Every time someone talks about how public wifi is safe to use without a VPN due to things like HTTPS and HSTS, some random person replies with "man-in-the-middle attack" because they don't actually know what that is, and therefore don't understand that HTTPS and HSTS address specifically that.
Comments
If it doesn't, or it requests that change via http not https to try to be 'helpful' to the older browser, then a type of MIM can slip in.
Logging into a router requires a handshake. aircrack-ng and airreplay intercepts these and uses a dictionary to crack the password. While not exactly MITM, it provides an example.
In practice, I'm many-burned many-shy on security hubris, and would turn on a VPN.
My 2 cents - VPNs do not keep you safe. They are over-rated when it comes to security or privacy.
MITM attacks are not the only ones out there.
There are people who will use HTTP and won't know any better, or read warning messages.
There was no SSL/HTTPS functionality anywhere in the code base. He just thought the little lock icon in IE meant comms were encrypted
That was in 1999.
0 trust
In 1999 they were still using ftp and telnet *thrashes* and we were high on the 32 bit supply
Ahh, those were the days. I miss the wild wild SFBA
https://www.youtube.com/watch?v=WVDQEoe6ZWY
https://support.mozilla.org/en-US/kb/firefox-dns-over-https https://blog.chromium.org/2020/05/a-safer-and-more-private-browsing-DoH.html
Wasn't there a whole breach of one of the big VPNs recently?
Asymmetric cryptography lets you verify the party you're taking to (the little lock on the browser bar), and also encrypt your data so it can only be read by that party.
The fake WiFi can capture your packets in between, but not read them.
Dunning Kreuger.
‘A man in the middle’ will just see all the numbers of everyone connected to the WiFi. A bunch of them. The attacker now has to take time to figure out which number (aka device) represents a person of value.
Jokes on you, I’m at Walmart.
C levels given criminal charges for fraud
You can enable it with some flag, but only if you provide reasonable justification why you need to, and it triggers additional review, so I don't think most apps do it.
It's not anywhere near the danger of a successful MitM attack though.
we’re so screwed
I do use VPN when travelling, but only because my home router is my exit, i.e. it is convenient, actually secure and most importantly costs nothing
Well, all it does is connecting devices to the internet.
And I've seen Citrix clients that were not allowed to be used in public WiFis. They also expire passwords every 30 days...
Using an SSL VPN like openvpn to your own cloud instance / home server will encrypt everything.
Enterprise users however are probably still using raw unencrypted SQL fat clients from the 90s and thus different criteria.
Us mega techie guys: yes, maybe.
My aunt and other relatives: never.
No one just pounds on a keyboard for 30 seconds and shouts “I’m in!” They need actual access to people or devices.
Is anyone using HTTPS+HSTS correctly? No.
Is everyone using HTTPS correctly? No.
VPN is your only option for reliable security on public wifi.
I'm a sysadmin and if I start watching web logs of my firewalls, I wanna tear my eyes out. I DO NOT RECOMEND!
Imagine watching the logs of a public wifi.. let's say.. an Airport.. or a McDonalds.. or.. a HOTEL!
Things can get disgusting if you pay attention.
- SNI is barely encrypted
- Domain typosquatting
- DNS (53) is unencrypted
- DPI and and traffic analyzers exist
- Shady VPNs everywhere also…
So yeah, content in more secure nowadays but if big brother wants to know what im into it’s ez.
tbf, actually implementing MiTM reqs more than just seeing the sni. I bet most ppl wouldnt like that an observer can in fact see which hosts you connect to.
someday, hopefully soon ECH might mean that what ppl expect of TLS, will actually be true.
Even if that were true, *most* of your connection will still use asynchronous encryption, so it's a moot point.
The CA issues a cert for the specific set of domains which a domain owner can prove control over (this may be the top domain, or a list of subdomains, or ab wildcard cert for any possible subdomain, etc)
The CA does check the DNS values and validate up to the roots.
Again: this is the exact scenario HSTS protects from. It's already widely deployed and there are even some entire TLDs that are preloaded.
You'd need to compromise a CA first.
Where they take you in a back room and beat you with a rubber hose until you give them your password
The guy with the rubber hose may be the infamous man in the middle
Constantly responds with 11, 00, 01
Flushes memory
restarts auth
de-authorizes root
NOTHING can stop us, uh… um… THEM… yeah… them, from seeing whatever they want.
I’ll Mission Impossible isolated data that is offline. I got some bungee cord. 🤔
😬😈🦹♂️
* VPNs are for safely reaching home base
* Having a network perimeter is an anti pattern in this day and age
* L7 + identity (SSO / oidc), please
TLS changed the playing field. The layers of history are not well explained. Corporate legacy also confuses people.
I upgraded to a subscription when Dumbo got elected last time. And, always hated giving Google access to everything. Having a non-google Calendar is great. I deleted about everything Google related I could, including browser.
The phone and internet companies don't want you to know that there are secret auxiliary ports on all devices. You just gotta open them up.
https://t.co/54EaCvF7DQ