[HN Gopher] Wi-Fine
       ___________________________________________________________________
        
       Wi-Fine
        
       Author : signa11
       Score  : 73 points
       Date   : 2022-08-02 05:56 UTC (17 hours ago)
        
 (HTM) web link (wifine.gitlab.io)
 (TXT) w3m dump (wifine.gitlab.io)
        
       | coltoneakins wrote:
       | Love this quote:
       | 
       | > When times change, the wisdom from that past era tends to stay
       | around for a longer while.
        
       | cypherg wrote:
       | "Additional, HSTS (with preloading) is quite widely deployed
       | (especially at big cloud services), which makes plain text
       | downgrade attacks hard to deploy."
       | 
       | looooooooooooool
       | 
       | Turns out, that was a lie
        
         | eloy wrote:
         | Is it? I just checked https://hstspreload.org/, and it seems
         | that twitter.com, facebook.com, outlook.com, cloudflare.com and
         | gmail.com are all preloaded.
         | 
         | Or do you mean that downgrade attacks are still easy to deploy?
         | Under what circumstances?
        
           | JackGreyhat wrote:
           | With a reverse proxy. You can reverse proxy any HSTS website,
           | and feed it to any client over plain http
        
             | notriddle wrote:
             | A client with the HSTS preload list will not connect to
             | facebook.com over plan HTTP. That's the whole point.
        
       | sph wrote:
       | To me public Wi-Fi is pretty much a honeypot. Most people I know
       | don't rely on it, especially with widespread 4G and mobile
       | phones, so the only people using it are shady figures for whom
       | open and public Wi-Fi is just another step in their OpSec.
       | 
       | I figure if you connect to an open Wi-fi and then to a VPN
       | endpoint, you're put on some government list.
        
         | can16358p wrote:
         | Many people do rely on it, they don't probably even know what a
         | password does vs an open network.
         | 
         | If people around you tend to have a profile like HN users yes
         | they of course know what they're dealing with.
         | 
         | Bur for the rest of the non-techie 99% of the world, public Wi-
         | Fi is perfectly fine.
        
           | sph wrote:
           | Perfectly fine for what? I live in Europe, everybody has
           | Internet at home, and if they're out, they have 4G on their
           | phone.
           | 
           | When would one need the coffee shop wifi, especially non-
           | techies that go there just to have a coffee, not to work?
           | Honest question.
        
             | legalcorrection wrote:
             | The vast vast majority of Europeans don't have unlimited
             | data plans with unlimited tethering. Not sure why you would
             | think they do.
        
               | cassianoleal wrote:
               | Reception can be pretty spotty in many areas as well, so
               | even if you do have unlimited data and tethering, you
               | might benefit from a public wifi.
        
         | _fat_santa wrote:
         | At places like Starbucks I wonder what all they do behind the
         | scenes to make sure the network is secure. Like if I go into a
         | mom and pop coffee shop and ask for the WiFi password, that's
         | one thing. But with starbucks all having a standardized wifi
         | infra in their stores, I wonder what sorts of things are
         | happening behind the scenes to make sure everything stays
         | secure. If consumers are worried about WiFi at these places, I
         | bet Starbucks IT obsesses over it.
        
         | legalcorrection wrote:
         | Everyone who goes to a coffee shop with their work laptop is
         | probably connecting to a VPN over open WiFi.
        
         | jobigoud wrote:
         | But what would they put on that government list exactly? Your
         | mac address?
        
           | tinus_hn wrote:
           | At least iPhones use a randomized MAC address for WiFi to
           | prevent tracking.
        
       | jeroenhd wrote:
       | Set your browser to HTTPS only mode (a setting in all modern
       | browsers) and you'll be Mostly Safe (TM). Also enable DoH (using
       | your own server, if you don't trust public ones) and you'll be
       | Even More Safe (TM).
       | 
       | Yes, you're exposing yourself to some random people on the
       | network who may try to attack your laptop or phone, but as long
       | as you enable your firewall you're Probably Fine (TM).
       | 
       | I'd avoid using public WiFi if you're a government agent or
       | working with highly sensitive data just in case. In all other
       | cases (i.e. 99% of people using their laptop in public) it's
       | perfectly safe if you just don't disable your device's security
       | mechanisms.
        
       | Avamander wrote:
       | Getting owned wise - maybe. Privacy wise - no.
       | 
       | Not all web traffic is HTTPS, way too much of it still isn't. Not
       | everything is HTTP(S) even, some nastiness comes from other
       | protocols. DNS is still rarely encrypted. NTP basically* isn't
       | encrypted. And all those combined allow a lot of privacy-invasive
       | profiling to be done. Without WPA3 public, it's also passive and
       | you have no clue.
        
