How dangerous is sharing a WiFi network with neighbors?

Question

Context. I am moving in to a building where neighbors share WiFi. There are several routers connected with each other, and residents connect to one of the WiFi networks. I was told it's cheaper that way and the speeds are good.

Concerns. I don't know who set those routers up and with what settings (like isolation or logging). I also don't know my neighbors and what they're up to. I don't have any reason to distrust them, and in fact there are cameras in the building, but I'm trying to understand the attack surface.

Assumptions. It's my understanding that each WiFi network is a LAN where people can sniff each other's traffic and connect to each other's ports. For example, if I run a website on 0.0.0.0:3000, my neighbors will be able to visit it if they find out my local IP. (I already do this on my phone to test my websites on mobile, but I do it on my own LAN).

• Is it true that a neighbor can see what websites I visit (DNS queries are usually sent in plaintext, plus source/destination IPs are unencrypted in the IP packets), but they won't be able to make sense of the data because the traffic is sent over HTTPS? For example, they can't see my password when I log in to online banking.

• Also, is it possible that a neighbor could exploit open ports on my phone and/or laptop, potentially compromising my devices with remote control or malware?

Risk mitigation. Here is what I think I could do:

1. Ask the landlord to set up a separate network just for me. I would be the only one that has the WiFi password. I don't know if this is enough considering the routers are interconnected. But I believe this will thwart nosy neighbors.
2. Ask the landlord to connect my own internet service just for my household. This should be more secure because I'll have my own router that I can safeguard.
3. Use a hotspot on my phone. However, I'm not sure how secure mobile data is, and I'm certain the speeds will be much lower.

Is there anything else I could do, and are there any other dangers I missed?

Answer 1

After some more research, here's the answer I would give myself.

1. Don't use insecure HTTP. There are browser settings and/or extensions that block HTTP or redirect it to HTTPS. If not, simply don't use websites over HTTP. This ensures your traffic is not sent in plaintext for anyone on the Internet to see.

2. Don't use insecure DNS. Browsers have a setting to use secure DNS (DNS over HTTPS) - make sure it's on (for example, Cloudflare has a guide). It may be available system-wide in your network settings (if it's not, use dnscrypt-proxy). Don't forget to turn it on on your phone too. This way your DNS queries are encrypted.

3. Don't open ports on 0.0.0.0. Open them on 127.0.0.1 instead. This answer explains the difference. This way, when you're developing a website, other devices on the LAN won't be able to connect to it.

4. Use a VPN to mask your activity. Both your IP and the server IP are included in the network packets (otherwise they couldn't be delivered). This effectively reveals the websites you visit. You can get around this by routing the traffic through an intermediary, i.e. using a VPN. This answer explains it in more detail.

5. Install updates on your devices regularly. This helps patch network vulnerabilities.

I didn't find other ideas useful. For example, I don't see how I could use a VLAN as suggested, because I don't have access to the router where it needs to be configured.