Wireless Internet forum: Security concerns on public Wi-Fi access

An easy fix for me has been a VPN. It's just one more connection you have to make using your "connect to."

By providing an extra secure tunnel through the web, I feel confident anything I send is secure from prying eyes or worse.

While many people might think that if the see "https://" in the url you are safe. This is not always true; another user can be logged on to the hotspot and act as dhcp, so you'd connect to them, then he'd fire up a password sniffer (such as ettercap)and then see all the password that are transimted to them, even the ones encrypted with SSL, along with other data such as what pages you have opened.

when you say "trusted land line", do you mean a wired connection?
I have a wired cable connection and then i also have a wired router so i can use it with multiple computers in my house. is that the most secure way to go? thanks!

You can do several things to help secure your computer and secure your passwords while on a public network. The first rule is have a good firewall on your computer. A free one is ZoneAlarm, but there are others. Make sure you are on the highest level of security in the settings when on a shared public network.

The next thing you can do is make sure your transactions on the network are encrypted. Using a Virtual Private Network connection to a known secure proxy server is one of the best ways. Nothing you transmit on the public network would be viewable.

Baring that use https sites that encrypt transmissions only. Most of your banking services use that encryption and secure transmission. I don't recommend this as there are ways around this.

The next level of security is for if you want to go to ebay, or other site that does not encrypt your transactions (A transaction is any click, or typed URL) is to not log in. If you want to monitor something, fine. Don't bid until you are on a secure private network. Read the news, get the weather, but don't log in.

Most people can't remember 100 or so passwords and the same amount of usernames. So, if you are one of those that can't and use say, 2 or 3 max. Most likely you will log on to a site that transmits the username and password in the open, that is when the hacker/sniffer/thief can steal your identity. (Not only on that site, but others where you have the same username and password.)

Remember the shared network can have people with sniffers, and if anything is in the open on that network, it can be viewed. Treat it as such.

I was reading up on how to secure transmissions at a public WIFI and it was suggested that I use a VPN on a secure proxy server. How is this done when I'm staying at a hotel on a business trip?

Thanks.

Jon, if you want to know, free Wi-Fi networks can be hacked easily because they have access to it, but if it has a password, you are more secure. Now, unknown networks controlled by unknown people can take, using some special software, everything you input and do on the Web, but in legitimate networks such as Starbucks, or an airport, there should be no hackers around to steal your info! Cheers!

While mac address filtering can deter an occasional hacker from logging into your network, it can be very easily bypassed. The hacker would scan for nearby computers that are connected to the protected network, then he would record the mac address of your authorized PC, and change his own mac address to be the same as your PC. He could then connect to your network normally.

On a parallel note, an employee at Starbucks in Bandung has just been arrested for stealing customers' credit card info and using it to buy stuff - so even at a 'name brand' place you are still theoretically at risk.

Maybe the secret is to avoid carrying sensitive info on the netbook you pony around with you. Or be like me and destroy your credit cards, ha.

First, put a password on every user's log in. Second, make sure you have a personal firewall on and updated. Third, a good, comprehensive Internet Security software is also important to ensure no malware is running to expose the system. Fourth, if you have any shared files, check the permissions to ensure that only authorized users can access it (in particular, do not have it set to "Everyone").

There are even more extreme steps to takes, but that should be all you need.

Is there any way to have COMPLETE security when using a WiFi hotspot? I have an internet business and want to find a 100% secure way of using WiFi. I came across WiFi Security Guy (http://7687.WifiSecurityGuy.com) and it appears to be a completely secure way of accessing wireless networks. I used the product for a while and it seems as if the program completely encrypts all data before it is sent out. The website shares the credentials of the person who designed the program and shows that he has years of IT security experience working with banks and classified military data so it seems to be a good solution. Does anybody know of a better COMPLETELY safe way for using wireless networks?

We are discussing public WiFi here, not your home WiFi. In addition, WEP is already considered insecure nowadays. It can be cracked by people with moderate computer knowledge. A Japanese even demonstrated cracking a WPA encryption. So use WPA2 whenever possible.

WEP: Wire Equivalent Privacy; The earliest form of wireless encryption. I uses the same encryption key over and over again and hence was easier to break.

WAP: Wi-Fi Protected Access; Was brought into being in 2003 when it was realized that WEP was not the way to go. WAP's encryption techniques require an encryption on the order of 4x10-20 (4 decimal point followed by 20 zeroes or 4.00000000000000000000) to break and is 21 characters long for encryption. As can be seen this is a much better encryption method. This is a much better encryption Then WEP. But wait there's more. WAP uses TKIP; Temporal Key Integrity Protocol, it changes the encryption key for every data transmission between the computer and the wireless router. This method was a stop gap for the weaker WEP standard.

WAP2 or it might be seen as WAPII: Wi-Fi Protocol Access 2 or Wi-Fi Protocol Access II; Uses TKIP and AES; Advanced Encryption Standard. This is so that WAP2 is compatible with the old and new encryption standards for older wireless routers. WAP2 uses AES for encryption because it is a stronger encryption method. WAP was a stop gap method while the Wireless Alliance came up with WAP2 standards and was released in 2004. WAP2 uses AES method for encryption, it is a standard that is stronger then then RC4 method used by WEP and WAP.

My advice is; If you are just starting out to go wireless be sure the equipment uses the WAP2 standards. If you are going to use wireless public access, make sure the public access uses WAP2 standards.

The problem is people with older equipment (that is older laptops, cards and wireless routers), to take advantage of the WAP2 encryption they would have to update their present wireless equipment. If one has an older laptop (2005 or lower), they would need to get a new USB wireless dongle, on a desktop they would need to get the newer cards and wireless router. A bit of advice if one is going to update their wireless equipment, they should also update their modems. It is indicated that cable and DSL is moving to the DOCSIS 3.0 standard. This is because (especially Cable and DSL) services because for two reasons; upload and download speeds are faster and it is compatible with IPv6 (Internet Protocol version 6). Comcast is one cable internet provider that already uses DOCSIS 3.0 standard.

I use public Wi-Fi with appropriate security software on. Still, it is better to assume that everything is being looked at by hackers...

There are things to concider. Some on your part, some on the part of the Wi-Fi you are curently using, some on the part of any other network you may connect to.

On your end:
You positively need an active firewall on your computer. It must be configured to treat any incoming connection as unautorised or untrusted. This will prevent others from looking at/into your computer. A good wirewall will make you browse in stealth mode: All your ports will look as if they don't exist at all axept for expected trafic. You can't hack something that you can't detect nor access.
There are many good to excellent firewalls available, and the best are not always the more expencives: Some free ones are about as good as the most expencive comercial ones. An obscure free firewall can be very secure just because any hacker may not expect encountering it and not have the tools/knowlege needed to circumvent it.
Your browser must be configured to use encryption whenever possible, and the highest protocol available.
Always make sure that your operating system have the latest patches and security updates installed.

On the Wi-Fi administrator part:
Does the wi-fi connection support encryption, if yes, use it, even if it's a weak encryption. This will encrypt the data that you broadcast to the hotspot.

From the sites you use:
If you are entering confidential information on a secure page (https:\\), that information is encrypted/decrypted on your computer and on the remote, secure, server. The transmited data is thus unreadable anywhere in between and safe. The Wi-Fi host, and the Internet, will only see the encrypted data, and so will anybody atempting to intercept it. It can be broken, but, normaly, it would take to much efforts and time to do it compared to the potential benefit. There is a very high probability that any extracted information to have become obsolete before it's been cracked, not to mention that any snooper would have to sort through the mixed up datas from many connections. In that view, the more persons that are using that hotspot, the safer it becomes.

If you access a secure site on a secure hotspot, your data gets encrypted twice using two keys and possibly two algorythms.

Other networks you may use:
Do you ever connect to a network that use beackon suppressing as a "security" measure? That's realy bad!
Why, do you ask?
Simple: It only hides the server's beacon, and that's the less vulnerable part of the network. It forces your computer to broadcast it's information every few seconds. Those informations are NOT encrypted. ANYBODY can record them, and use that information you just given to fake the credentials of that network and pose as it. It can also get used to enter into YOUR network if you use that technique at home by posing as you.
Here, the keyword is to NEVER EVER use beackon suppression, ever.
DISABLE network discovery needed when you access a network that use beackon suppression.

If you do some general browsing that don't involve sending any confidential/sencitive data, you are safe.

The final word is:
For most users, if your computer is reasonably up to date, you are safe.
Don't forget the basic safe browsing precautions.

Disabling of SSID broadcasting can help secure your network. Apparently, there are tools that can eventually spot your SSID. Since the SSID is contained in the 802.11 association request at the wireless client bootup time to gain access to the network from the wireless access point it can be seen by hackers at this time. Continue to WPA2 encryption for extra security.