When you’re out and about, and especially when you’re traveling, you might find yourself feeling quite a bit of anxiety when logging into public Wi-Fi. Maybe you’re sitting in an airport waiting for your flight, and the siren call of that Wi-Fi network is making your ears itch. You’ve got one of the best laptops you can buy, but you’ve always heard that public Wi-Fi is dangerous, or your work strictly prohibits it. So what is a traveling techie to do? I sat down with Chester Wisniewski, Principal Research Scientist for Sophos to find out just how terrible it was.
Funny story. It turns out it’s not so bad.
Most of what you’ve heard about public Wi-Fi likely dates back a decade or more. That’s where the terrible reputation comes from. But things have changed, and it’s important to understand how, and part of the how includes the why. There’s a little history to go over to see how we got here though.
“Today if I go to Starbucks and I try to hack you, I get nothing. At best the most I’ll see is ‘Adam is going to Facebook’ but I have no idea what he’s doing on Facebook. I don’t know if he’s logging in as him, or if he’s logging in as his alter ego. I have no concept because all of that is encrypted and protected at the application layer rather than the network.”
How we got here
Many moons ago, the internet was largely unsecured. We relied on our networks to keep our network traffic protected. As a result, people were vulnerable to attacks with cute names like “evil twin” and “man in the middle.” These attacks allowed a hacker to see everything that was happening as it flowed through the internet. Type in www.facebook.com and enter your username and password and all of that was just sitting there, waiting to be intercepted. But it was cool because the network protected everything.
But just under a decade ago, a man named Edward Snowden popped up on the world’s radar and everyone suddenly realized that everything we do on the internet could be watched and/or collected. When that happened, we all freaked out. Fortunately, we freaked out in a good way; we started locking everything down as much as possible.
This brings us to where we are today. Says Wisniewski “Today if I go to Starbucks and I try to hack you, I get nothing. At best the most I’ll see is ‘Adam is going to Facebook’ but I have no idea what he’s doing on Facebook. I don’t know if he’s logging in as him, or if he’s logging in as his alter ego. I have no concept because all of that is encrypted and protected at the application layer rather than the network.” Spoiler alert, I wasn’t logging in at all, and in fact, I never go to Facebook, but that’s another article for another time.
How things are today
It took some time for all of this to be put into place, but in 2019, Google reported that almost 92% of all traffic on the internet was encrypted. It turns out the answer was in our address bar all this time. The “s” in “https://” indicates that the traffic you’re generating is encrypted. It uses Transport Layer Security (TLS) to encrypt data sent over the internet, and it does this at the application level. It’s worth noting that “the application level” refers to both the website, such as facebook.com and the Facebook app.
The only information that leaks unencrypted is DNS lookup information. For example, if you open a browser and go to www.digitaltrends.com, and someone intercepts your signal, they can see that you went to the best tech website ever, but they wouldn’t be able to see what you did when you got there. Even that is changing according to Wisniewski. Both Firefox and Google Chrome hide DNS lookup information by default, and most other web browsers offer the ability to do so. Windows 11 has a system-wide option that you can enable to hide that information in any browser.
So what that all boils down to is that for the most part, public Wi-Fi is about as safe as you can reasonably ask for.
Additionally, HTTP Strict Transport Security (HSTS) adds another layer of security. HSTS basically teaches your computer what a website looks like on your first visit. Every subsequent visit confirms for your browser that you’re at the correct one. There’s even an HSTS preloaded list of tens of thousands of domains that your browser knows about even before your first visit. This prevents man-in-the-middle attacks from sending you to the wrong site made up to look like the right site and compromising your traffic.
Exceptions to the rule
So what that all boils down to is that for the most part, public Wi-Fi is about as safe as you can reasonably ask for, but there are a few caveats to that. This will sound similar to our Scream trailer smart home hacking article, but similar circumstances call for caution in this case. If you are the kind of person who routinely handles extremely sensitive information and/or information that other people would really want, then you should think twice before connecting to any network that you or your company/agency didn’t set up yourselves. While the encryption we use every day is robust enough to handle casual attackers, if you handle information that others would literally kill for, public Wi-Fi is not for you.
Another big caveat comes in the form of companies whose policies specifically forbid you from using public Wi-Fi. If you work for such a company or agency, simply don’t do it. In the company’s opinion, there aren’t enough protections in place, and they sign your paychecks, so who are you to argue? The bottom line is, companies have rules and as an employee, it’s your job to follow them, despite what a tech website has to say about the matter.
Finally, check in with your gut. If you feel uncomfortable logging into your bank from your local airport, don’t. After all, this is your data. You can use a banking app to log in from your phone on 5G or LTE which is about as secure as networks can get.
Other ways to stay safe
So are there ways that you can make your web traffic even safer? I asked about VPNs for example. One theory is that a Virtual Private Network is a good way to hide data, and to an extent, Wisniewski agrees. But in cases like that, he describes a VPN as “reassigning trust.” While most of your traffic is already encrypted, using a VPN shifts the unsecured stuff (like DNS lookups for example) over to the VPN. If you trust your VPN more than the network engineers at Starbucks, that will help you out with the limited amount of data that isn’t already encrypted.
One of the most important messages Wisniewski left me with was a warning against clicking through security messages. When you’re visiting a website, and your browser pops up a warning saying the site may not be safe, it’s probably not safe. The problem may be as simple as a typo, or an expired security certificate, but suffice it to say, if you’re getting a warning, there’s a reason. Double-check everything, and when in doubt, just skip it and come back another time.
In general, for most people, public Wi-Fi is safe, and the reason for that is because as a society, we’re a lot more security conscious than we were even 10 years ago.
Beyond that, password managers are a great tool to use to stay safe on the internet, regardless of how you’re connecting. Password managers are inherently stringent when it comes to security, and they prevent reuse or oversimplification of passwords. Plus, if a password suffers a breach, it’s simple enough to change.
But the overall message here is that in general, for most people, public Wi-Fi is safe, and the reason for that is because as a society, we’re a lot more security conscious than we were even 10 years ago. As such, we have demanded that our information be more protected, and the internet has responded. So if you’re traveling or just out and about, it’s probably OK to grab a coffee and take in some Netflix.
