1

I could use two wifi connections, both with WPA & WPA2 Enterprise security, automatic PEAP and MSCHAPv2, one of them with certificate, the other without; both require user/pwd and are on a university campus.

Would any one of them be considered safe enough to do online banking on it? What other data are needed to better evaluate the question, if any? if not, what sort of risks am I getting exposed to?

Edit1: connection uses https, and let's consider as safe ethernet cable from the same university.

Edit2: Suppose I look at the certificate through Firefox on Linux: then is it enought that it is emitted by the same entity that I see say at home, or should I compare it more carefully?

Improve this question

2 Answers 2

Reset to default
2

Because the actual connection to the bank is probably secured with TLS (https), which is mandatory in most legislations for banks now, it does not depend on the authentication and encryption of the wifi you are on; your information will be secure even over an open wifi.

However, as those are university networks, it might be the case that they use a TLS-Proxy to inspect the https-traffic for malware or exfiltration. If they do that, your TLS-connection is not with your bank but rather with the proxy of your university, which is a man in the middle.

This is useful because webmailing uses https as well and cannot be checked for viruses that could otherwise be checked for and blocked in an enterprise network.

You can check that with the ssl obervatory or checking what certificate you get from within that network and from home and comparing those.

A good hint would be if you installed a CA certificate for your university.

On the other hand, banking sites, at least the common ones, are usually on a white list for TLS proxies because of exactly the problems that this could entail.

Improve this answer
5
  • Thanks for nice answer. So basically could I regard it as safe as connecting via ethernet cable from the same university? suppose I look at the certificate through firefox on linux: then is it enought that it be emitted by the same entity, or should I compare it more carefully?
    – jj_p
    Sep 26, 2017 at 21:41
  • 1
    @jj_p I think it'd be better (although more annoying) to compare the SHA-256 fingerprint. Issuer is probably good enough for your purpose though.
    – AndrolGenhald
    Sep 26, 2017 at 21:48
  • @AndrolGenhald Now I'm a bit puzzled: assuming that security of such connections are the same as wired ones from the same place, I was looking at SHA-256 fingerprints as you suggested, and it turns out that the same (online banking) site uses (at least) 3 different certificates, namely looking at fingerprint from the same connection I get different fingerprints upon different trials. Is this pattern common? What should I check then, should I be happy if at least some of the fingerprints match between two different places?
    – jj_p
    Sep 27, 2017 at 15:29
  • 1
    @jj_p They must be using multiple certs, if the issuer is the same it's probably fine. If you want to be sure you could try searching certificate transparency logs for the domain and make sure you get one of the certs listed. Looks like my bank currently has 16 valid certs! I'm actually a bit surprised by that too, I'd have thought a bank would want to keep the number of valid certificates for their domain much lower.
    – AndrolGenhald
    Sep 27, 2017 at 15:54
  • This might be useful when using reverse proxies as load balances and TLS endpoints in different locations; if one location gets compromised, only one certificate must be revoked. Could be some sort of redundancy. Yet, if the certicate is from a trusted CA, everything should be fine. You can only take so much steps to be secure. Additionally, that question is not even close to this one. This is not a forum; if you have follow up questions, use the ask question button.
    – Tobi Nary
    Sep 27, 2017 at 16:53
1

The banking website should have an HTTPS (secure SSL) link over which you are logging in. This HTTPS link creates end-to-end encryption between the banking server and your browser. In addition, you should check the certificate provided by the banking website to make sure it is the original website and not a phishing page.

As far as WiFi security is concerned, if it is an HTTPS link (it will most likely be that), you are safe from any network sniffing attempts even on an open WiFi because of the end-to-end encryption. Since you have a WPA2 secure access point, you are further protected from sniffing attempts.

In my opinion, both of them are relatively safe to conduct banking on as long as the criteria discussed above holds.

Improve this answer
2
  • 1
    I'd be more concerned about the certificate being for the university firewall. Generally a certificate isn't going to tell you if it's a phishing site (many banks use EV certs but I wouldn't count on it), but it should be obvious if it's from the university.
    – AndrolGenhald
    Sep 26, 2017 at 20:54
  • Thanks for your answer. Suppose I look at the certificate through firefox on linux: then is it enought that it is emitted by the same entity, or should I compare it more carefully?
    – jj_p
    Sep 26, 2017 at 21:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .