0

Is this article correct? A little bit? A lot? Or is it all bollox?

Sure using public or near-public wifi (internet cafe or hotel) you should expect your browsing history to be visible to the world, but ...

Specifically three questions:

  • Does the hotel's wifi asking for a password make any difference to the visibility of your internet traffic? (A guest/hacker in another room would also get that password and could detect your traffic.)

  • If you log into your bank over hotel wifi, that's encrypted. (Presuming your bank's site is https://... -- and if it isn't, change your bank.) Sure a hacker could see that there's traffic, but couldn't crack it to get your banking password(?)

  • Hackers getting into hotel's admin systems and stealing guests' credit card details is indeed a problem. But that's nothing to do with hotel wi-fi. You're just as likely to get your card number pwned, whether or not you used the wi-fi, whether or not you used a VPN. The hackers are probably in another country, connecting to the hotel chain's HQ systems, and not via any specific hotel at all(?)

  • 4
    This is probably a better fit for the InfoSec StackExchange site. – Roddy of the Frozen Peas Jul 8 at 5:27
  • 2
    Yes, maybe a better fit, but don't ask that question there. Search the site instead (e.g. hotel wifi) because I'm sure it has been asked and answered there already. – user40521 Jul 8 at 7:24
  • I did search the Stackosphere before posting to this site -- because it seemed the Qs & As here were closest to what I wanted to know. Google didn't show me the InfoSec site. Now that I've browsed through the hits, they seem rather geeky. if the Q has been asked & answered there, I'm not sure I would have understood it was answering my Q about the article -- which is alarmist and non-technical. – AntC Jul 8 at 8:57
  • Yeah but on the other hand by asking here you're going to get potentially incorrect or incomplete answers since this is not a site targeted to people who actually understand the concept fully. Or at all. – Roddy of the Frozen Peas Jul 9 at 14:18
2

Does the hotel's wifi asking for a password make any difference to the visibility of your internet traffic? (A guest/hacker in another room would also get that password and could detect your traffic.)

This depends - is the password entered via a captured portal (do you get redirected to a payment or login screen when you try to browse) or when you select the network in your network settings and enter a wifi key?

If the former, then the network is essentially open to all, and only the internet route is blocked for payment or authorised users. In this case, wifi packets can be sniffed easily enough.

If the latter, generally you are safe, as there is encryption inplace between you and the router.

If you log into your bank over hotel wifi, that's encrypted. (Presuming your bank's site is https://... -- and if it isn't, change your bank.) Sure a hacker could see that there's traffic, but couldn't crack it to get your banking password(?)

Yup, HTTPS is secure enough - there are situations where HTTPS can be mitigated by a network provider, but they generally apply only if there is ever a situation where the network provider gets to install something on your computer - you should never accept this, as they can install a root certificate of their own and then man-in-the-middle all of your traffic on that network.

Your third question isn't really a question at all.

Also note that you aren't safe from attack if you use the Ethernet cable connection often provided in hotel rooms - network routers can often be forced into promiscuous mode, allowing anyone on the network to receive all your traffic.

  • No need to install your own certificate to mount a MITM against HTTPS; there are more than enough dodgy CAs that are trusted by your browser already (Let's Encrypt much?). – fkraiem Jul 8 at 8:51
  • 1
    @fkraiem and how do you propose to get Let's Encrypt to issue you a cert for a domain you cannot validate authority or ownership for? Enquiring minds would love to know... – Moo Jul 8 at 8:53
  • Ok, I take back the part about Let's Encrypt, but there are many documented cases of dodgy or compromised CAs (and of other weaknesses of the whole HTTPS trust model in general). – fkraiem Jul 8 at 9:12
  • Abusing a dodgy CA is a very risky proposition, and not something you'd do to just to get a few banking passwords. See what happened to Symantec: blog.mozilla.org/security/2018/03/12/… . Also, promiscuous mode is a way to get wifi packets by recording traffic. ARP spoofing would be the way to get Ethernet packets, if there isn't some active router in there preventing it (as opposed to a regular switch). – Gyðja Björnsdóttir Jul 8 at 15:57
1

If the wifi is unsecured, it means that all data is sent as-is without encryption over the air between your device and the access point. Anyone can sniff the traffic, and see exactly what's going there. Using secure connection (e.g. HTTPS), then the data is encrypted and essentially secure, although the source and target IP addresses are not, since it's still run over plain TCP/IP.

On a secured wifi, even though everyone has the same password, cracking it is not quite as straightforward. Connecting to the network will be done through a handshake, where each connection gets its own encryption key -- all data sent over the air between your device and the access point will be encrypted with this key. Of course, some wifi encryption methods are easier to crack than others, so it's still advisable to use HTTPS and other secure protocols on top of it.

Also, just requiring to input a password does not necessarily means the wifi is secure. Quite often you will just need to login to a proxy server to let you access the internet, while the wifi itself is unsecured.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.