Using public WiFi safety questions

[maflynn]

I repeat my question from before: What added security does a VPN Provide over the SSL connection provided by most websites?

What about man in the middle attacks that use SSL/TLS stripping, certificate spoofing, or downgrade attacks

If there's any risk of someone sniffing my packets, I don't want to just rely on a one method to protect my identity and data (https). VPN is a low lift, easy solution that is largely fire and forget and given the unknown nature of public hotspots, its better to be safe then sorry.

 

[crococarbs]

VPNs are largely snake oil unless you live in a high-surveillance state and/or need to overcome geoblocks (or are working for a company and need to access internal resources while away from the office).

As others are saying, most traffic over the net is now encrypted, so there's very little risk to using public wifi. About the only thing VPNs do is stop the provider of the wifi from profiling you.

Another issue is, while connected to a VPN all of your traffic is routed through the VPN provider, and how much can you say you trust the provider itself?

So are you happy to use your banking website on any free wifi? I understand that SSL encrypts things etc, *BUT* just as one example, a malicious free wifi could intercept DNS requests and send you a legit-looking malicious copy of your bank's website, and potentially gather some sensitive info from you.

So about trusting VPN, that's why it's key to choose reputable VPN provider. Don't use a no-name free VPN, use a serious accountable paid service provider, I use Proton VPN but there are others.

 

[maflynn]

VPNs are largely snake oil unless you live in a high-surveillance state

I think travel warriors who rely on many public hotspots, including hotel wifi, which has almost zero protections makes VPNs a safe option.

there's a reason why nearly every company uses VPNs to allow access to their networks, resources and applications when remote - because its not snake oil and protects their infrastructure. If companies feel its a worthwhile investment, why should I consider it snake oil

 

[Sully]

I use a VPN and encrypted DNS so that my ISP can’t profile my internet traffic. In public a WiFi situation a VPN has the added benefit of allowing you to get around network blocks. 🍆🍑

If you’re concerned about public WiFi, just use cellular data and skip the hospital wifi altogether.

 

[macfacts]

VPNs are largely snake oil unless you live in a high-surveillance state

I'm in Canada and my last hospital visit was free, the wifi was free too, the password was by the front desk, I think it just gets changed every month. I think a nurse chose the password cause it was a warm/fuzzy word. The only thing I had to pay for was parking. Even restaurants have free Wi-Fi, just ask the waitress for the password.

 

[Fishrrman]

OP:

Use a VPN, you should be fine.

You can sign up for the FREE version of ProtonVPN. It doesn't have all the bells and whistles of the "pay for" version, but it still ought to work well enough for your needs for the hospital stay.

That's really about all there is to it.

The best VPN for speed and security

Get fast, secure VPN service in 120+ countries. Download our free VPN now — or check out Proton VPN Plus for even more premium features.

protonvpn.com

Good luck on the hospital procedures...

 

[SalisburySam]

The typical response to a breach is to issue statements about how they use “industry standard security” (which means nothing), and to offer one or two years of credit monitoring.

Don’t forget the CEO-issued mandatory statement to customers stating that “…your privacy is our top priority!”

 

[OS X Dude]

VPN is the way to go. You can subscribe to a good reputable provider like Proton VPN, not sure if you can do a trial then cancel, worst case you have to pay for a month of VPN which is not a lot. Better to pay for a reputable service IMO, than to try to find a "free" one that who knows how their business model and practices are.

Proton literally have a free tier that's brilliant.

 

[popup]

Because why?
Because you’re afraid your hospital, who have your billing information already, will find out that you use Chase Bank? How does that endanger you?

We are talking about a public WiFi, being in a hospital is a detail.

 

[Plutonius]

If you limit your access to general surfing, you should minimize any problems.

 

[brilliantthings]

Mullvad VPN is $6 for one month for up to five devices. Problem solved.

 

[Bigwaff]

Another issue is, while connected to a VPN all of your traffic is routed through the VPN provider, and how much can you say you trust the provider itself?

Could you not say the same about your ISP? How much can you say you trust your ISP? Or any ISP? If you truly want to hide your traffic, you need a reputable VPN (examine reviews, whether there is no logs policy, independent reviews and security assessments of vendor, etc), encrypt DNS traffic, use a firewall, and just be plain smart and security conscious browsing or using the internets.

If you don't care, then whatever. At the very least, ISP is capturing your DNS requests so they know where your traffic is going... and selling it. There's gold in them there data hills.

 

[Sully]

Could you not say the same about your ISP? How much can you say you trust your ISP? Or any ISP?

Yes!!!!! Or, at least, any of the major ISP's in the US. Comcast, Spectrum, Google, and the list goes on. I trust Proton or Mullvad way more than any of these predatory ISP's.

I feel like VPN's that are are in the business of privacy, open source, and audited are much safer than any American ISP that has a draconian privacy policy that is forced on you, is not open source, and is unaudited. I assume my web traffic is a product for these ISP's to sell.

 

[Alameda]

We are talking about a public WiFi, being in a hospital is a detail.

So, inside a hospital, it will be the hospital’s WiFi network, but… ok, let’s say you use a public open WiFi in a coffee shop and you access your Chase bank. What danger presents itself? I contend that there is none, except somebody can find out that you bank at Chase, along with 35 million other people.

