Imagine the following scenario:

  • Users connect to an open WiFi network (no password, no encryption)
  • All users stick to secure transmission protocols for all confidential data (HTTPS, SSH, VPN, etc.)
  • Users devices do not accept any inbound connections

Would this scenario provide a reasonable level of security for the users involved? Or perhaps more importantly, does a malicious user's presence on an unencrypted WiFi network pose a known threat to the other users?

  • Secure from what? Even though the content is encrypted, other data is available (destination, presence of the client, active use, etc.) What's your threat concern? – schroeder Aug 6 '15 at 16:21
  • You also have the obvious MITM issues to deal with, but I'm not sure that is in scope of your question. – schroeder Aug 6 '15 at 16:21
  • @schroeder I assume by MITM you mean relating to trusting the router/network itself? I more mean only the other users being untrusted. And I largely mean from an anonymity/confidentiality perspective. I'm not sure client existence or destination IPs are going to tell other users much? – thesquaregroot Aug 6 '15 at 16:25
  • MITM means a malicious actor on the open network forcing traffic through their computer in order to collect content of encrypted streams. Destination IPs are not the only destination data: DNS queries and domain names can also be sent in the clear even when using encrypted communication. – schroeder Aug 6 '15 at 16:32
  • @schroeder Even still, does that data necessarily pose a threat to that user's identity or data? Except in extreme cases where the malicious user may be able to infer the identity of another with this information, I'm not sure I see how it poses a general threat. – thesquaregroot Aug 6 '15 at 17:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.