

It all depends on the security of the Wi-Fi service itself: does it use WEP, WPA, WPA2? (The Difference Between WEP, WPA, and WPA2 Wireless Encryption (and Why It Matters)

Another problem for the users is that, as in public places, any attacker can use the free Wi-Fi provided in your train to set a rogue access point to monitor their online activities.

P.S.

Interesting to read: WEP Vulnerabilities and Attacks.

  • I think it is WPA-2 or higher, but not 100% sure. Does logging in via the Google App on Android offer any more security(ie.another layer) than doing the same thing in a browser? I use 2 step verification on my Gmail account in a browser – TPLinks Oct 18 '15 at 14:10
  • 8
    I don't mean to step on @Begueradj 's toes, or be competitive, but I feel this answer is a bit misleading. Wireless encryption is certainly a good thing, even a requirement, but it does not address all the possible attacks. I believe we are better served by always assuming that the intervening network is insecure and focusing on end-2-end protection provided by SSL, including HTTPS, or VPN. – JaimeCastells Oct 18 '15 at 14:50
  • 1
    I'm not sure I understand. If you are saying that not all encryption is good encryption, than I completely agree. On the other hand, encrypting wireless traffic certainly is a recommended practice. WEP is a deprecated protocol and should not be used because it had very weak, easily defeated encryption. WPA-2 using AES with WPS disabled is the current standard. As with all encryption, one must ensure that one is using strong encryption and that the particular implementation (i.e. product) has any known flaws patched. – JaimeCastells Oct 18 '15 at 15:39
  • 1
    Even if the network uses WPA2, aren't all the packets decryptable by anyone who has the password? (Yes, this assumes that the network is PSK, but I think that's a safe assumption for a free thing.) – Blacklight Shining Oct 18 '15 at 19:58
  • 1
    I literally don't understand why the encryption of the network even comes into play here. It seems totally irrelevant. – Mehrdad Oct 19 '15 at 7:52
0

To the best of my knowledge, even when you use apps with encrypted connection, your personal information could also be leaked due to the third-party ads that pop up in most of your applications. Those information may include your iOS version, your device information, your Service Provider, your display language, and the most serious one: the app that you are opening, your current city and country. It is because those third-party ads does not come with encryption, thus your personal information is very vulnerable to an attack type known as man-in-the-middle.

0

If you are doing anything sensitive, then yes you should be using VPN whenever you connect to any sort of public WiFi/802.11 network. Depending on HTTPS using TLS is just not sufficient when human nature is involved (we tend to become complacent/comfortable and forget to remain ever vigilant).

To be clear unless you

  • always put the HTTPS:// in the web browser when going to a secure site AND
  • check every single time/page that you are connected via TLS before you enter a password or access sensitive information

without a secure VPN alternative, you are vulnerable. And if people honestly evaluate if they follow these requirements, very few (if any of us) could answer that they do.

Most people don't enter the full URL starting with the "HTTPS://" even when connecting to secure websites. Instead they will typically type something like "google.com" and hit enter, depending (usually without knowing) that this default request is over HTTP and that it will redirect them to the HTTPS resource.

Now it is relatively trivial to set up a MitM attack where a device pretends to be the public WiFi network (and possibly denying access to the real WiFi network). When a redirect to the HTTPS resource is detected, the attacker will establish the TLS session to the server, but keep sending the information to the client over HTTP.

This is simply the opposite operation that takes place in many application delivery controllers (aka load balancers) when they do SSL/TLS termination in hardware. And all it takes to perform such an attack is about $100 in hardware, a bit of knowledge, and human nature.

If you want to be secure, assume that human nature will win out and use VPN on public WiFi networks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.