Our local train service has added free Wi-Fi.
I have been checking GMail and logging into a few apps. Then logging into websites using HTTPS. Is this secure, especially if done via app?
The network is stored in my Wi-Fi list and automatically picks it up when I get on the train.
If you are not using a VPN, then every site you visit that sends or receives anything sensitive (especially passwords) should be HTTPS rather than just HTTP. The 's' in HTTPS stands for secure which is provided by TLS handshaking and encryption. In effect, when using TLS (i.e. HTTPS, which I refer to interchangeably here) you are effectively using a separate VPN for each site.
It might be worth adding a comment about why this is good practice. There are several concerns when using any public hotspot. The first is that some other Wi-Fi user has configured their device (laptop, phone, ...) to receive all the traffic being broadcasted from the nearby systems. This can also be prevented if the hotspot is properly configured to use encryption, but that is not wholly trustworthy since the older Wi-Fi encryption protocols are attackable.
The second risk is that the hotspot device itself has been compromised. There are several ways in which this can happen including from the wireless network, the wired network and physical access. Another attack is spoofing the hotspot so users connect to the attacker's system rather than the legitimate service.
Rather than trying to assess the security of each wireless environment, I recommend that you become aware of the security of communication to each of the Internet services you use and move to TLS for anything that communicates information you would not want publicly disclosed. This habit should be followed for both wireless and wired connection since it can also protect against the (generally rare) attacks that expose data from the wired Internet.
It occurred to me to add a couple of disclaimers:
This discussion is about data in transit. Do not assume that your data is well protected at the destination service just because it was encrypted during transmission. That protection is lost once it arrives at the destination and other protections must be in place for the processing and storage of sensitive data at the remote site.
ALSO, you may have seen headlines about problems with TLS. Those are about specific implementations or older versions of the protocol. If the service provider has properly updated and maintained their system and you are using modern, updated software (such as keeping you browser software updated), TLS is a very powerful and entirely reliable protocol.
It all depends on the security of the Wi-Fi service itself: does it use WEP, WPA, WPA2? (The Difference Between WEP, WPA, and WPA2 Wireless Encryption (and Why It Matters)
Another problem for the users is that, as in public places, any attacker can use the free Wi-Fi provided in your train to set a rogue access point to monitor their online activities.
P.S.
Interesting to read: WEP Vulnerabilities and Attacks.
To the best of my knowledge, even when you use apps with encrypted connection, your personal information could also be leaked due to the third-party ads that pop up in most of your applications. Those information may include your iOS version, your device information, your Service Provider, your display language, and the most serious one: the app that you are opening, your current city and country. It is because those third-party ads does not come with encryption, thus your personal information is very vulnerable to an attack type known as man-in-the-middle.
If you are doing anything sensitive, then yes you should be using VPN whenever you connect to any sort of public WiFi/802.11 network. Depending on HTTPS using TLS is just not sufficient when human nature is involved (we tend to become complacent/comfortable and forget to remain ever vigilant).
To be clear unless you
without a secure VPN alternative, you are vulnerable. And if people honestly evaluate if they follow these requirements, very few (if any of us) could answer that they do.
Most people don't enter the full URL starting with the "HTTPS://" even when connecting to secure websites. Instead they will typically type something like "google.com" and hit enter, depending (usually without knowing) that this default request is over HTTP and that it will redirect them to the HTTPS resource.
Now it is relatively trivial to set up a MitM attack where a device pretends to be the public WiFi network (and possibly denying access to the real WiFi network). When a redirect to the HTTPS resource is detected, the attacker will establish the TLS session to the server, but keep sending the information to the client over HTTP.
This is simply the opposite operation that takes place in many application delivery controllers (aka load balancers) when they do SSL/TLS termination in hardware. And all it takes to perform such an attack is about $100 in hardware, a bit of knowledge, and human nature.
If you want to be secure, assume that human nature will win out and use VPN on public WiFi networks.
