Hacker News Reader

Comment by Cupertino95014 | Hacker News Reader

When on any sort of public WiFi network, use a VPN.

If anyone has a story about how "that's not enough" I'm eager to hear it. Can't be too careful, can we?

OK, I'm honestly curious, because the idea in my head is this:

Using a VPN to protect you from the dangers of public Wi-Fi is worthless, because HTTPS already does everything VPN companies claim their VPNs do to protect you, such as protecting people from snooping your banking information or redirecting you to some "Wells Fargo But It's A Phishing Frontend" website, because HTTPS provides both encryption and, through certificate verification by way of the browser's own trust store, validation that you're connecting to the domain you think you're connecting to and an MITM attack isn't going on.

If I'm somehow wrong about any part of that, I'd like to know.

It's ok to admit you're wrong; you know that, right? You don't have to dig further down or move the goalposts when it's clearly shown you didn't actually read the article or understand the vulnerability in question.

It's also ok for you to sit down. You know that, right?

I did read the article and "use a VPN" is solid advice; moreover it's something you have complete control over, whereas the system on board the airplane is beyond your control.

Except you can just not use it, which is probably the best advice of all.

You clearly don't understand it enough to know that "use VPN" has nothing to do with it. It may be good best practice, but it has literally nothing to do with this article or the vulnerability in question.

It's the equivalent of me coming into the thread and saying "the sky is blue". It's a factual statement, it's kind of in the realm of being related, considering airplanes fly in the sky, and yet it is completely and utterly tangential to the article and vulnerability. It's as off topic as a comment can be.

This has absolutely nothing to do with the fact that it was public WiFi, so your advice of using a VPN is irrelevant.

This has to do with being on a public network (an airplane), does it not? Maybe your outrage is over-the-top.

Absolutely not. This has to do with how accounts for that network are managed. Even if you use a VPN you will still have an account there and your data were at risk to this vulnerability.

> The impact of these two bugs was signifcant. It was access to first name, last name, address, and email of the user as well as last 4 digits, expiration date, billing name, and address of the credit cards.

Assuming you're a black hat exploiting this bug, what can you do, if the target is using a VPN?

I don't know what "address of the credit cards" means, but let's assume it's the target's home address.

You don't get their credit card number or security code. You don't get access information on any of their web accounts. Correct?

If you spy on their internet activity during the flight, it's all encrypted. You won't learn anything.

However, you do have the ability to change their password, so they can't get into their own account anymore.

You could also bill all your own activity to their account. I don't know if you can bill other things to the account.

You could get access to whatever data was stored in that account. I don't know what that would be, other than when & how much you used it in the past.

Is this a complete summary of the potential damage?

Since there's no Reply button for the two answers to this:

Neither of them answer my last question ("is this a complete summary..."). Should I assume it is?

And I never said "oh but the data leak isn't really that bad of a vulnerability" -- you did.

None of the impact of having your data leaked from your account is in any way modified by using a VPN for your data traffic while you are on the airplane. Hence the initial reply of that your suggestions of a VPN is irrelevant. Don't try to change this into a "oh but the data leak isn't really that bad of a vulnerability" after having lost that argument.

Where do I say "oh but the data leak isn't really that bad of a vulnerability"?

I tried to summarize what the vulnerability is. Why are you so upset about that?

You completely missed what this vulnerability is. It has nothing to do with intercepting another user's traffic. The checkout page in question actually uses SSL anyway, so it's not even possible absent some sort of MITM attack.

This has to do with API endpoints that exposed customer information and allowed password changes without checking that the request was coming from the customer. The customer didn't have to be logged in to the account, or even on the flight in the first place. If they had an account, it was exposed.

Quite right. But as I said, "intercepting another user's traffic" would be an additional vulnerability, but not if you're on VPN.

Maybe you could just admit that and end the argument. This doesn't require you to minimize the seriousness of the bug.

The article is about authenticating to a Wi-Fi captive portal. So not only is a VPN irrelevant, as everyone has already pointed out and you continue to ignore, it wouldn't even work.

> Assuming you're a black hat exploiting this bug, what can you do, if the target is using a VPN?

Going by the same logic, what can a black hat exploiting this bug do if the target ISN'T using a VPN?

Using or not using a VPN in the context of this bug is totally irrelevant.

Wouldn't that depend on whether this airplane system lets two machines use the same account at the same time?

You still have an account, even when you are not currently in the air.

You seem confused about what we're arguing about.

OP said "what would not being on VPN let someone do to you?"

not

"what harm could occur if you're not in the air?" or

"does using a VPN protect you from all harm?"

and the question/assertion is, "if you were in the air, and not on VPN, then could a black hat who's compromised your account spy on your traffic?"

I don't understand how a black hat, even with access to your account, could spy on your traffic? They're entirely different concepts. Just having access to the account doesn't mean you can see all data going through the network for people using that account.

And even if they could, any sensitive page should be using HTTPS, so the data will be encrypted. A VPN still wouldn't make a difference.

Reply on news.ycombinator.com