8

I'm quite a bit of a traveller. So i tend to just stay with my smartphone and sometimes notebook. I'm not a security expert but i would like to check how to know if wifi is safe to use. For example, at airport or cafe. Sometimes, cafes or hotels offer wifi without password or some kind of login page before use. The one thing I'm doing right now is if i use public wifi i dont go and online shopping i just check my emails and search some train times.

However, i would like to stay safe as much as possible how do i check if the wifi im logged in is safe from sniffer?

20

You can't. It doesn't matter whether the wifi is encrypted or not: you can't know whether the access point is trustworthy. A WPA2 access point with a strong password doesn't help when the access point itself is a rogue access point put up by someone who may or may not be the café or hotel owner. And yes, it happens — people put up open access points with reasonable-sounding names in likely places that don't have one, or provide better signal, in order to retrieve the data of unwitting visitors.

For something like checking emails, always use HTTPS. Take extra care to verify that the certificates are valid, and if they aren't, don't connect.

For something like checking train times, it doesn't really matter. If you're accessing public data and don't particularly mind if someone learns what you're accessing, you have no need for security. If you're concerned about privacy, or if you're concerned that the information may be maliciously modified in transit, connect to a known good VPN service. Again, don't click through any “invalid certificate” warning.

  • 4
    I personally always tunnel my traffic through an SSH tunnel or VPN (also making sure all my DNS traffic sent through the tunnel). – Lucas Kauffman Jan 2 '14 at 20:50
  • @gilles actually checking train times can be bad, an HTTP request can be seen and an attacker can modify the HTTP response to include, for example, a JavaScript block to do bad things or deliver malware, or watch this amazing video from the author of Silica (wireless pentest kit) silica.immunityinc.com/SILICA-7.17-service-impersonations.mov) for more craziness – Tate Hansen Jan 2 '14 at 22:51
  • 1
    @TateHansen What the MITM can do is no worse than what the website can do. If you trust your system to visit random websites, you can use HTTP in realistic scenarios. (Yes, ok, maybe you're Phileas Fogg and Fix MITMs you to make you miss your train, but that's an unusual scenario.) – Gilles Jan 2 '14 at 22:57
  • 1
    To tack on some more information from a business traveler about smart devices. Once connected to a network many of them will attempt to auto connect which can give attackers/fake AP's your credentials. – Ajaxasaur Jan 3 '14 at 22:20
  • Lucas's VPN suggestion is pretty much the only way to be sure that your internet session is safe while on a public network. If your employer doesn't provide a VPN connection (and if they do, make sure that all traffic is tunneled over it, and not just traffic to the corporate servers), there are a number of relatively inexpensive VPN providers out there. That said, if you stick to HTTPS for anything that requires a password or has personal information (like email), and keep your system up to date, then you should be relatively safe. – Johnny Jan 4 '14 at 1:31
2

There really isn't a finite answer here. A Wifi showing a lock is promising some sort of encryption, but this encryption is covering the over the air transmission only. WPA2 is a generally better mechanism than some of the earlier encryption mechanisms (you may see this as part of the description of the network) but the bigger problem is that you really don't know what's sitting behind the wireless router that is offering you connectivity. You have to figure that the average coffee shop or hotel is not putting a huge ton of money into keeping their network spyware free.

When a shop offers measures like passwords, click through web pages that make you accept terms and conditions or other add-on measures - their big driver is really business - they want to make the wifi available to customers who are paying them money and they want to protect themselves from lawsuits (thus the terms and conditions). It's a good sign to see this, as it means someone put a little thought and effort into thinking through the configuration, but it's by no means a perfect guarantee.

General protection measures are recommended by many companies and fall into the following categories:

  • keep your software up to date - since the network isn't going to screen spyware for you, make sure your defenses are good.
  • have virus scanning and a personal firewall if you are concerned about your data and your system's integrity
  • when using a work computer, use any VPN client you are given - it never hurts to use it even for default browsing, as it means your traffic will be routed through the network and some level of privacy is being applied.
  • don't do unsecured transactions of sensitive data - always make sure HTTPS or SSL is on when you're sending a credit card, personal info, or other information you want kept private.

I'll admit, it is likely to be more a gut reaction than anything, but I feel a little better using a big business wifi than a smaller business - for example, I'd feel pretty sure that Starbucks has concocted a fairly regimented way of providing wifi at all locations that involves a least a reasonable attempt to keep malicious junk off their network. Similarly I feel a little better on branded wifi - for example, you'll notice that all Starbucks use attwifi - AT&T is their host. AT&T would prefer not to have their network gear compromised, so I figure they have probably taken a few standard steps to keep their infrastructure patched and up to date. I'm still not going to be lax about the steps above, but I'm less likely to consider this as huge a risk as Mom&Pops diner with a wifi that shows the out of the box name of the product and no password at all.

And one last non-technical caveat - don't underrate shoulder surfing. It's far easier to snoop the top of someone's desktop than to go to all the work of hacking a network. The great thing about wifi hot spots is that you know people may be using computers near them.

  • Seeing an "attwifi" SSID doesn't ensure that you're really connecting to a genuine AT&T Wifi network -- you might be connecting to the laptop of the guy next to you. – Johnny Jan 4 '14 at 2:38
  • Fair enough... although if I am sitting in Starbucks, see one and only one attwifi, and get the typical Starbucks clickthrough screens, I feel moderately comforted. Yes, the guy in the table next to me could be spoofing me... but if I have a reason to be that paranoid, I really shouldn't be using any public Wifi at all. – bethlakshmi Jan 6 '14 at 22:18
2

There is no such thing as a "safe WiFi". Not that the encryption and other security features of a WiFi access point are necessarily weak (well, they are, but they conceptually be otherwise); but a WiFi is only an access point, i.e. a door to the wilderness of the Internet, where tigers and bears and lions roam. Regardless of what happens at the WiFi level, sniffers can occur everywhere on the path from your machine to whatever server you are contacting.

Use SSL (i.e. HTTPS Web sites) to protect against sniffers anywhere in the path. And lo! this will also protect you against the vagaries of an evil-minded rogue access point.

1

One of the approaches can be tunnelling all the traffic through SSH. You just need to have a remote access to a trusted computer somewhere in the world (or personally yours). Tunnelling via SSH can be done from all devices such as phones, laptops, tablets which run Android, Linux or Windows. I personally prefer do this running SSH server on my home computer.

With SSH tunnel you can get all the traffic encrypted between your device (in the place like internet cafe or public WiFi spot) and trusted remote machine. So it would almost the same like you are physically in front of your trusted machine and browsing internet from it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.