When you connect to an open wireless network (that is, a wireless network without any symmetric password set) is there any sort of secure key exchange going on, or is data sent back and forth unencrypted and able to be intercepted by anyone "listening"?
Yep. Open wireless networks are entirely unencrypted; anyone can see all the data you send (even if they aren't connected to the network).
an open wireless connection means there is no password exchange required to connect to the network. most data used over an open wireless connection is easily observed. once connected however, there are ways to encrypt your data such as using a vpn. This would allow data to be encrypted over an open wireless connection like public hotspots. though an observer is able to see that there is data, it would be unreadable.
Wireless networks that do not ask for password sen data over the air unencrypted and anyone can :
- Scan your pc/phone to actively try to exploit a component in your hardware
all data via http:// e.g cookies,downloads,images,passwords and email sent
Do Arp Spoofing
Additionally you can't even be sure that the Wi-fi network is legitimate.
That's all i remember for now...and what can you do?
Make sure you do anything sensitive over https://
Always set connection to public so sharing is off by default
On phones if sending sensitive emails is better to use your browser than using pop3 (see source )
Why can't open Wi-fi provide encryption ? Well is no technically impossible i guess the simple answer is because nobody wants it bad enough plus would be hard to upgrade all existing infrastructure. I think they could easy do something like normal TLS encryption with CA certificates but this could make possible to them sniff in your https traffic which is bad(i'm not sure maybe someone can explain this better)