Security on a public Wi-Fi hotspot that cannot be safe

A bad habit has taken hold! We no longer keep an eye on which pages we open or where we type in our passwords when we are logged in to public Wi-Fi networks. Recently, a trend has spread for working from cafés. If needed, we ask the staff for the Wi-Fi password and off we go. We log in to the few e-mail accounts we use, check the company database, pay a few bills, buy a few small things online, finish our coffee and head off. Public Wi-Fi networks stay with us for the rest of the day too. We connect on the train, in the shopping centre, while walking down the street; our phone keeps switching to every Wi-Fi network it comes across... And so we trust all day long. But the question arises: should we? Is public Wi-Fi safe?

Unfortunately, without a VPN, it is not. Before we look at all the threats we face when using public Wi-Fi, let us see how a connection works.

Wi-Fi (short for wireless fidelity) is wireless communication in computer networks, operating in the unlicensed 2.4 GHz or 5 GHz band (which means the provider does not have to pay any fees for its operation, it only has to observe the rules of the Czech Telecommunication Office (CTU)). Wi-Fi networks can be built in two ways. We are concerned with public Wi-Fi, so the infrastructure network is what interests us. It contains one or more APs (access points), which broadcast a signal over a wide area. This signal is then received by the APs of individual users. So that users can search for the networks being broadcast and tell them apart, APs broadcast the signal via an identifier called the SSID (in practice this means that a Wi-Fi network has a unique name, which is displayed when searching).

Website encryption

You may have noticed website encryption, or perhaps not at all. Some websites begin with http and others with https. In the URL bar you also often see a padlock and the word "Secure". What does this mean, and what are the differences?

HTTP

If the address starts with this protocol, the website is not encrypted. All communication that takes place over it can be intercepted and altered. An attacker can capture not only login details, but also the cookies that keep you logged in to the website.

HTTPS

Websites starting with https are marked, for example, with a padlock and the word "Secure". This means the website is encrypted and the data you enter cannot be eavesdropped on. Whenever you log in to a website, always check that the address bar starts with https. If it does not, the site poses a risk to you. Unfortunately, even HTTPS protection may not be one hundred per cent. A potential hacker can still capture the cookies that remain on the website and keep you logged in. However, the communication itself stays hidden, and decrypting it would be difficult. 

What threats does using unsecured public Wi-Fi pose?

MITM attack (Man In The Middle)

MITM attacks work by placing an attacker in the path of the data flow you are sending (for example between your computer and the e-mail server), and the attacker not only eavesdrops on the data but can also change it. If they intercepted, for example, the details you enter into internet banking, they could send the money to a completely different account. An attack can be carried out, for example, via viruses that you download onto your device, or even via an antivirus program. An ordinary user finds a MITM attack very hard to recognise, but there are various plug-ins that you can install in your browser which can help you spot an attack. Internet banking is, however, well protected, so fraudsters try to forge the login page itself and force you to enter your login details. This kind of attack is called phishing, i.e. "fishing" for passwords. Such attacks, however, can threaten you regardless of the type of connection. 

Session hijacking attack

This type of attack threatens mainly websites with an unsecured http protocol. When you log in to a site, a so-called session is created. If an attacker manages to capture your login (it is enough for them to capture the cookies), they can pretend to be you. An ongoing attack is again very hard to recognise; prevention is by using a VPN (see below).

"Fake" Wi-Fi

An attacker sets up a public Wi-Fi network that looks as if it is provided by, for example, a railway station, an airport or a café... After you connect to it, they eavesdrop on your access details and more. The protection against this attack is to connect only to public networks for which you have to be given the password.

Staying safe on public Wi-Fi

How can we prevent such attacks coming from public unsecured Wi-Fi networks? Can we create at least a somewhat safe "oasis" in this dangerous world of public Wi-Fi? The following steps will help.

Update

Make sure the system you use is always up to date, as well as the programs on your computer and the apps downloaded on your mobile phone. Do not forget to update your antivirus program either. When downloading any application, always make sure it comes from an original source.

Turn off automatic connection to Wi-Fi

On computers and mobile devices, turn off the option that lets the device connect to available public Wi-Fi networks automatically. You can also help with this by turning off Wi-Fi scanning, which on phones in particular is practically always on. You will save not only battery, but also protect your privacy and your device.

Two-factor authentication

Two-factor authentication works like this: when you log in to a site for the first time from a new device, in addition to entering your user name and password, you are verified in another way as well. An example is entering a code that is sent to you by SMS. Use it wherever you want to secure your account better. Start right away with your e-mail. If an attacker obtains access to your e-mail, they no longer need passwords for other sites or apps, because they can simply reset them via e-mail.

Do not turn off the firewall

All operating systems now come with a firewall installed, so in this case your only concern is to keep it switched on. A firewall is essentially a wall that stands between the user's device and the internet. It is a software tool that checks all electronic data communication entering a computer or computer network. It thus protects the computer from being attacked by other users or by malicious programs (trojan horse, spyware, etc.). It is not all-powerful, but the blocking rules are regularly updated by the service provider, and they filter out already known dangers. 

VPN

VPN services work as follows: data from your device is encrypted by the VPN client on your PC, and then sent through an encrypted tunnel to a VPN server, which can be located anywhere in the world, for example in your company, or be run commercially. The VPN server decrypts the data and sends it on to the website. The website you are logging in to therefore does not know your IP address, only that of the VPN server. Likewise, your internet provider cannot see which pages you visit. However, the VPN server stores all the data, so you need to choose one you trust. This raises the question of what happens if someone runs a VPN server just to collect users' data? You can avoid this risk by downloading a verified VPN service. VPN services from antivirus companies are very trustworthy. Alternatively, it is worth running your own VPN servers, even for fairly small businesses. It is not expensive hardware.

TIP: Read the article What is a VPN, why use one and what advantages does it bring

Password manager

When creating new login details, we usually face the problem that we cannot come up with a truly strong password, because we would not remember it. A large percentage of users therefore have a few passwords that they cycle through on all the servers they log in to. More advanced users have a password that they vary in different ways. The most advanced, however, use a password manager: a clever tool that stores your passwords in an encrypted file on your computer, to which only you have access. This is done through a single password, which you have to remember. Thanks to a password manager you can create really strong passwords; the tool generates the password and then logs you in automatically. You can choose between paid and free tools.

TIP: Read the article How to create a proper password

Staying secure also requires not being trusting or careless when moving around the internet. Even if you do everything correctly, exactly as you have just read, there will always be some "but". Hackers always try to stay at least one step ahead, so what works today may not be one hundred per cent effective tomorrow. It is therefore good, in the area of security on public Wi-Fi networks, not to rest on your laurels after downloading a VPN, and to keep learning constantly.

Author: Johana Nádvorníková