How to protect your privacy while on WiFi ?

How to protect your privacy while on WiFi ?

Secure Home | Search | About
 General Computer Security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
How to protect your privacy while on WiFi ? wylbur37 09-10-2007
Posted by rms on September 12, 2007, 10:37 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
> Any operating system and browser properly configured and maintained is
> enough to secure the connection between you and whatever on line travel
> site you use. Assuming of course that site uses HTTPS/SSL, which all
> reputable sites absolutely do.

But they don't. Most popular web email services exit out of https to
regular http as soon as the login is over, leaving the user fully open to
cookie hijacking.

rms



Posted by Anonymous Remailer (austria) on September 13, 2007, 1:21 am
If you were  Registered and logged in, you could reply and use other advanced thread options

rms wrote:

> > Any operating system and browser properly configured and maintained
> > is enough to secure the connection between you and whatever on line
> > travel site you use. Assuming of course that site uses HTTPS/SSL,
> > which all reputable sites absolutely do.
>
> But they don't. Most popular web email services exit out of
> https to regular http as soon as the login is over, leaving the user
> fully open to cookie hijacking.

We were discussing travel sites and financial transactions in general.
Injecting poorly configured and/or misused webmail services would seem
a bit misleading.

Regardless of that, a big part of "properly" includes using your head.
Making unencrypted connections to authenticate any mail service is just
plain silly, and cookie hijacking is as old as cookies themselves. So
if your web mail provider doesn't offer a hard HTTPS interface that
encrypts everything, you need to find another provider quick. Yours
isn't reputable. ;)

FWIW, Gmail allows "full time" HTTPS along with POP3S adn SMTPS if you
care to do things the "right way".


Posted by Anonymous Remailer (austria) on September 13, 2007, 4:30 am
If you were  Registered and logged in, you could reply and use other advanced thread options

Anonymous Remailer (austria) wrote:

>
> rms wrote:
>
> > > Any operating system and browser properly configured and
> > > maintained is enough to secure the connection between you and
> > > whatever on line travel site you use. Assuming of course that
> > > site uses HTTPS/SSL, which all reputable sites absolutely do.
> >
> > But they don't. Most popular web email services exit out of
> > https to regular http as soon as the login is over, leaving the user
> > fully open to cookie hijacking.
>
> We were discussing travel sites and financial transactions in general.
> Injecting poorly configured and/or misused webmail services would seem
> a bit misleading.
>
> Regardless of that, a big part of "properly" includes using your head.
> Making unencrypted connections to authenticate any mail service is
> just plain silly, and cookie hijacking is as old as cookies
> themselves. So if your web mail provider doesn't offer a hard HTTPS
> interface that encrypts everything, you need to find another provider
> quick. Yours isn't reputable. ;)

Second that. This cookie hijacking thing was blown way out of
perportion at Blackhat. Ancient history that's only a problem if
you're in a privacy coma.

Sad thing is a lot of people are.

Funny thing is a lot of them were at Blackhat. *shrug*

>
> FWIW, Gmail allows "full time" HTTPS along with POP3S adn SMTPS if you
> care to do things the "right way".

If you give a spit about your email you sure as hell aren't messing
around with Google in the first place.


>


Posted by donnie on September 14, 2007, 10:47 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

>
> donnie wrote:
>
> > If I am using a library or free AP to book a vacation
> > with personal info, credit card etc.
> > Would you rec using a 39.99 program along with
> > Vista with all the security running.
> > Or would Vista with all the security running be
> > enough?
>
> What "39.99 program" are you talking about?

A tunnel VPN program.
I don't think being specific on a particular
company is necessary.

>
> Any operating system and browser properly configured and maintained is
> enough to secure the connection between you and whatever on line
travel
> site you use. Assuming of course that site uses HTTPS/SSL, which all
> reputable sites absolutely do. There's no 39.99 program out there
> that's going to improve on that sort of end to end strong encryption
in
> any significant way, and even if it could it's an almost sure bet
> there's something out there that will do an even better job for free.
;)
>
> Just make sure your security settings aren't broken (you haven't
turned
> off warnings about SSL certificates), and pay attention if you're
> visiting Travelocity/Orbitz/whatever and all of a sudden you get a pop
> up about the certificate not matching the site or whatever. Don't just
> click "OK" and keep going.
>
> > Thanks.
> >
message
> > > Unruh wrote:
> > >
> > > >
> > > > >When using the Internet via WiFi at a public place such as a
> > library
> > > > >or cafe, it is conceivable that the people running the router
> > > > >could be capturing all of your transmissions and therefore
> > > > >could be recording your name, account numbers, etc.
> > > >
> > > > Use ssh.
> > >
> > > This doesn't really add anything over a simple SSL connection.
> > >
> > > > But the greater danger is taht they have put trojaned files onto
> > > > the computers. Thus you cannot really trust the puttyssh they
> > > > installed
> > >
> > > The scenario is using public APs not kiosks. You're using your own
> > > software and machine.
> > >
> > > As long as you're not foolish enough to disable security warnings,
> > > and pay attention to them, there's nothing at all dangerous about
> > > using sensitive Internet services from WiFi access points. It's
> > > safer than handing your credit card to the flunkie behind the
> > > counter when youpay for that double mocha latte. Your local
library
> > > or Starbucks is no
> > more
> > > or less trustworthy than your ISP, and your home broadband
> > > connection can be "sniffed" by your neighbors as easily as your
> > > wireless connection at the AP in many cases.
> > >
> > > That's why end to end encryption exists folks, to make that
sniffing
> > an
> > > exercise in futility. The only thing a onlooker can learn is where
> > > you do your business, and contrary to what someone posted things
> > > like Tor not only add a layer of encryption similar to SSL/HTTPS,
> > > they also remove that piece of information from the equation. An
> > > HTTPS
> > connection
> > > made through the Tor network is 100% secure no matter where you
are
> > > or what you're doing when they're use properly.
> > >
> > > > for example, or even the keyboard, since that could be captured.
> > > > If it is your own computer, then use ssh, and do not use web
> > > > browsers.
> > >
> > > Huh?
> > >
> > > Then how in the heck are you going to actually do anything?
> > >
> > > >
> > > >
> > > >
> > > > >Are there ways to prevent or minimize this hazard?
> > > >
> > > > >For example, would it help to use something like Torpark?
> > > >
> > > > >What would you recommend?
> > > >
> > >
> >
>


Posted by Anonymous on September 15, 2007, 4:57 am
If you were  Registered and logged in, you could reply and use other advanced thread options
donnie wrote:

>
> in message
> >
> > donnie wrote:
> >
> > > If I am using a library or free AP to book a vacation
> > > with personal info, credit card etc.
> > > Would you rec using a 39.99 program along with
> > > Vista with all the security running.
> > > Or would Vista with all the security running be
> > > enough?
> >
> > What "39.99 program" are you talking about?
>
> A tunnel VPN program.
> I don't think being specific on a particular
> company is necessary.

You don't need to spend $39.99 to set up a VPN. There's several
completely free solutions available, and they're open source. Chances
are the one you pay for isn't OSS. In fact there's a fair chance you'll
be buying that same FOSS software, repackaged.

If you're talking about using some sort of commercial VPN service,
don't. Unless you're accessing sites through an end-to-end encrypted
connection (SSL/HTTPS/TLS), you're handing all your precious data over
to an essentially unknown third party. And if you are using SSL like
you should the single benefit you get for your $39.99 is hiding where
you're doing business from the people, on your end of the wire only.
The VPN server and everyone past them knows where you're going.

You can hide that level of information in exactly the same way very
easily and for for free using Tor, your own VPN/SSH tunnel, or even free
proxies. Changing teh apparent destination of otherwise secure traffic
is one of the very few things open proxies are actually good for.


Similar ThreadsPosted
Protect Your Online Privacy And Internet Security November 6, 2004, 1:46 pm
How to protect my website? February 3, 2005, 8:45 pm
how to protect confidential document August 28, 2007, 2:40 am
How to protect your Online Customers' passwords? May 27, 2006, 12:26 pm
Actions the Government Should Take to Protect Information June 17, 2006, 2:23 pm
Is there a way to protect read-only files from copying/theft? June 4, 2004, 8:18 pm
ANN: Folder Castle 2.2 - Protect Your Files and Peace of Mind July 9, 2008, 2:34 am
Motorola Biometrics Solution Will Help Protect Delaware Citizens with Improved Identity Technology April 11, 2006, 2:22 am
Detecting Wifi networks December 20, 2004, 10:41 am
Is it safe to use a stranger's WiFi channel ? November 16, 2005, 2:04 am

The site map in XML format XML site map

Contact Us | Privacy Policy