         | ActorNightly wrote:
         | Its still fairly easy to spoof APs. 802.11w aims to prevent
         | this but support is spotty. And a spoofed AP means now the
         | attacker has access to things that would normally gated behind
         | NAT.
         | 
         | Although with use of social engineering, you can set up a
         | gateway page that says something like "Log in to Facebook for
         | free wifi", bypassing the need for any exploits.
        
       | j0057 wrote:
       | I'm no security expert, but this discussion leaves a large part
       | of the threat model implicit before discussing countermeasures:
       | what is the asset that needs protecting, who is the threat actor,
       | what is the threat vector, what would be the likelihood and the
       | damage. Not spelling this out leads to a lot of "yeah, but what
       | about XYZ" discussions.
        
       | _fat_santa wrote:
       | This something that annoys me to no end about VPN ads. I listen
       | to alot of podcasts so I can't go a day without hearing an ad for
       | ExpressVPN. The ad read always includes a bit about "hackers
       | being able to see your data on an open network".
       | 
       | And while technically true, I could technically run an old http
       | only site and you might happen to be on the same network as a
       | hacker using the decades old Firesheep, so yeah technically that
       | could happen, but it's just so disingenuous when they come out
       | and hammer that point home.
       | 
       | Anyways rant over.
        
       | badrabbit wrote:
       | Oh wow this shit again. @joepie91 you are very wrong about VPNs
       | and this is the sort of mess that gist thread leads to if you
       | ever see this.
       | 
       | Has OP never heard of responder? Things other than browsers are
       | actively making and accepting network requests all the time.
       | Plenty of sites by default have port 80 open and redirect to 443
       | (can be intercepted).
       | 
       | Please do not spread harmful information. Never (ever) use an
       | open wifi without a VPN.
       | 
       | Edit: My favorite APT that abuses this:
       | https://www.kaspersky.com/resource-center/threats/darkhotel-...
       | 
       | Oh, and if you have corporate VPN make sure there is no split
       | tunneling. And even with a good VPN, make sure to set explicit
       | restrictive host firewall rules. As in no traffic allowed to the
       | public wifi interface subnet aside from captive portal and dhcp
       | (e.g.:wpad)
        
       | tialaramex wrote:
       | In this space, if you have WPA3 then there's no benefit to having
       | a "password" for WiFi which actually is public knowledge.
       | 
       | In WPA and WPA2 the password means network use is encrypted,
       | which means a completely passive adversary can't just snoop the
       | network so long as there's a password.
       | 
       | But in WPA3 even _without_ a password everything is encrypted
       | anyway, your station says  "Hey, I'm joining this network here's
       | a number" and the AP says "Welcome aboard, here's a different
       | number" and now you've got encrypted networking. Obviously with
       | no password the AP could be an imposter, but passive snooping is
       | impossible.
       | 
       | On the other hand, if you're dead set on identifying users,
       | there's no substitute for the Enterprise WiFi behaviour all the
       | way from WPA onwards where users have a username and password,
       | doing this locally for your home WiFi is very annoying, but at
       | scale it's convenient yet able to be responsible. The entire
       | world's academic community have a single such network EduROAM, if
       | you're an MIT student and you happen to be in the library of a
       | Polish university, your WiFi just works, or if you're a Cambridge
       | professor giving a talk at the University of Sydney in Australia,
       | same deal. The institution where you're a guest knows your
       | identity (often email address), but doesn't see your credentials
       | (password in most cases), it's trusting your home institution to
       | validate that identity.
        
         | badrabbit wrote:
         | Even for wpa3 if it is public wifi you should use a VPN and
         | restrict LAN traffic because of other hostile clients on the
         | WLAN.
        
         | NoahKAndrews wrote:
         | Small correction: with WPA2, a passive observer can decrypt the
         | traffic between a device and the access point if they know the
         | password and capture the initial connection of that device.
         | Wireshark has built-in support for this.
        
         | thenthenthen wrote:
         | Funny, when teaching networking we would be able to visit each
         | others local webservers across multiple campuses and subnets
         | (!) on EduRoam. Fun times.
        
         | tsm wrote:
         | I worked in IT support as an undergrad ten years ago and am now
         | going to grad school and using eduroam. It is _such_ a night-
         | and-day difference; I 'm so incredibly pleased that there was
         | enough international and inter-institutional cooperation to
         | make it work.
         | 
         | I especially like it when I open up my laptop at a new coffee
         | shop and discover it's already connected to eduroam--in the
         | city I live in (Edinburgh) there are enough university
         | buildings scattered around that a surprising percentage of the
         | city center is covered. The National Library also uses eduroam.
        
           | solarkraft wrote:
           | Same deal in my city. Very cool!
           | 
           | ... it also raises questions about what would be so hard to
           | just distribute WiFi access to all citizens.
        
