Hacker News Reader

Comment by md_ | Hacker News Reader

It's not a "yes/no" answer. If you're visiting http:// sites, if your OS doesn't use DoH/DoT, if you have unpatched vulnerabilities exploitable by same-subnet attackers, then maybe it's dangerous.

The question is, is it dangerous enough to:

- Use a VPN? Yes, if the VPN is free, trustworthy, and not blocked by the wifi.

- Not use the Wifi, and instead pay for data/roaming? Nah.

- Tell lay users that "avoiding public wifi" is one of the top things they should do to stay secure online? Hell no. User attention is expensive, and wifi is relatively safe.

"I don't use public wifi without a VPN" is the new "I never click links in email." It's something semi-technical users say to show off how much less pleasant their online experience is for no particularly good reason. ;)

View on HN

> Use a VPN? Yes, if the VPN is free, trustworthy, and not blocked by the wifi.

I agree with most of your points; I'd just like to say that I'd never trust a "free VPN"... (Outside of "it's free since I host it".) I'd put most of my effort into vetting which VPN is best audited/trustworthy.

As an aside, the other big threat that sidesteps HTTPS certificate validation would be for the attacker to only serve HTTP. The browser will call this out in the URL bar at least. This can be mitigated by sites sending HSTS headers (forcing you to use HTTPS for future connections), but this isn't necessary universal. And requires having visited the site earlier on a "safe" network.

I have my own self hosted VPN, but I am a fan of Windscribe too, they offer a free VPN which I'd personally trust. I do pay for it, but wouldn't have any concerns recommending it.

They actually wrote an article explaining how/why it's free: https://blog.windscribe.com/free-vpn-myths-debunked-70a0aa46...

Obviously do your own research.

HSTS is also pre-loaded, you can pre-load an entire apex domain (such as ycombinator.com) or indeed an entire TLD (.dev is pre-loaded).

And browsers are starting to offer HTTPS-by-default mode where the browser just interprets HTTP as HTTPS (in links, in bookmarks, almost everywhere) and if the HTTPS server won't accept the connection you get a full-page interstitial where you can choose to let it go for one site that doesn't have HTTPS if you're comfortable with that.

Yeah, a free VPN is almost guaranteed to be a honeypot, whereas free wifi has only a small chance of being a problem.

"Free Wi-Fi" also almost always means "no encryption on the PHY" meaning eavesdropping is trivial and MITM is much more likely. I never use public, open Wi-Fi without wireguarding home.

That's the point. If you don't trust open wifi then you would trust free VPN far less.

I don’t think that’s necessarily true.

Do I trust ProtonVPN’s free tier less than I trust a random access point named (say) “NYC Free WIFI”? I would say no: I know who ProtonVPN is, and I’m only trusting them, not all their other users.

I agree a lot of free VPNs are shady as fuck, but free tiers from reputable companies are reasonable, and if anything may be more trustworthy than your home ISP.

As I said to the other reply, I was thinking “that you host yourself” (i.e. Algo) when I wrote this.

That said, I think this is a bit too absolute. ProtonVPN has a free tier, for example, and they’re seemingly a legit company (who make their money from the paid tier). I would not disrecommend ProtonVPN—it’s probably as or more trustworthy than most free public wifi.

But the same argument for public wifi applies to VPNs: you shouldn’t be that worried, because important things don’t rely on network trust anyway.

I setup wireguard, pihole and caddy (reverse proxy) on an rpi4 for this purpose... that and access to my internal network (nas, desktop, etc). Works relatively well, was a bit of a pain to get pihole binding properly via docker (compose file).

Using dyndns service on my domain so that I can refresh a subdomain to always point home.

I'm trying to reason why you suggest "if the VPN is free". If the VPN is free, I'm confident that I'm paying the VPN provider using my browsing data rather than money. A paid VPN service (somewhat) instills that small amount of trust that my browsing data is not stored/tracked/sold.

I meant like Algo. My point was only that the threat here is so small as to not be worth spending real money to mitigate it.

But I'm being a bit tongue in cheek--most users are not going to want to set up Algo. And you're right that otherwise, the VPN is probably as sketchy as the wifi itself.

Algo is interesting! First time hearing about it, thanks :).

This is what I use when:

a) I'm traveling b) I remember to turn it on c) I'm not blocked by the wifi (which is common)

IOW, while Algo is great, and I'm pretty paranoid, "distrusting public wifi" is sufficiently far down my personal threat model stack rank that I don't really care about it much.

Echoing the other comments about a free VPN, the only free VPN worth trusting is the one you run from your own home router, which a decent router can offer.

If the WiFi is free... you're the product!

Reply on news.ycombinator.com