So you’re sitting at the airport. Your flight has been delayed (again), and you

Question

So you’re sitting at the airport.

Your flight has been delayed (again), and you can’t help but wonder if your HR forgot to reimburse you for last month’s business trip (again). No problem, you think. You’re at the coffee shop. They offer free WiFi. Fire up the laptop and check your bank account. Done.

Sounds great. Until you realize days later that one of the 200 people sitting around you “listened in” on your signal; has your bank login information; and is now sitting in a similar coffee shop in Aruba—all on your dime.

What are some things to help keep your public hotspot Web surfing safe and trouble-free?

Explanation / Answer

When you connect to an open Wi-Fi network like one at a coffee shop or airport, the network is generally unencrypted — you can tell because you don’t have to enter a passphrase when connecting. Your unencrypted network traffic is then clearly visible to everyone in range. People can see what unencrypted web pages you’re visiting, what you’re typing into unencrypted web forms, and even see which encrypted websites you’re connected to — so if you’re connected to your bank’s website, they’d know it, although they wouldn’t know what you were doing.

In practice, there are a variety of attacks that can be performed against you if you were to connect to your bank’s website on public Wi-Fi. For example, sslstrip can transparently hijack HTTP connections. When the site redirects to HTTPS, the software can convert those links to use a “look-alike HTTP link” or “homograph-similar HTTPS link” — in other words, a domain name that looks identical to the actual domain name, but which actually uses different special characters. This can happen transparently, allowing a malicious Wi-Fi hotspot to perform a man-in-the-middle attack and intercept secure banking traffic.

Malicious Hotspots

Most dangerously, the hotspot you connect to itself may be malicious. This may be because the business’s hotspot was infected, but it may also be because you’re connected to a honeypot network. For example, if you connect to “Public Wi-Fi” in a public place, you can’t be entirely sure that the network is actually a legitimate public Wi-FI network and not one set up by an attacker in an attempt to trick people into connecting.

Protecting Yourself: Don’t do online banking or access sensitive data on public Wi-Fi if possible, even if the sites are encrypted with HTTPS. A VPN connection would likely protect you, so it’s a worthy investment if you find yourself regularly using public Wi-Fi.

Related Questions

Navigate

• Browse (All)
• Browse S
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.