Public AP: How to reduce vulnerability window between Captive Portal and starting VPN?

Question

I always use a VPN on my Mac when I access over public APs (such as coffee shop free WiFi)

How much should I worry about the window of time where I am in the captive portal (the agreement screen) and have not yet started my VPN? My hunch is "lots".

What are some best approaches when you are tempted to use a public AP?

Would it be something like:

• Don't have any browser tabs that will try to refresh before you get the VPN started

• Minimize the number of background processes that will try to connect

I suppose another approach is "punt on public AP whenever possible, and tether to a VPN connection over your phone instead". Chews up data though.

What do the more security-savvy folks advocate?

Answer 1

I suppose another approach is "punt on public AP whenever possible, and tether to a VPN connection over your phone instead". Chews up data though.

You have basically two strategies for your risk (surfing on a public AP).

• Elimination: Not using it
• Mitigation: Taking precautions to reduce the probability and impact of having information disclosed.

How much should I worry about the window of time where I am in the captive portal (the agreement screen) and have not yet started my VPN?

VPN will just help you by encrypting your data traffic, which I understood as your major concern when surfing on a public AP. You will be unable to surf anyway until you pass the "captive portal", so I don't see a lot of risk here from a browsing perspective, as long as the only tab you have opened is "agreement screen".

However, once you boot your Mac, some of your applications are very excited awaiting for a network connection. As soon as you connect to the public AP they will try to connect to the Internet (which will fail since they will be probably faster than you opening the "captive portal". Depending on how they were built there is a risk of revealing information. e.g.:

• Password in an url [Caught by a sniffer]
• DNS spoofing [An application pretending to be the one your application is expecting]
• Browser tabs previously opened or installed addons [Although here you could be protected by a time-out])

Other considerations

You are heavily focused on the disclosure of data in transit, however there are other risks when connecting to an unknown AP.

However keep in mind (one example of many others) that someone could by scanning your ports in order to attack open ones which have vulnerable applications listening to it. VPN won't help you here.

Answer 2

There are two enterprise level approaches (apart from banning of course! which many do).

The OS firewall can be made to ban direct connections from all applications. This can be combined with some app to handle the initial VPN connection. It should be made to allow access direct to the Internet for a short period or until the VPN connection is made. It should ideally also have an embedded browser to allow access to captive portal pages. That is actually a reasonably secure way of working.

The alternative is to use a 3rd party VPN connector such as the CISCO client. However, I'm afraid I'm not familiar with Mac security so I don't know what might be available. I'm told the OpenVPN can be configured securely for captive portal but again, I'm not familiar I'm afraid. The best VPN clients I've seen work similarly to my first point. They block all network traffic except for http(s) which is only accepted into the client which contains an embedded browser. Once the VPN connection is made, they enable full network access again. With Windows, it is also possible to have a client that replaces the GINA login component with a VPN aware version - this allows secure mounting of network drives during login as well.