Want to use my wifi? (2013)

https://thejh.net/written-stuff/want-to-use-my-wifi?

by duramato • 9 years ago

125 63 9 years ago

thejh.net

dang• 9 years ago

Discussed at the time: https://news.ycombinator.com/item?id=6766106

craftyguy• 9 years ago

So using HTTPS seems to mitigate everything in this article?

bonyt2• 9 years ago

Well, sslstrip still likely works on websites that don’t use HSTS, or that you’re visiting for the first time. I suppose the HTTPS Everywhere plugin might mitigate this.

Do any browsers try https first yet?

Now that I think of it, I guess many search engines now use HTTPS with HSTS and will send you straight to the https site if it knows of one, so that’s good.

https://moxie.org/software/sslstrip/

geofft3• 9 years ago

If I'm using a wifi network I don't really trust (coffeeshops, airports, etc.), I'll turn on HTTPS Everywhere and further enable "Block all unencrypted requests," effectively giving me "HTTP Nowhere."

This works for most things - for a few things I'll open an incognito window in Chrome, which simultaneously turns off extensions and doesn't send my original cookies, and I'll be careful about what I do in that window (certainly no logins to sites I care about). This is generally enough for e.g. reading some random news site that doesn't support HTTPS at all.

IncRnd6• 9 years ago

No. That is only the case when the certificate is pinned, which is the proper mitigation in this case. VPNs do not have stellar records regarding security.

confounded2• 9 years ago

VPNs do not have stellar records regarding security.

I rely on them. Can you elaborate?

barbegal• 9 years ago

Probably the easiest, yet most powerful one is to only use the browser in incognito mode while surfing on insecure networks. This way, no information (like passwords or cookies) can leak out and no evil cache entries can sneak in.

Is only partially true. If you sign in using incognito mode your passwords and cookies will leak. And you have to remember to open the incognito window after connecting to an insecure network and close it before you connect to a secure network because the cache and cookies are maintained until you close the window.

bonyt2• 9 years ago

Here is an interesting dilemma: should HSTS persist in incognito mode?

If not, then this becomes bad advice, because all the attacker has to do to disable HTTPS is not redirect http sites to https ones (sslstrip).

If so, then the list of sites for which your browser attempts HTTPS connections without being told to is the list of sites you’ve accessed in the past. This information could become a supercookie allowing sites to identify and track you even in incognito mode.

https://nakedsecurity.sophos.com/2015/02/02/anatomy-of-a-bro...

Klathmon• 9 years ago

Unless the website makes use of HSTS preload

varenc• 9 years ago

This is possible! HSTS does apply to incognito to my knowledge

Here’s a project that uses this fact to look up browser history: https://github.com/diracdeltas/sniffly

crunchatized2• 9 years ago

Yeah the only true part there was 'no evil cache entries.' Chrome's incognito mode even explicitly warns that it does not defend against your ISP/employer/school (aka any man-in-the-middle). All incognito does is keep any data from the session from being saved to disk.

drdrey2• 9 years ago

What about browsing over tor?

Viper007Bond• 9 years ago

tor isn't a VPN service, it's an anonymizer. The end node could still sniff your traffic presumably.

drdrey2• 9 years ago

Yeah but that would protect you from the insecure wifi attacker, no?

icebraining6• 9 years ago

The end node could still sniff your traffic presumably.

The same is true on a VPN. Tor is no different, except it adds extra layers for anonymization.

chakalakasp• 9 years ago

How I Learned to Stop Worrying and Love the VPN

dannyw• 9 years ago

An even easier way is to subscribe to a reputable VPN. There are often various sales where you can pick up annual packages at steep discounts. Having a VPN is also useful for troubleshooting network connectivity, and bypassing content-based throttling.

I like Private Internet Access.

js24• 9 years ago

Run Algo on a droplet.

https://blog.trailofbits.com/2016/12/12/meet-algo-the-vpn-th...

shujito2• 9 years ago

how secure is it?

thinkloop• 9 years ago

Any reason to use droplet in particular over other vms?

radec• 9 years ago

Doesn't seem like this would be as anonymous as something like PIA....assuming you can trust pia.

Still thanks for the idea, going to look into it more.

corobo• 9 years ago

I love it when developers write web copy

Setup is automated. Just answer a few questions, and Algo will build your VPN for you.

There are 5 steps before you get to the "Setup is automated" part! They're easy enough steps for someone with a bit of tech chops behind them and I will go easy on the first two (Set up VPS, download Algo) but come on, that is not automated!

jmiserez• 9 years ago

How would you know if it’s reputable? Better to run your own on a VPS (or even better a dedicated box at home).

kqr• 9 years ago

I have strong confidence in my home ISP -- they have a track record of standing up for their customers, they are vocal about human rights to privacy and they generally are not easy to compel. So, naturally, I run a VPN server on my gateway machine.

But just looking at the market out there, I feel incredibly fortunate that I can choose such a good ISP. They are very rare.

dazc• 9 years ago

'I like Private Internet Access'

Ironically, 50% of the time, I get access denied on Hacker News whenever I am on PIA (london)

confounded2• 9 years ago

I’ve been getting a blank page, on mobile only, when on PIA in the last week or two (also about 50% of the time).

dalemyers• 9 years ago

The "MiniHack" iOS app totally fails for me on PIA. I can usually access the site from my desktop just fine though.

IncRnd6• 9 years ago

Probably the easiest, yet most powerful one is to only use the browser in incognito mode while surfing on insecure networks. This way, no information (like passwords or cookies) can leak out and no evil cache entries can sneak in.