         | sillystuff wrote:
         | > The institution where you're a guest knows your identity
         | (often email address),
         | 
         | The identity in the outer EAP does not have to be your real
         | identity, just the realm (@domain.dom) must be correct so the
         | radius proxying can be routed appropriately. E.g.,
         | anonymous@example.edu in the outer EAP will work fine for the
         | user, jdoe@example.edu.
        
       | eloy wrote:
       | Hi! Author of that website here.
       | 
       | Can some mod or the OP that submitted this post change the title
       | to "Wi-Fine: it is fine to use public Wi-Fi"? The current one is
       | not very descriptive.
       | 
       | Also, let me know if any of you have comments to me specifically.
        
         | HellsMaddy wrote:
         | Email hn@ycombinator.com, they usually respond really quickly.
        
         | signa11 wrote:
         | unfortunately, the submission is past a deadline (not so sure)
         | for title change. perhaps @dang can help ?
        
       | fmajid wrote:
       | HSTS is surprisingly NOT widely deployed, never mind HSTS
       | Preload. Google, Amazon, eBay, BofA or Chase have neither.
       | Facebook, to its credit, does, then again with Facebook your
       | threat model is what' _inside_ the perimeter.
       | 
       | https://blog.majid.info/hsts-preload/
        
       | throwoutway wrote:
       | I was trying to explain this to someone recently and basically
       | described the same.
       | 
       | However, there's still a privacy risk on a public wifi, correct?
       | As in your neighbor can see the DNS requests (as those are
       | generally unencrypted).
       | 
       | If you use a VPN, cool, but now your "free VPN" gets to see that.
       | 
       | The only other issues I could think of were ARP poisoning /
       | spoofing and maybe local phishing redirects
        
         | aidenn0 wrote:
         | DoH encrypts dns requests over the local network.
         | 
         | HSTS helps with local phishing redirects, as the browser ought
         | not load a 3xx request over http for sites with HSTS enabled.
        
         | feet wrote:
         | There are multiple reputable non free VPNs, why are you jumping
         | to the conclusion that all VPN users are on a free one?
        
         | nibbleshifter wrote:
         | A fair amount (DNS, etc) is still in the clear, yes.
         | 
         | I still see a good amount of clear text web traffic when I do
         | packet captures in airports and the like.
         | 
         | Usually image or media files, but the odd time I see some badly
         | conceived automatic update process pulling an exe or msi over
         | plaintext HTTP.
        
           | closewith wrote:
           | > I still see a good amount of clear text web traffic when I
           | do packet captures in airports and the like.
           | 
           | Of all the places I'd avoid packet sniffing, that's high on
           | the list.
        
             | jstanley wrote:
             | Why?
        
               | closewith wrote:
               | Because irrespective of the legality of packet sniffing
               | on a network you don't own, airport police have no chill.
        
             | nibbleshifter wrote:
             | Its where you find the best variety of packets! Far
             | superior to cafes.
        
           | roustem wrote:
           | Would something like NextDNS help?
        
             | tialaramex wrote:
             | NextDNS offers DoH (DNS over HTTP) so yes, your DNS look
             | ups are encrypted. But of course if an app developer
             | clicked past all the "This is a terrible idea, just stop
             | it" and added that code to download your porn over a
             | plaintext HTTP 1.0 connection from their server this-is-
             | literally-porn.example then NextDNS doesn't magically
             | prevent that when you run their crappy porn app.
        
             | PhantomBKB wrote:
             | Firefox has built-in support for DNS over HTTPS using
             | NextDNS or Cloudflare
        
           | pydry wrote:
           | I think debian does package updates over HTTP in the clear.
           | It's not _necessarily_ a problem if the package is signed and
           | the signature is verified.
        
             | tialaramex wrote:
             | But you don't have privacy. If you didn't want anybody to
             | know that you've got clown-fetish-program version 1.6.4
             | installed, then Debian's package upgrade code fetching
             | clown-fetish-program version 1.6.4.1 update is a
             | disappointing give away.
             | 
             | In the real world is it embarrassing to have Emacs
             | installed? Or KDE? Or even Tux Racer ? Probably not. But
             | all things being equal we'd rather the program just kept
             | this to itself right?
        
               | Avamander wrote:
               | It could also reveal information about your system that
               | could be used for exploiting. E.g. you have a package
               | installed that can be used for privilege escalation once
               | compromised.
               | 
               | Not to mention the additional possibility of exploiting
               | apt itself vs. having to exploit the TLS stack (which
               | goes trough a lot more scrutiny).
        
               | teddyh wrote:
               | https://tracker.debian.org/pkg/anarchism
        
       ___________________________________________________________________
       (page generated 2022-08-02 23:03 UTC)