Chicago - Apr. 8, 2020
Music TV Politics Sports Books People Places & Things
 
Beachwood PP&T
Our monthly PP&T archive.
Chicagoetry
Rhymes for the Times.
Beachwood Bookmarks
So You've Decided To Be Evil
Vintage Beer Signs
Easy Bar Tricks
Best of Craigslist
Wacky Packages
Chicagology
Taquitos Snack Food Reviews
How Products Are Made
Everyday Mysteries
Chicago Zombie
FAIL
Texts From Last Night
Fuck My Life
Awkward Family Photos
QuackWatch
Alcademics
Lamebook
Ultra Local Geography
Uncyclopedia
Best Pinball Machine Ever
Land of Sky Beer Waters
Calumet 412
Chicago Patterns
Vince Michael's Time Tells
Renegades of Funk Chicago
History vs. Hollywood

Why Public Wi-Fi Is A Lot Safer Than You Think

If you follow security on the Internet, you may have seen articles warning you to "beware of public Wi-Fi networks" in cafes, airports, hotels and other public places. But now, due to the widespread deployment of HTTPS encryption on most popular websites, advice to avoid public Wi-Fi is mostly out of date and applicable to a lot fewer people than it once was.

The advice stems from the early days of the Internet, when most communication was not encrypted. At that time, if someone could snoop on your network communications - for instance, by sniffing packets from unencrypted Wi-Fi or by being the NSA - they could read your e-mail. They could also steal your passwords or your login cookies and impersonate you on your favorite sites. This was widely accepted as a risk of using the Internet. Sites that used HTTPS on all pages were safe, but such sites were vanishingly rare.

However, starting in 2010 that all changed. Eric Butler released Firesheep, an easy-to-use demonstration of "sniffing" insecure HTTP to take over people's accounts. Site owners started to take note and realized they needed to implement HTTPS (the more secure, encrypted version of HTTP) for every page on their site. The timing was good: earlier that year, Google had turned on HTTPS by default for all Gmail users and reported that the costs to do so were quite low. Hardware and software had advanced to the point where encrypting web browsing was easy and cheap.

open-wifi.png

However, practical deployment of HTTPS across the whole web took a long time. One big obstacle was the difficulty for webmasters and site administrators of buying and installing a certificate (a small file required in order to set up HTTPS). EFF helped launch Let's Encrypt, which makes certificates available for free, and we wrote Certbot, the easiest way to get a free certificate from Let's Encrypt and install it.

Meanwhile, lots of site owners were changing their software and HTML in order to make the switch to HTTPS. There's been tremendous progress, and now 92% of web page loads from the United States use HTTPS. In other countries the percentage is somewhat lower - 80% in India, for example - but HTTPS still protects the large majority of pages visited. Sites with logins or sensitive data have been among the first to upgrade, so the vast majority of commercial, social networking, and other popular websites are now protected with HTTPS.

There are still a few small information leaks: HTTPS protects the content of your communications, but not the metadata. So when you visit HTTPS sites, anyone along the communication path - from your ISP to the Internet backbone provider to the site's hosting provider - can see their domain names (e.g. wikipedia.org) and when you visit them. But these parties can't see the pages you visit on those sites (e.g. wikipedia.org/controversial-topic), your login name, or messages you send. They can see the sizes of pages you visit and the sizes of files you download or upload. When you use a public Wi-Fi network, people within range of it could choose to listen in. They'd be able to see that metadata, just as your ISP could see when you browse at home. If this is an acceptable risk for you, then you shouldn't worry about using public Wi-Fi.

Similarly, if there is software with known security bugs on your computer or phone, and those bugs are specifically exploitable only on the local network, you might be at somewhat increased risk. The best defense is to always keep your software up to date so it has the latest bug fixes.

What about the risk of governments scooping up signals from "open" public Wi-Fi that has no password? Governments that surveil people on the Internet often do it by listening in on upstream data, at the core routers of broadband providers and mobile phone companies. If that's the case, it means the same information is commonly visible to the government whether they sniff it from the air or from the wires.

In general, using public Wi-Fi is a lot safer than it was in the early days of the Internet. With the widespread adoption of HTTPS, most major websites will be protected by the same encryption regardless of how you connect to them.

There are plenty of things in life to worry about. You can cross "public Wi-Fi" off your list.

-

Comments welcome.



Permalink

Posted on January 30, 2020


MUSIC - Bill Withers In The Beachwood.
TV - Bubble Wrap TV.
POLITICS - Pleading For Protection.
SPORTS - Not Quite Monsters.

BOOKS - Jesus Didn't Believe In Hell.

PEOPLE PLACES & THINGS - Choose Your Chicago Q House.


Search The Beachwood Reporter

Subscribe To Our Newsletter
Email:

Follow BeachwoodReport on Twitter



Beachwood Radio!