Why are all the free wifi services offered by hotels and airports etc unsecured? I scan
networks with AVG and then use TunnelBear’s VPN (virtual private network) whenever I want to use them for anything other than checking weather or news. Steve
There’s often a trade-off between security, convenience and cost. This doesn’t just apply to wireless hotspots but to houses, cars and other things.
You could make your house more secure by adding deadlocks to all the doors, putting bars over the windows, and installing floodlights, burglar alarms and security cameras. However, it would be expensive, and it would make life less convenient. It also wouldn’t make your house impregnable: an army would just blow the doors off.
Real security choices actually depend on two other things: the value of what you’re protecting, and the perceived risk. For example, you’d expect a jewellery shop to spend more on security than, say, a patisserie. The question is not how much security you can get, but how much you need.
Airport hotspots etc
When it comes to airport, hotel and similar hotspots, convenience rules. Both the suppliers and the users want their networks to be as easy to use as possible. Anything that would require IT support is an anathema because support is expensive and there are no long-term benefits.
In general, the perceived value of hotspot communications is low, and that applies to both the traffic and the customers. First, hotspot users are mostly checking the weather, or news, or posting social media updates rather than, for example, trading stocks and shares or exchanging sensitive medical information. The perceived value of the traffic is low.
Advertisement
Second, hotspot users are generally transitory. It may be months or years before they use the same hotspot again, if ever. The perceived value of the customer is therefore low.
Third, there are millions of hotspots, and hundreds of millions of people use them. How often do people get hacked – or at least, how often do they know they’ve been hacked? I don’t have any numbers, but I don’t even have any anecdotal evidence. The perceived risk is low.
Under the circumstances, I don’t expect airports, hotels, coffee shops and other hotspots to invest in better security. People who want or need better security will have to provide it themselves, as you do with TunnelBear.
Minimising risk
Like jewellers, people should pay more attention to security if they have more to lose. That includes activists, politicians, diplomats, some journalists, and people with sensitive commercial or industrial information. Frequent users should also be more careful than casual users. I’d take more precautions if working from the same coffee shop for several hours a day than if using it for 10 minutes in passing.
You should obviously make sure your PC’s security patches are up-to-date, and have anti-malware software and a firewall in place.
For extra security, turn off file and printer sharing: open file-sharing could allow a hacker to put malware on your computer. Also, turn off both wifi and Bluetooth when you are not using them: they allow you to be tracked.
Worse, smartphones and laptops may connect automatically to any available networks, including rogue and ad hoc networks running on nearby laptops. It’s therefore important to know each hotspot’s exact name before you try to connect. If not, you may log on to an “evil twin” network with a similar name, which someone has set up to collect names and passwords.
Otherwise, the best defence is to have nothing to lose. This has become much easier nowadays. Thanks to the cloud, very few people need to keep sensitive information on a laptop. It can be backed up in multiple places and accessed from almost anywhere.
If you are travelling, you can reset Windows 10 to factory condition very quickly, then sign on with an empty Microsoft account by creating a new email address at outlook.com. Your laptop now contains no personal information. When you arrive at your destination, you can log on to your “real” account. If you need any sensitive information on the trip, you can get it from a cloud service such as Dropbox, or stow it as a heavily encrypted blob on an anonymous file sharing site.
When you get home, you can reset your laptop back to factory condition then restore your old data from a backup.
Safer hotspots
Advertisement
The riskiest hotspots have no security at all. Obviously, it’s best not to use them if there’s an alternative, but you can use them with a VPN or by only accessing sites that provide secure https not http connections. The EFF’s browser extension HTTPS Everywhere makes this easier.
Nowadays, most hotspot names appear with a lock symbol next to them, which means you need a password to log on. Home and office networks work like this. All networks should now be using WPA2 wireless protected access security not WPA, WEP or WPS.
Airport, hotel and coffee shop networks are not necessarily unsecured: most of them now use web-based security, where you sign in via a web page. These networks should be safe enough if you use https encrypted communications, but even with a VPN, you are at some risk because your initial connection to the web page is unsecured.
For this reason, it’s a good idea to shut down all web browsers and email programs before you turn wifi on. Browsers and other programs may try to download new data as soon as they see an internet connection, which could expose personal information.
Using a VPN
In the early days of computing, corporate computers were often connected by dedicated private lines. Today, they connect over the open internet using a VPN or “virtual private network”. In other words, all the communications between your PC or smartphone and the VPN supplier are encrypted so that nobody else can read them. It’s like having your own line.
Browser-based VPNs have been popular for some time, thanks partly to the marketing efforts behind products such as Hotspot Shield. More recently, Opera has added a VPN to its browser. The consensus seems to be that, unlike the free ad-supported Hotspot Shield, it’s a remote proxy rather than a “proper” VPN. However, it’s still better than nothing.
A VPN like TunnelBear works at the system level, so that everything gets encrypted, not just browser traffic.
In either case, there are two problems. First, you are moving trust from the hotspot provider to the VPN provider. Your usage data could still be tracked and sold to third parties. Second, once your communications leave the VPN server, they’re back on the open internet, so you still need https (SSL/TLS) as well.
Can you trust your VPN provider?
There are more than a hundred VPNs on the market, so it’s hard to choose, but TorrentFreak asks some good questions in Which VPN Services Keep You Anonymous in 2017? TunnelBear isn’t featured, though earlier this month it said it was the first consumer VPN to publish a third-party security audit (PDF).
VPNCompare.co.uk, The VPN Guru and Best 10 VPN are among the websites that publish information about VPNs, including some comparison reviews. However, it’s complicated. Caveat emptor.
Have you got a question? Email it to Ask.Jack@theguardian.com
How can I extend Wi-Fi to the other side of my house?
How can I provide guests with Wi-Fi without giving them my password?
Since you’re here …
… we have a small favour to ask. More people are reading the Guardian than ever but advertising revenues across the media are falling fast. And unlike many news organisations, we haven’t put up a paywall – we want to keep our journalism as open as we can. So you can see why we need to ask for your help. The Guardian’s independent, investigative journalism takes a lot of time, money and hard work to produce. But we do it because we believe our perspective matters – because it might well be your perspective, too.
I appreciate there not being a paywall: it is more democratic for the media to be available for all and not a commodity to be purchased by a few. I’m happy to make a contribution so others with less means still have access to information.
Thomasine F-R.
If everyone who reads our reporting, who likes it, helps to support it, our future would be much more secure. https://www.theguardian.com/technology/askjack/2017/aug/17/ask-jack-how-can-i-use-airport-and-hotel-wifi-safely
