Nervous about using public Wi-Fi while you travel? You shouldnt be. Heres why – Digital Trends

When youre out and about, and especially when youre traveling, you might find yourself feeling quite a bit of anxiety when logging into public Wi-Fi. Maybe youre sitting in an airport waiting for your flight, and the siren call of that Wi-Fi network is making your ears itch. Youve got one of the best laptops you can buy, but youve always heard that public Wi-Fi is dangerous, or your work strictly prohibits it. So what is a traveling techie to do? I sat down with Chester Wisniewski, Principal Research Scientist for Sophos to find out just how terrible it was.

Funny story. It turns out its not so bad.

Most of what youve heard about public Wi-Fi likely dates back a decade or more. Thats where the terrible reputation comes from. But things have changed, and its important to understand how, and part of the how includes the why. Theres a little history to go over to see how we got here though.

Today if I go to Starbucks and I try to hack you, I get nothing. At best the most Ill see is Adam is going to Facebook but I have no idea what hes doing on Facebook. I dont know if hes logging in as him, or if hes logging in as his alter ego. I have no concept because all of that is encrypted and protected at the application layer rather than the network.

Many moons ago, the internet was largely unsecured. We relied on our networks to keep our network traffic protected. As a result, people were vulnerable to attacks with cute names like evil twin and man in the middle. These attacks allowed a hacker to see everything that was happening as it flowed through the internet. Type in http://www.facebook.com and enter your username and password and all of that was just sitting there, waiting to be intercepted. But it was cool because the network protected everything.

But just under a decade ago, a man named Edward Snowden popped up on the worlds radar and everyone suddenly realized that everything we do on the internet could be watched and/or collected. When that happened, we all freaked out. Fortunately, we freaked out in a good way; we started locking everything down as much as possible.

This brings us to where we are today. Says Wisniewski Today if I go to Starbucks and I try to hack you, I get nothing. At best the most Ill see is Adam is going to Facebook but I have no idea what hes doing on Facebook. I dont know if hes logging in as him, or if hes logging in as his alter ego. I have no concept because all of that is encrypted and protected at the application layer rather than the network. Spoiler alert, I wasnt logging in at all, and in fact, I never go to Facebook, but thats another article for another time.

It took some time for all of this to be put into place, but in 2019, Google reported that almost 92% of all traffic on the internet was encrypted. It turns out the answer was in our address bar all this time. The s in https:// indicates that the traffic youre generating is encrypted. It uses Transport Layer Security (TLS) to encrypt data sent over the internet, and it does this at the application level. Its worth noting that the application level refers to both the website, such as facebook.com and the Facebook app.

The only information that leaks unencrypted is DNS lookup information. For example, if you open a browser and go to http://www.digitaltrends.com, and someone intercepts your signal, they can see that you went to the best tech website ever, but they wouldnt be able to see what you did when you got there. Even that is changing according to Wisniewski. Both Firefox and Google Chrome hide DNS lookup information by default, and most other web browsers offer the ability to do so. Windows 11 has a system-wide option that you can enable to hide that information in any browser.

So what that all boils down to is that for the most part, public Wi-Fi is about as safe as you can reasonably ask for.

Additionally, HTTP Strict Transport Security (HSTS) adds another layer of security. HSTS basically teaches your computer what a website looks like on your first visit. Every subsequent visit confirms for your browser that youre at the correct one. Theres even an HSTS preloaded list of tens of thousands of domains that your browser knows about even before your first visit. This prevents man-in-the-middle attacks from sending you to the wrong site made up to look like the right site and compromising your traffic.

So what that all boils down to is that for the most part, public Wi-Fi is about as safe as you can reasonably ask for, but there are a few caveats to that. This will sound similar to our Scream trailer smart home hacking article, but similar circumstances call for caution in this case. If you are the kind of person who routinely handles extremely sensitive information and/or information that other people would really want, then you should think twice before connecting to any network that you or your company/agency didnt set up yourselves. While the encryption we use every day is robust enough to handle casual attackers, if you handle information that others would literally kill for, public Wi-Fi is not for you.

Another big caveat comes in the form of companies whose policies specifically forbid you from using public Wi-Fi. If you work for such a company or agency, simply dont do it. In the companys opinion, there arent enough protections in place, and they sign your paychecks, so who are you to argue? The bottom line is, companies have rules and as an employee, its your job to follow them, despite what a tech website has to say about the matter.

Finally, check in with your gut. If you feel uncomfortable logging into your bank from your local airport, dont. After all, this is your data. You can use a banking app to log in from your phone on 5G or LTE which is about as secure as networks can get.

So are there ways that you can make your web traffic even safer? I asked about VPNs for example. One theory is that a Virtual Private Network is a good way to hide data, and to an extent, Wisniewski agrees. But in cases like that, he describes a VPN as reassigning trust. While most of your traffic is already encrypted, using a VPN shifts the unsecured stuff (like DNS lookups for example) over to the VPN. If you trust your VPN more than the network engineers at Starbucks, that will help you out with the limited amount of data that isnt already encrypted.

One of the most important messages Wisniewski left me with was a warning against clicking through security messages. When youre visiting a website, and your browser pops up a warning saying the site may not be safe, its probably not safe. The problem may be as simple as a typo, or an expired security certificate, but suffice it to say, if youre getting a warning, theres a reason. Double-check everything, and when in doubt, just skip it and come back another time.

In general, for most people, public Wi-Fi is safe, and the reason for that is because as a society, were a lot more security conscious than we were even 10 years ago.

Beyond that, password managers are a great tool to use to stay safe on the internet, regardless of how youre connecting. Password managers are inherently stringent when it comes to security, and they prevent reuse or oversimplification of passwords. Plus, if a password suffers a breach, its simple enough to change.

But the overall message here is that in general, for most people, public Wi-Fi is safe, and the reason for that is because as a society, were a lot more security conscious than we were even 10 years ago. As such, we have demanded that our information be more protected, and the internet has responded. So if youre traveling or just out and about, its probably OK to grab a coffee and take in some Netflix.

Excerpt from:
Nervous about using public Wi-Fi while you travel? You shouldnt be. Heres why - Digital Trends