I want to make sure I understand the security implications of this scenario:
- I am staying in a hotel.
- I have a VPN on my android phone.
- I connect to the hotel's unencrypted WiFi network with the phone.
- I start a Wifi Hotspot on the phone. It has a secure password and WPA2 encryption.
- I connect my laptop to the Wifi hotspot
I know that (barring a a proxy on the phone or a rooted phone with a modified routing table) Android doesn't route the laptop's connection through the VPN , but directly to the underlying network interface (the hotel's unencrypted Wifi).
My question is, what kinds of dangers does this setup expose the laptop to?
I believe that these statements are true: are they?
the phone would effectively be acting as a router, so the laptop would NOT have an IP address on the hotel WiFi network directly, but rather on the phone's own private network, with the phone being its gateway.
- This means that potential attackers on the hotel WiFi network cannot send unsolicited packets to the laptop (i.e. can't port scan and such).
any unencrypted traffic received/sent by the laptop could of course be spied on by others on the hotel WiFi as it transited.
use of HTTPS would prevent anyone on the hotel wifi from spying on or injecting data into those streams (i.e. they couldn't modify an HTTPS website)
What other dangers are there for the laptop that I am missing?