 

[Bigwaff]

So, inside a hospital, it will be the hospital’s WiFi network, but… ok, let’s say you use a public open WiFi in a coffee shop and you access your Chase bank. What danger presents itself? I contend that there is none, except somebody can find out that you bank at Chase, along with 35 million other people.

Google search "man-in-the-middle public wifi"

 

[Alameda]

Google search "man-in-the-middle public wifi"

I’m going to repeat myself a third time: What danger does public wifi present if you are using HTTPS, which is enforced by web browsers today?

With HTTPS, your traffic is encrypted between your computer and the target website. Your browser validates the target site through the use of cryptographic certificates.

The only “danger” anyone has listed is that a bad actor can determine which websites you visit.

 

[brilliantthings]

I’m going to repeat myself a third time: What danger does public wifi present if you are using HTTPS, which is enforced by web browsers today?

Weird tone but let's roll with it. I'm going to be the third person to tell you... You can be a victim of a person-in-the-middle attack on public wifi. Google it. This can be mitigated by using a VPN.

 

[Alameda]

Weird tone but let's roll with it. I'm going to be the third person to tell you... You can be a victim of a person-in-the-middle attack on public wifi. Google it. This can be mitigated by using a VPN.

How can a man in the middle attack present a certificate which convinces your browser that it is making a legitimate HTTPS connection to the website of your choice?

 

[psingh01]

I repeat my question from before: What added security does a VPN Provide over the SSL connection provided by most websites?

SSL encrypts the connection between you and the website but the ISP and anyone in between (hospital wifi) will know what website you are connected to.

With a VPN the ISP, or in this case the hospital network, only sees you connect to the VPN server and it is encrypted as well. All of the details about the website that you are connecting to are only seen at the vpn server which makes those connections (if the connection is ssl then it is encrypted from them too but they see the host).

A crude analogy is ssl is like putting a letter in an envelope. Anyone can see the address on the envelope but not the letter inside. VPN is like putting that envelope inside another envelope and the address on the outer envelope is for the vpn server.

 

[Alameda]

SSL encrypts the connection between you and the website but the ISP and anyone in between (hospital wifi) will know what website you are connected to.

With a VPN the ISP, or in this case the hospital network, only sees you connect to the VPN server and it is encrypted as well. All of the details about the website that you are connecting to are only seen at the vpn server which makes those connections (if the connection is ssl then it is encrypted from them too but they see the host).

A crude analogy is ssl is like putting a letter in an envelope. Anyone can see the address on the envelope but not the letter inside. VPN is like putting that envelope inside another envelope and the address on the outer envelope is for the vpn server.

Thus, using SSL over a public WiFi network is safe and a man in the middle attacker cannot obtain your passwords or any of your confidential data.

 

[Bigwaff]

A crude analogy is ssl is like putting a letter in an envelope. Anyone can see the address on the envelope but not the letter inside. VPN is like putting that envelope inside another envelope and the address on the outer envelope is for the vpn server.

Continuing the analogy, if you use encrypted DNS (DoH) then the address on the envelope can't be read as well.

Thus, using SSL over a public WiFi network is safe and a man in the middle attacker cannot obtain your passwords or any of your confidential data.

I'm sure you are capable of doing your own research to learn about "man-in-the-middle" attacks over public wifi. Just using SSL doesn't protect you from an attack vector. There are other methods to steal your passwords and confidential data with "man-in-the-middle". I don't use public wifi w/out a VPN. Anybody can pretend to be Starbuck's guest wifi network.

 

[Alameda]

Continuing the analogy, if you use encrypted DNS (DoH) then the address on the envelope can't be read as well.

I'm sure you are capable of doing your own research to learn about "man-in-the-middle" attacks over public wifi. Just using SSL doesn't protect you from an attack vector. There are other methods to steal your passwords and confidential data with "man-in-the-middle". I don't use public wifi w/out a VPN. Anybody can pretend to be Starbuck's guest wifi network.

“Do your own research” is not an answer. No-one in this thread has explained how public WiFi is unsafe to use and how passwords can be stolen in man in the middle attacks.

VPNs cost money and slow your connection speed. So if the question cannot be answered, then why put up with added expense and slower speed?

 

[brilliantthings]

“Do your own research” is not an answer. No-one in this thread has explained how public WiFi is unsafe to use and how passwords can be stolen in man in the middle attacks.

VPNs cost money and slow your connection speed. So if the question cannot be answered, then why put up with added expense and slower speed?

For anyone who's interested in finding out about why visiting SSL websites doesn't protect you entirely, DYOR. It's very easy to find. And easy to discover that a VPN protects you.
If you're in hospital for less than a month, pay Mullvad $6 and forget about it.
PS not loving your tone and I'm not going to match it. DYOR is a fine answer.

 

[Alameda]

So are you happy to use your banking website on any free wifi? I understand that SSL encrypts things etc, *BUT* just as one example, a malicious free wifi could intercept DNS requests and send you a legit-looking malicious copy of your bank's website, and potentially gather some sensitive info from you.

So about trusting VPN, that's why it's key to choose reputable VPN provider. Don't use a no-name free VPN, use a serious accountable paid service provider, I use Proton VPN but there are others.

If a malicious attacker spoofed your bank’s website, SSL authentication would fail. They would not posses the certificate necessary to prove to the browser that they are chase.com or whatever.

 

[SevenTheGamingKitty]

A VPN absolutely will protect you, and offers real safety benefits, as it encrypts your network traffic from your computer

isn't connecting to websites over HTTPS also encrypted?