Can I use an AP "Bridge" with password to imporve security over an open, unencrtyped WiFi signal?

Question

I have access in my neighborhood to an open, unencrypted WiFi signal but I am leery of using it because of security reasons.

I don't want to let my username, passwords or credit card numbers available over an open , unencrypted WiFi signal.

My question is this, I purchased a router that has the ability to "Bridge" to this open WiFi signal and it creates a new "Access Point" that requires a password and provides encryption.

Is this router actually providing security with the new "Access Point" that "Bridges" to the open signal? Is the data passing through the air to the original WiFi AP now encrypted because the 2nd "Bridge" router is using encryption.

Thanks for any feedback!

Answer 1

This would provide no additional security unfortunately.

If you use the new AP as a bridge you would not then be able to connect to it via WiFi, you would connect to it via Ethernet. It effectively connects your wired network to the WiFi network.

That aside because the network is open anyone can join the network. Once on the network (even if the AP bridge did offer you protection) they could still gain access to your traffic using a MiTM (man in the middle) attack like ARP Cache Poisoning. I've written a few articles on my blog about Session Hijacking and Code Injection which are a couple of attacks you would be vulnerable to.

Answer 2

Your "bridge" AP will offer no additional protection for any traffic going to/from the Internet. However, depending on how you have your network configured, it may be able to provide protection for local traffic between your own devices.

As it stands, your path to the Internet is this:

You --> Open WiFi --> Internet

You're proposing some sort of configuration that changes the path to this:

You --> Secure Bridge --> Open WiFi --> Internet

As you can see, your traffic is still passing through the Open (and insecure) WiFi network. Traffic flowing between your devices and the Secure Bridge will be encrypted and therefore protected from eavesdropping. But any traffic that is internet-bound will have to be sent across the Open WiFi network in the clear* - otherwise the Open WiFi network wouldn't know how to handle it.

*Note: Here, "in the clear" is referring only to the physical layer of the transmission. Your traffic may be protected by encryption at higher layers (e.g.: HTTPS) in certain applications.

The only protection added is for local traffic sent between your own devices which are connected to your Secure Bridge. That is, traffic passing between your devices that does not need to be routed through the Internet (e.g.: file transfers via network share). Since this traffic is not Internet-bound, it will never need to be sent over the Open WiFi and therefore will be protected by the encryption your Secure Bridge uses even if it is not encrypted at a higher layer.

The only way to keep your traffic secure when there is an untrusted network in your path is to make sure it is all encrypted at a higher layer. Typically, this is done via VPN tunneling (e.g.: Tor). VPN tunneling effectively changes your network path to this:

You --> VPN Provider --> Internet

Of course you still need an existing network, such as the Open Wifi, to connect. But, with all your traffic passing through a VPN, nobody on that network will be able to casually eavesdrop on your transmissions. You also need to bear in mind that the VPN provider will have just as much access to your traffic as if it was being sent over an Open WiFi network, as will anyone along the path from the VPN provider to the Internet endpoint - endpoint included.

For any data you want truly protected in transit, you need end-to-end encryption at the highest layer possible. This is usually done via application-level protocols like HTTPS, SSH, and PGP.

Answer 3

You need to consider the following:

1. Your new AP that you are planning to configure in bridge mode would simply extend the original signal to you and you will still have the unencrypted WIFI signal to connect to on the new AP.
2. Suppose that you were able to connect the new AP to the open AP as a client, since you have no access to the open AP's configuration (I assume), you will have to connect it with open WIFI signal (AP to AP connection). Now even if you use another signal band on your new AP that is encrypted and secure, all your traffic between the new AP and the Open AP will still be unsecure even though the connection between you and the new AP was secure.

The short answer to your question is NO.