Public Wi-Fi: Should We Use It?

The Internet is everywhere now. Gone are the days of having to go to a library to do online research. Also gone are the days of having to wait until you got home to get on the Web, which involved unplugging a telephone line to set up your dial-up Internet connection! We don’t have to wait anymore to get online. With wireless networks, or Wi-Fi networks, web surfing is possible anywhere from schools to airports. Many businesses like hotels provide their patrons with credentials to secured public Wi-Fi networks, while other businesses like coffee shops provide free but unsecured public Wi-Fi that does not require credentials. Whether secured or unsecured, is public Wi-Fi safe? The idea of free Wi-Fi sounds cost-effective and convenient, but it does come at the expense of privacy and exposure to online dangers like identity theft? Online dangers are lurking everywhere, but if you ever need to use public Wi-Fi, secured or unsecured, here are some risks to be aware of and tips on how to minimize these risks for yourself.

Risks

Weak Security

The encryption technology used to secure Wi-Fi networks leaves much to be desired in terms of protection. Early on, wireless networking devices used the Wireless Encryption Protocol (WEP) for data encryption, but this protocol was found to be poor in protection and significantly vulnerable to hacking. Not only is WEP still being used by some wireless networks now, but the successor to this protocol, Wi-Fi Protected Access (WPA), has been discovered to have major flaws as well. One catastrophic fault identified in WPA2 (a security method added to WPA for stronger protection) is a proof-of concept exploit known as Key Reinstallation Attacks, or KRACK for short. Impacting multiple operating systems and all modern secured Wi-Fi networks, especially Linux and Android systems, KRACK enables attackers who are located within a certain range of susceptible devices or access points to intercept sensitive data assumed to be encrypted, such as passwords and chat messages. This exploit also makes possible the injection of malware like ransomware into a website a victim may be accessing. It can also open the gates to attacks in which thieves decrypt data that a user is sending to an access point from his device.

Fishy Wi-Fi Networks

In addition to exploiting legitimate public Wi-Fi networks, online attackers can also land victims by setting up their own rogue networks for unsuspecting Internet surfers to find and join. Hackers usually like to give their networks names similar to those of businesses in the vicinity, like “ABC Coffee Shop1” to give the impression of authenticity. Unfortunately, however, these shady networks serve as cyber playgrounds for thieves, in which they snoop on users’ online activity, viewing their browsing history, account credentials, and more. This type of invasion is carried out through Man in the Middle Attacks (MITMs). In a MITM attack, an attacker looks for vulnerabilities in a network, in which he establishes a connection for himself in between the victim and the server the victim tries to connect to when visiting a website, making himself a “man in the middle.” Once this connection is set up, the attacker can then intercept the original, real connection between the victim’s browser and the server, capturing and possibly even modifying data that’s in transit.

How to Stay Safe on Public Wi-Fi

Use Secured Public Wi-Fi

Whenever possible, use a password-protected Wi-Fi connection. It may still be vulnerable to attack, but it has an extra layer of protection that unsecured Wi-Fi networks lack, making them less of an attractive target to hackers.

Use a VPN

An effective alternative to directly using public Wi-Fi is to connect through a Virtual Private Network (VPN), which can be used on both computers and mobile devices. A VPN is a technological feature that extends a private network possessing links across public networks. This allows a user’s computer to connect to other computers like servers across a public internetwork as if the computer and the server were directly connected in a regular private network. The data communication between the user’s computer and server is encrypted, requiring VPN users to submit authentication information such as passwords. VPNs were originally created for company employees working outside the office to securely link to corporate servers through public internetworks like the Internet. Even though the connection is carried out intermediately over a public network, it appears to the user as a private point-to-point connection instead of a public one, making it “virtually private.” Nowadays, you don’t have to be a company employee to utilize a VPN; there are free and paid VPN applications available to the public.With a VPN, the encryption of communication will provide extra levels of protection against hackers, which helps guard your privacy and anonymity, making it harder for intruders to eavesdrop on your activity.

Use Your Mobile Phone Hotspot

Avoid the need to even consider using public Wi-Fi altogether by using your own personal hotspot on your mobile device when you’re away from home. Using your own network gives you more control over your security, especially since mobile hotspots are password-protected and tell you how many people are connected to your network. If you’re concerned about exceeding your data usage limit, consider upgrading to an unlimited data plan.

Hold Off  on Sensitive Transactions

If you must use a public Wi-Fi network, make sure you do not visit any sites or perform any transactions that require accessing or entering personally identifiable information (PII), such as your social security number, home address, date of birth, or bank account details. Also refrain from making any online purchases, which require credit card payments. Again, you never know if someone is “peeking in” on your online activity, even on a secured connection.

Only Use HTTPS Sites

If you’re surfing the ‘Net on public Wi-Fi, only visit sites that use the secured HTTP protocol, denoted by the “https” prefix in the web address bar of a browser window. Secured websites will also feature a closed padlock icon to the left of their URL in the web address bar. HTTPS sites encrypt communication on their site to help thwart data interception from online thieves. It may be easy to forget to check that you’re on a secured site, so a good measure to take is to enable the “Always use HTTPS” feature on websites you go to regularly. You can also install a browser extension like HTTPS Everywhere that forces your browser to use the secured HTTP protocol for sites that are visited. The only caveat with these extensions is that they can only enable encryption on parts of websites that already have security features set up. So if a website is not secure on its own, then the extension may not be able to support it, and you may have a higher risk of exposure on that unsecured site.

Disable Automatic Wi-Fi Connections

Make sure the wireless settings on all of your devices are configured so that they do not automatically connect to any available hotspots within range wherever you travel. You can access these features in your Control Panel or System Preferences, specifically in Network Settings. Turning off this automatic connection feature will ensure that you do not unknowingly link to public hotspots.

Learn More About Staying Safe Online

Staying safe out there on the Web is a task in and of itself, but you can make it easier by staying up to date on security news and trends with educational resources. Stay current with cyber security by taking courses from Cybrary:

• Network Fundamentals
• Network Operations and Security
• Wireless Access Exploitation Skill Assessment