This isn't true, as incognito can leak cookies. The proper mitigation is for site and app designers to use cert pinning.

ce42• 9 years ago

FYI, this piece is from Jann Horn - known for the recent intel cpu bug disclosure at Google project zero.

leni536• 9 years ago

I believe that it's that site's responsibility to set the cookie's secure attribute. Otherwise I'm surprised nobody mentioned disabling 3rd party cookies as a mitigation on the client side. Using a VPN provider, a VPS or even your self-hosted VPN in your home (your home ISP) is just choosing who you trust.

dspillett2• 9 years ago

My solution has always been to use a VPN, not just on an untrusted network but on any wireless network (for any comms using an insecure protocol any wireless network, even one run by yourself to the highest standards, is an untrusted network anyway). When WEP was broken it didn't affect me because the WLAN was just a transport and my traffic was protected by the VPN. When WPA was broken it didn't affect me because the WLAN was just a transport and my traffic was protected by the VPN.

Of course this creates two problems which make it impractical for the man-on-the-street: choosing the solution and host (in my case OpenVPN with end-points running on my home network and a hosted VM as a backup in case that link is down) and keeping yourself (your server, your client, your configuration) up-to-date as new exploits are found. But I'm not a man-on-the-street in this instance so it works for me. There are a number of solutions that claim to provide out-of-the-box methods that the untrained can use without any effort, but there is still the "which service do I trust?" issue to contend with from both security and reliability points of view.

A side problem is client support on devices, particularly mobile phones, though from my selfish PoV that is a lot easier now: OpenVPN seems reliable on my Android devices, Windows Phone is effectively dead, and I never had an iDevice so haven't needed to care. The final problem is a human one: remembering to turn it on if you don't have ti on all the time automatically.

The same works when providing wireless access to or via a network you care about, such as wireless access in an office environment. The access point could be left as open as open can be (though security in depth: there is no harm in turning WPA2 on as an extra layer of protection) but don't let it route anything that doesn't look like your VPN traffic and let the VPN handle security.

If you need to provide wireless access for guests (visiting clients for instance) have a separate WLAN with all the usual protections that doesn't route to your other local network legs at all (without going out and back in via a VPN of course). Beyond that, their security is their problem.

aglionby• 9 years ago

I'm with you on the majority of your comment, but I'd contend that VPNs are definitely accessible for your average person, assuming they're are actually aware of them and how they help. Sure you don't get the same guarantee regarding logs etc. if you use a commercial option instead of rolling your own, but that's a different threat to the one described in the article.

In terms of trust, I'm happy going with bigger names which have more to lose if they turn out to not be doing what they say. Private internet access (no affiliation) for me ticks this box, is a really simple install on my phone + laptop, and has anonymous payment methods as well if that's something that's important to you.

IgorPartola• 9 years ago

There are two places where I found this approach problematic because I want to VPN to my home LAN.

First, client devices with OpenVPN don't support tap only tun. This means that when I'm not home, I can't e.g. my home NAS, etc.

Second, like most Americans, my home internet connection is dog slow. I get 80/5 Mbps. The 80 is tolerable, but the 5 is a drag. Surfing the web when first I have to VPN home...

Bonus problem: even with a business ISP setup, I am still under restriction with what I can do with my own IP address, can't get a static IPv6 allocation, etc.

dspillett2• 9 years ago

I'm lucky enough to reliably see 76 down 17 up, the best you can get for a residential location in the UK generally unless FTTP is available to you, which is more than sufficient for most of what I do (mail and other mainly-text-with-some-images comms, HN, StackExchange, shopping, SSH & remote desktop or equivalent for various admin). On shared wireless or 3G/4G getting 17+ as a sustained rate is pretty rare in my experience anyway. And I've got a couple of static IPv4s play with, and a /48 IPv6 should I ever get around to using that properly, which I can do pretty much anything I like with and the ISP doesn't shape traffic beyond basic QoS measures either. It isn't a cheap connection, but nice...

Another advantage of the VPN endpoint being at home is that location sensitive applications think I'm there. This seems to reduce "are you a human?" checks in some places, and extra "characters 3, 9, and 11 from your password" requests during credit card payments.

One extra disadvantage, that doesn't affect me but would be a concern to someone gaming or taking part in other timing sensitive tasks, is extra latency, but you'll experience that on any VPN.

I've not found lack of tap support an issue, as I've only needed TCP & UDP via IPv4 anyway so normal routing options over tun do the trick. The lack of local broadcast support can break name resolution in some cases but that is nothing I can't fix with a hosts file entry or static hack in the LAN's DNS resolver.

lmm• 9 years ago

I go a little further in the same direction: I treat even my wired home network as an untrusted network transport. My home server exposes exactly the same things to the LAN that it does to the public Internet (indeed as far as I'm concerned the LAN just is part of the public Internet - with IPv6 my home server even has the same address from either). My only open ports are secure protocols like SSH or HTTPS or PostgreSQL-with-SSL.

I do use OpenVPN to run a few nonsecure "legacy" nonsecure protocols - the servers for those listen only on the VPN interface which isn't bridged to the physical LAN - but these days I very rarely need it.

bclemens• 9 years ago

All of this and more has been explored with BEEF. An easy way to demonstrate these sorts of attacks is with BEEF + MITMF.

http://beefproject.com/

https://github.com/byt3bl33d3r/MITMf

Bromskloss• 9 years ago

Aren't all these problems that exist for all unauthenticated traffic, wifi or not?

GranPC• 9 years ago

Mirror: https://web.archive.org/web/20180104070103/https://thejh.net...

superdaniel• 9 years ago

Thanks

Want to use my wifi? (2013)

Related Stories