2

I'm at a place where there is public wifi, and I want to use it with trading accounts that contain some money. I have my account set up with google authenticator, and the connection is https. is all of this enough, or should I spend $100/week to use my phone's (slower) internet for security?

4

A public Wifi means an uncontrolled router an possibly an HTTP proxy. That means that you cannot rely on that to securely connect you to the correct server, not speaking of any MiTM attack.

But that is what SSL/TLS is made for: if your client browser is correctly configured (it should be...), the certificate presented by the server guarantees that you have reached the correct server, provided you control that the URL is the correct URL and actually uses HTTPS(*). Then the protocol ensures that everything exchanged between your client and the server is encrypted so you can pass you credentials there, and do whatever you need to do without risk of MiTM attack.

But the additional rule is that you should control the URL in the address bar of your browser - what should be done consistently anyway...


(*): if the URL does not start with https:// or is not exactly what you are used to, immediately close the connection because security cannot be guaranteed...

1

HTTPS alone (with or without 2FA) should be enough to secure your connection to whatever site you're using. (See Serge Ballesta's answer for more detail on that.)

However, other sites which don't use HTTPS will not be protected, and if you ever happen to visit such a site (even accidentally, or even if a page you're visiting just happens to load an HTTP page or script in the background) a MITM attacker on the local network could exploit that to do all sorts of nasty things; like steal your (non-Secure-flagged) cookies on every non-HSTS site you've ever visited, install persistent web-based backdoors in your browser cache, or even remotely take over your home router after you return home and connect to your local network.

For this reason, I suggest you only access the internet through a VPN while using public WiFi. Commercial VPN services are much, much cheaper than $100/week, and will protect more than just your HTTP connections from being intercepted or snooped on. (For example, your DNS requests will also go through the VPN.)

Another option would be to install a browser extension like HTTPS Everywhere and set it to block all unencrypted requests. That won't protect other non-HTTP requests like DNS from being intercepted or spied on, but it will avoid the attacks I described in the paragraph above.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.