0

I want to use my laptop to connect to a public WiFi in a library but...

I have strong security in my Windows host machine (comodo firewall using a public network settings and rules, protocols disabled, limited privileges account, GPO rules, services disabledm, browser hardened with settings and extensions...) and use dnscrypt to help protecting my DNS but i think this wound't be enough to be totally safe if I connect my host to the wifi.

I have no VPN right now. Can I use virtual machine to connect an use only Internet through it and totally isolating the host system from the network?.

I have a Wifi usb dongle too. So i was thinking in disabling all the network interfaces in the host (including the VM one) and connect the VM (guest) only to that dongle.

What do you recommend, there is any guide out there to do this with Virtual Box?

This is only to browse the internet and maybe download some documents & programs, not to use my user credentials by loging in some web but I want to access my projects and documents in my host HDDs securely by isolanting it from the internet.

If I wanted only internet no HDD access I would use Tails u other Live OS and run, but... (I don't want to mount my HDD and browse the files in it while I'm connected to a not trustworthy network)

  • 1
    Which threats do you want to protect against? More and more traffic is moving over TLS these days, so in general I'm not too worried about public wifis any more. I was more worried ten years ago. – vidarlo Apr 14 at 10:46
  • My thread is someone sniffing my traffic. I use dnscrypt so the HTTPS traffic would be protected against mitm in theory but i want to not take risks at all. I want to isolate my host for real to avoid any risk. Nowdays anybody can use xploits easily with kali or similar... – NullPointer666 Apr 14 at 11:33
  • dnscrypt would not be the primary protection against MITM on TLS. Certificate validation and HSTS would be the primary protection. Obtaining a valid certificate is difficult, and HSTS prevents downgrade attacks. DNSSEC or similar only authenticates the results of lookups, and doesn't make MITM impossible if you control the network. – vidarlo Apr 14 at 11:41
  • 2
    But if sniffing of traffic is a concern, no, a VM will not change that in any fashion. – vidarlo Apr 14 at 11:42
  • 1
    Computers do not randomly leak information onto a network. If the data is so sensitive that you don't trust being networked, I believe the solution would be separate hardware. – vidarlo Apr 16 at 6:42
1

If I wanted only internet no HDD access.. I would use Tails and run, but...

You can use Tails on your computer and have a full access to your files and documents. Linux have evolved ;) But honestly, I do not think you need this much of protection for browsing the Internet on a public WiFi : Use HTTPS everywhere, have a well configured firewall and you should be alright, unless you're carrying with you strictly confidential documents, which I seriously doubt.

Also, a VM is not in anyway a mean to protect your host. There is many ways to escape VMs, and the only purpose of such machines is to create an environment which is controlled, thus useful for security research, better separation of data, or retrocompatibility e.g.

To sum up, the only way for being secure on the Internet is to be careful : I frequently use McDonald's or Starbucks' WiFi and I do not have any Antivirus or Firewall on my Windows 10 laptop. What I have though is experience and most importantly the ability to not click anywhere.

Always update your system, check that you're using HTTPS and be careful with your DNS.

  • I know you can mount NTFS on Linux since a very long time ago. I am a Linux user too since many years but I get your comment since I didn't explain myself correctly (now I added an explanation at the end of my question). I am not carrying my super secret files but they are still personal (projects, notes...) so I want to keep them private. I added some comments to the other reply to reflect this too. I know there are ways to scape from VMs but the odds are quite more minimal than connecting directly the host to internet. That kind of threads are for powerful or targeted people. Not my case – NullPointer666 Apr 15 at 20:56
  • Caution doesn't protect you from many Internet attacks like DNS poisoning or MITM... and I am very careful. In your case an VPN connection would be the best protection. If you don't care about logging, no problem... for the DNS dnscrpypt is handy. One layer more. – NullPointer666 Apr 15 at 21:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.