0

On Campus we have free Wi-Fi, specifically, Eduroam which needs student credentials to be accessed (each student has its own credentials).

One thing that triggered me was that no certificate is provided when connected to the Wi-Fi (possible Wi-Fi impersonation).

I don't feel safe connecting my laptop in this network. So I was thinking a way to connect without exposing my OS to the network:

  • Using a VM (but I don't think it's possible to connect only the VM to a Wi-Fi)
  • Making a dual boot with a Linux distribution specifically to access this network (since I only need to use this WiFi in some classes)

For now dual boot seems a good idea but I'm not 100% sure.

Is there a better way ? Is dual boot effective ?

6
  • Last I used it, Eduroam did present a certificate. Sep 20, 2022 at 12:57
  • What threat are you trying to protect against?
    – vidarlo
    Sep 20, 2022 at 17:46
  • @vidarlo Basically WiFi Impersonation Sep 20, 2022 at 18:20
  • @TiagoMartins so MiTM? Why isn't TLS adequate protection against that? >99% of my traffic is more or less immune to MiTM-attacks, due to being TLS or similar.
    – vidarlo
    Sep 20, 2022 at 18:57
  • Depending on your OS, it's absolutely possible to let only the VM access wi-fi. Heck, you could even use the VM to run a VPN client and then access the internet through the VPN. Actually setting it up, on the other hand, isn't necessarily easy.
    – user253751
    Sep 21, 2022 at 12:05

2 Answers 2

1

Some quick choices:

  • Get an USB network adapter and pass it to the VM. You don't need to connect the host to the AP.

  • Configure the network adapter of the VM as bridge so that it independently connects to the network, and then you configure your host to some random IP which is not provided by the AP's network.

2
  • I tried the USB network on my VM and works well! I disabled the VM network adapter that connects to my host too. Now my host system is on Airplane Mode and I have Wi-Fi on my VM. This is enough to "isolate" my host from the public wifi ? Sep 20, 2022 at 13:35
  • 1
    @TiagoMartins yes, as you said, your host is not even connected to the public wifi, so from all that matters, it's isolated.
    – user15194
    Sep 20, 2022 at 14:11
1

I don't feel safe connecting my laptop in this network. So I was thinking a way to connect without exposing my OS to the network:

That's where the firewall comes into play: even if you have running services and therefore open ports on your computer, the firewall can prevent any of those ports being exposed on the local wifi network if you classify the "zone" as untrusted.

A third option is to use a live OS on a USB stick, so you don't have to partition your disk or make any changes to your computer configuration.

The question is, what are you going to use the wifi for? If you don't trust it, then you should not be using it for the purpose of sending any confidential information, even when using an ephemeral/disposable operating system (eg Tails).

However, it does makes sense to use a VPN that you trust (can be your own) whenever you need to connect to a third-party network you don't control and don't trust. Obviously, the VPN should identify itself with a certificate so that a rogue network can't do a MITM.

1
  • I'm not using that Wi-Fi even to go to social media or personal email, I use it only to do some class work. But my system is always checking for updates or uploading new files into cloud, in background, using that untrusted Wi-Fi. Thanks for the tip about live OS on a USB stick though! Sep 20, 2022 at 17:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .