Safe use of public WiFi Internet access

[blackhelicopter]

Was at ADL QP yesterday, couldn't even find the Telstra AP. So not sure if it is a continuing issue. Fortunately Internode has good coverage of the whole terminal here and could still connect from within the QP (and it's free).

The Internode AP at ADL is also generally MUCH faster than Hellstra's, even if you're not a paying Internode customer. (You can unthrottle it if you have an Internode username/password for your home ADSL account etc.)

I never bother with QP wifi, I generally use my 3G dongle instead (partially because of the speed or lack thereof, but also working in IT security I have a certain mistrust of public wifi access points )

[Mal]

I never bother with QP wifi, I generally use my 3G dongle instead (partially because of the speed or lack thereof, but also working in IT security I have a certain mistrust of public wifi access points )

Especially with tools like FireSheep so easy to use these days...

[beardoc]

I never bother with QP wifi, I generally use my 3G dongle instead (partially because of the speed or lack thereof, but also working in IT security I have a certain mistrust of public wifi access points )

Particularly since taking over your Twitter or Facebook account when you connect on a Wi-Fi network is so easy now - people may not be aware of Firesheep - a plugin that snoops on the Qantas Club Wi-Fi network (which is unencrypted) for the cookies you use to log into Facebook and Twitter and then grabs them - a single click and they are logged into Facebook and Twitter as you and can start sending messages as you, email friends asking for money, and post defamatory updates.

Firesheep In Wolves’ Clothing: Extension Lets You Hack Into Twitter, Facebook Accounts Easily

If you're not encrypting your transmissions on the QANTAS Club Wi-Fi, then you're at risk.

[simongr]

I had a similar problem in the F lounge on Saturday - so I switched to 3G on the iPad.

I am intrigued by the risks around wifi - I use it extensively. I wonder if the iPad usage is more secure but am not sure.

One major challenge is hotels that dont provide wired access and only provide wifi.

All my work emails are through a VPN client (RSA token).

I am not overly concerned about hacking my facebook account though (my bigger issue on facebook is the small private messages at the moment).

[samh004]

Especially with tools like FireSheep so easy to use these days...

I forgot to try it out when I was there on Saturday!

Particularly since taking over your Twitter or Facebook account when you connect on a Wi-Fi network is so easy now - people may not be aware of Firesheep - a plugin that snoops on the Qantas Club Wi-Fi network (which is unencrypted) for the cookies you use to log into Facebook and Twitter and then grabs them - a single click and they are logged into Facebook and Twitter as you and can start sending messages as you, email friends asking for money, and post defamatory updates.

Firesheep In Wolves’ Clothing: Extension Lets You Hack Into Twitter, Facebook Accounts Easily

If you're not encrypting your transmissions on the QANTAS Club Wi-Fi, then you're at risk.

As long as the website you are visiting uses HTTPS then you’re safe.

[futaris]

As long as the website you are visiting uses HTTPS then you’re safe.

You mean if you use https everywhere or a VPN, etc. Some sites support https but default to using http.

[blackhelicopter]

As long as the website you are visiting uses HTTPS then you’re safe.

Assuming the user doesn't click through the certificate warnings if you try an SSL man-in-the-middle attack. Which they always do.

[Mal]

I am intrigued by the risks around wifi - I use it extensively. I wonder if the iPad usage is more secure but am not sure.

An ipad is no more safer than a normal pc over wi-fi. It is vulnerable to the same isssues that a pc has.

[samh004]

An ipad is no more safer than a normal pc over wi-fi. It is vulnerable to the same isssues that a pc has.

I wonder if the apps that connect to popular sites though might connect through a different port, would that make a difference? I’m not well versed here but I thought HTTP went through a particular port, which might be how firesheep works, but an app may use a different port?

[beardoc]

I wonder if the apps that connect to popular sites though might connect through a different port, would that make a difference? I’m not well versed here but I thought HTTP went through a particular port, which might be how firesheep works, but an app may use a different port?

Firesheep works by packet sniffing an unencrypted Wi-Fi connection and picking up cookies from other people that are using the same Wi-Fi network. It doesn't expose passwords but it can intercept cookies from other people's computers and then with a simple click can become logged in as those other people. HTTPS would fix this, as would a VPN tunnel, but Facebook, Twitter, and a whole series of sites do none of these. So be careful. You should be encrypting your connection anyway on public Wi-Fi (try Get Behind the Shield! Hotspot Shield by AnchorFree if you need something, you're not keen to pay for it, and you're willing to put up with ads).