i’m paranoid about using public wifi but sometimes I have no choice. I have read that it is unsafe to log in to accounts using public wifi. My question is: If I log in (for example to Gmail) using a secure connection on my laptop, then take my laptop to a public location, open my laptop to see that I’m still logged in, and then connect, does my log in information get re-sent?

I am thinking that if my log in information does not get re-sent, then maybe it’s a bit safer?

  • 1
    Most public service providers like Facebook and Google do correctly use TLS (https) and that protects you from credential or session stealing. Just make sure to not ignore certificate warnings. However it might not be the case for some smaller providers, so using a VPN service when you are often on the road can add an additional protection layer. – eckes Nov 12 '17 at 6:00
  • If you are already logged in to Gmail then on next visit login cookies are sent over https for authentication. – defalt Nov 12 '17 at 6:58

The logins to sites like Google use one of the modern authentication methods. Often OAuth.

These use tokens issued by the site to your browser to indicate that you have logged in. There are typically 2 timeouts for authentication on these sites.

There may be a login timeout. This may be updated when you do something active on the site or it may be a fixed timeout. Generally measured in days, sometimes weeks or months. When it expires, you have to put your login credentials back in.

On top of that, there is a token refresh timeout. Tokens are typically short-lived since that reduces the amount of work the servers have to do to check that the browser using the token is the one it was sent to originally. The token is checked on each page refresh (sometimes via socket connections as well) and can be refreshed by the server during those interactions. If the token expires, the server will typically recheck your login credentials and issue a new token without your interaction if it thinks the credentials and the browser are still valid.

This is what lets you have extended sessions with a service without having to log in all the time. You will note that banking and finance services don't allow extended sessions as they are certainly less secure. But with careful processing, it can be a fairly safe mechanism and is used, for example, on Azure & AWS management portals.

So, to your question. There is reauthentication going on. A secure service will check that the token is coming from the originating IP address and if not, will force a recheck of credentials (which doesn't necessarily mean a new login for the user). But all of that happens over HTTPS (TLS) and so should be invisible to a Wi-Fi based hacker.

I say should because there are lots of ways for this to go wrong. The service may not be validating tokens correctly for example which can lead to token replay attacks (though that needs something to have access to the token from your browser). You could be subject to a Man In The Middle Wi-Fi attack which intercepts your TLS connection. Browsers are generally better at reporting on these now, if you get a warning to say that there is something wrong with the certificate for a site while you are on Wi-Fi, that is a pretty good indicator of a MitM attack happening. There are also various ways for the service to have messed up the configuration of their TLS making it weaker.

For security, you should always use a good VPN (there are many really poor ones) and have that turned on from the outset.

  • Thank you Julian. That is a very well thought out and well written answer. I have been putting off getting a VPN as I didn't want to add another monthly service charge to the growing number of monthly service charges, but I think I will just have to bite the bullet and get one. Thanks again. – Michael72688 Nov 12 '17 at 19:29
  • I sympathise. I recently went through my own selection process and it was horrible. There are so many rubbish providers out there and it is hard to choose. I went for VPN.ac - not the cheapest but seems to have good performance, good customer service, clients for all platforms and a wide range of endpoints. I've already used it in several countries as protection against hotel Wi-Fi and it seems to work well even when streaming video (getting BBC iPlayer when overseas is nice). It scores well on security and privacy too. – Julian Knight Nov 13 '17 at 13:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.