1

I received the following message from my bank:

Be careful when using wireless networks. Some wifi networks are unsecure, meaning that they may allow someone else to access information or files stored on your device. When you're out in a public place, it's best to stick with known sources for your internet connection, such as the Starbucks wifi, and not a random home network that happens to be open. It's always best when you're on the go to turn off your wifi, unless you absolutely need it. It's safer to use up some of your monthly data instead of connecting to a wifi network that could potentially allow hackers access to your device.

This seems like a really bad analysis of the risks of public WiFi to me. I've never heard anyone recommend using Starbucks WiFi for security reasons.

As a security-minded person, my advice to friends who ask has been to never connect to WiFi networks where you don't know the person responsible for it and all the other people who are connected without (1) a well configured firewall and (2) tunneling all traffic through a trusted, encrypted VPN. (Starbucks WiFi would of course fail this test.)

I understand that these might be out of reach for less tech-savvy people, but is it really good to suggest using public WiFi from "known sources"?

Some other thoughts:

  • It seems like it would be relatively easy to set up a fake Starbucks access point.
  • Attempting to contrast "unsecure wifi networks" (presumably unencrypted?) with "known sources" seems to be missing the whole point of the risks of public WiFi, as well as comparing orthogonal concepts.
  • The one thing I agree with is their last recommendation to use cellular data rather than connecting to public WiFi.
  • Overall, this seems like a rather self-contradictory recommendation.

Is my analysis of public WiFi completely off base? Does my bank have a good reason for making these recommendations to (presumably lay) users?

  • Your right, its not hard to either fake or 'take over' WiFi like the starbucks. (Look up what a WiFi Pineapple can do if you are interested) While I agree that the advice is bad, I suppose if you have to choose of two evils chosing the Starbucks one has a higher chance of being legit. Still a bad idea. – toom May 17 '18 at 14:30
  • Maybe written by their lawyer that always go to starbuck to take a sip? – mootmoot May 17 '18 at 14:32
2

Is my analysis of public WiFi completely off base?

TL;DR - You analysis is not off. You are correct.

Does my bank have a good reason for making these recommendations to (presumably lay) users?

In my professional opinion, your bank is in error. While using Starbucks is safer than connecting to someone's home wifi, this can lull a client into a false sense of security. WPA-2 encryption has been proven to be vulnerable, and WEP and WPA encryption are child's play to crack. Once on a wifi network, a simple packet sniffer can capture all sorts of information unless other hosts are using a VPN.

It seems like it would be relatively easy to set up a fake Starbucks access point.

You are correct. They're called evil twin AP's. Besides hiding the hardware, they're relatively easy to set up and the kind of person who could detect it is not the kind of person to use free/public wifi.

Attempting to contrast "unsecure wifi networks" (presumably unencrypted?) with "known sources" seems to be missing the whole point of the risks of public WiFi, as well as comparing orthogonal concepts.

The only difference between a known and unknown network is familiarity. Technically speaking, knowing the barista does not make one's network more secure. Again, you are accurate. Your neighborhood friendly barista probably doesn't know if his/her network is compromised, so having the warm fuzzies about connecting provides no security.

Finally, your point (which was not chronologically last but an excellent summation anyway)

As a security-minded person, my advice to friends who ask has been to never connect to WiFi networks where you don't know the person responsible for it and all the other people who are connected without (1) a well configured firewall and (2) tunneling all traffic through a trusted, encrypted VPN. (Starbucks WiFi would of course fail this test.)

You are correct in your advice. Always use a VPN on Wifi, and ensure you have some sort of AV if you're running windows. (Linux machines, like the one I'm writing this on, have different set of "rules" for firewalls and you can simply change iptables).

  • See my comment above; with the same SSID, there will only be one network that shows up. – multithr3at3d May 17 '18 at 18:18
0

When you're out in a public place, it's best to stick with known sources for your internet connection, such as the Starbucks wifi, and not a random home network that happens to be open.

Can be seen both ways. It does suggest to use cellular. And it's better (not best) to use a known public wi-fi than a random home network - you can at least ask the employees for which network is the official one. They could be mistaken, or the networks can be named the same, but that's still a bit more to go wrong before you're compromised.

A better way to phrase it would be to advice the users not to use wi-fi and turn it off for their bank connection unless completely necessary, and if necessary, only use secured wi-fi from known sources.

It's relatively trivial for a wi-fi network's owner or someone intercepting open wi-fi traffic to mount an attack. Other users connected to a secure network need to make more effort.

In my UX experience there are usually three ways non-skilled users react to such a message:

  1. Disregard (obvious)
  2. Read it as "wi-fi is dangerous". It's rare for people to make more than one perception adjustment from a single message.
  3. Read it as "don't use this bank app on wi-fi". Again, one adjustment from the message, but this time a specific behavioral one.

The rest of the message about what kinds of wi-fi are more or less insecure would only reach people that already have a position an opinion and will mentally argue with the message. A direct statement "don't use wi-fi" could alienate them, while a wordy explanation allows them to take it as a Barnum statement supporting whatever their position is.

  • "you can ask the employees for which network is the official." thing is; if they fake it they most likely take the exact name right? – toom May 17 '18 at 14:40
  • But then there will be two networks with the same name - that should be enough to create suspicion in someone security-conscious enough to process the part about which wi-fi to use. – Therac May 17 '18 at 14:43
  • Only for those who know better. If they create an evil twin, the SSID's will be identical and most people would assume this is for redundancy or load-balancing. They may not think about those exact terms, but the layperson will probably not regard 2 nets with the same SSID with suspicion. – SomeGuy May 17 '18 at 14:55
  • Also, if I am not mistaken the WiFi pineapple can 'overpower' an AP. – toom May 17 '18 at 14:59
  • True, I suppose most people wouldn't notice. Still, I was mostly focused on the message and how most people would just take that Wi-Fi is bad from it. – Therac May 17 '18 at 15:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.