How safe are public Wifi hotspots ?

[fab5freddy]

I am curious to know how safe public wifi hotspots are ?
when you are at a Starbucks surfing on their network,
how hard is it to packet sniff usernames and passwords ?

Also, if you are using a https secure site like an online bank,
does that make it much safer against hackers ?

thanks!

 

[mac2x]

No, they aren't particularly safe. Run your firewall at it's most restrictive settings, and I personally would never do online banking on a public network, even though all the sites are encrypted. Perhaps if you subscribe to a VPN service it might be better, but I have no experience there.

 

[SeenJeen]

I turn off ALL sharing when I'm in a public hotspot. I would suggest turning on OS X's firewall because it is OFF be default.

Anything is "easy" for an experienced hacker; OS X has exploits, Windows has exploits, Linux has exploits.

Sure, a secured connection is excellent protection, that is, if the hacker doesn't have a direct connection to your computer

Leave banking and all that fun stuff for home, or on a private connection.

 

[miles01110]

They're not safe at all.

 

[GoCubsGo]

Do as others have said and turn off all sharing and turn on that firewall. I wouldn't trust doing much by way of banking on a public network.

 

[fab5freddy]

yep, but after turning off all file sharing and turning on
the maximum firewall protection, how safe are you with all
this in place ?

 

[xraydoc]

yep, but after turning off all file sharing and turning on
the maximum firewall protection, how safe are you with all
this in place ?

The owner of the public network (or, as the case may be, the "pwner" of the network) can fairly easily packet sniff and snatch passwords, usernames, etc., if he wanted to. Using SSL-encrypted sites makes things safer, but any data passing back & forth on that site that doesn't happen to encrypted would be at risk.

The risk of your computer being directly hacked into is minimized by using a strict firewall.

Bottom line: If you're using a public access point, you're theoretically at risk. The risk may be low, but I personally wouldn't do any banking and any email I access should use an SSL-encrypted login.

 

[fab5freddy]

well, what i am referring to is, sometimes i'll use the public Wifi
at my local Starbucks, which is run by AT&T wireless.

i have my Gmail set to always use https SSL.
and all my banking sites are https secure.....

I have all file sharing off and have my Mac firewall turned on
blocking all incoming connections...

 

[madog]

well, what i am referring to is, sometimes i'll use the public Wifi
at my local Starbucks, which is run by AT&T wireless.

i have my Gmail set to always use https SSL.
and all my banking sites are https secure.....

I have all file sharing off and have my Mac firewall turned on
blocking all incoming connections...

Theoretically, you're not all that safe on a public network.

Realistically, the chances are slim that anything will happen (sure, there could be some evil network admin or sneaky teenager trying to hack connected machines, but... c'mon). As long as you are aware, and take the necessary precautions like you are, then you shouldn't have anything to worry about.

As far as anyone gaining physical access to your Mac, the only way they could do that is if they are watching, and your browser is connected to a specific website with malicious code in it for an extended period of time that would let them gain access. The chances of that are slim to none. Even if you had file sharing on they couldn't do much unless you changed the read/write permissions or didn't have an administrator password set.

If logging in to anything on the web through an https site, then you're pretty much A-OK (regardless of a public network or not).

 

[fab5freddy]

thanks maddog, nice to hear 2 sides of the story.

 

[drspringfield]

There was an interesting project where a guy had a few Tor endpoints (meaning he had a bunch of people's traffic routing through his computer), and he wrote a tool called "sslstrip" that takes common websites (like say, bankofamerica.com), and "strips" the SSL from them.

He found that the vast majority of people don't notice. If everything looks and works normally, people rarely notice the absence of the lock and the "http" where "https" should be.

If you're using a public hotspot, stay alert for such tricks.

 

[fab5freddy]

Cool, I will note that!
Though i always look at the Green Address bar in Firefox
making sure it is on SSL mode when i log into my online banking!