Hacker News Reader

Comment by malandrew | Hacker News Reader

This is actually a pretty serious legit concern that I'm surprised we haven't seen a proper solution for.

I feel like there should be some sort of trusted certificates or other method to determine whether or not you can trust the access point and alert the user when they may be moving sensitive info over that network.

View on HN

For a variety of reasons it doesn't really matter if you authenticate the hotspot if the rest of the traffic goes in the clear as unless you also do key exchange as part of the authentication and then use it for protecting your traffic someone could just forward the authentication to a real box and then take over or simply hijack your connection after you've authenticated. There is also the problem of wide deployments like coffee shops making it pretty easy to steal certificates.

WPA Enterprise / WPA2 Enterprise with PEAP (and several other flavors) includes a server certificate as part of the authentication process that you can validate before supplying your credentials. While it's not perfect, you can run public wifi with WPA2 Enterprise and just set the login to guest and a blank password (and say that in the ESSID). That allows anyone to connect but still allows them to authenticate the hotspot and have a fair level of protection from session snooping or hijacking.

Realistically future versions of 802.11 should use some type of system like that for unprotected connections, but they don't seem very interested.

Yea, EAP-TLS was one of the oldest EAP methods, and the client certificate is actually optional per the spec, though most supplicants require it (using a dummy cert is the workaround).

Why? You would use tls anyway with any service you think is even remotely important to you.

Yeah, malandrew probably would. But what about the 95% of the world that has no idea what TLS is?

They're already hosed, a borrowed SSID isn't going to do much more harm.

Just use an encrypted tunnel and your safe.

If a Van near the hotspot spoofs the network name running the equivalent of BlueCoat, even SSL traffic can be silently monitored or tampered with.

The problem is 99% of folks don't know how to setup a stunnel and the remaining 1% understand the performance implications of being paranoid all the time.

Not if you don't ignore cert warnings.

Reply on news.ycombinator.com