Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 1 down vote favorite

I have my google account setup on my phone and tablet. If I go to some place which has free WiFi access like an airport, or a bus, or even starbucks, how safe is it to use their WiFi service? Will they in any way be able to gain access to my google account or any account I have setup on my phone or tablet.

share|improve this question

closed as off topic by Karan, Dave M, Siim K, Luke, wizlog Feb 19 at 19:56

Questions on Super User are expected to relate to computer software or computer hardware within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

3 Answers

up vote 3 down vote accepted

The simple answer is that it is very difficult to guarantee safety on a public wireless network, as everything you send can be received by an attacker.

  • Configure your firewall to deny any connections
  • Strong wireless encryption is a must - if the network offers anything less than WPA2, don't use it.
  • Don't use websites that use http - you must use https (which uses SSL) and ideally, check that it is using SSLv3 or TLS1.2

The thing you can't confirm is how secure the wireless access point is - an attacker could have control over it, which means the wireless encryption is not protecting you.

So you should really use a VPN for anything sensitive or valuable, so you have an encrypted tunnel to an endpoint not attackable at your location.

And if you are working with really sensitive information - just do not use any public wireless network.

Know the risks and decide. Are your bank account contents valuable to you? If so, you may not want to do online banking on a public wireless network anyway.

There are loads of questions on this topic over on Security SE, so if you want more information please have a look.

share|improve this answer
2  
“Strong wireless encryption is a must” No, it's useless for the user. Encryption or the lack of it concerns the hotspot owner to authorize connections. When you don't trust the network infrastructure, it doesn't matter whether it encrypts anything. – Gilles Feb 19 at 9:38
1  
Defence against different attackers. strong encryption - against others on the network. But defending against an attacker who owns the hotspot.....nah, that's a trust issue – Rory Alsop Feb 19 at 9:39
1  
How do you know whose hotspot you're really connecting to? Anyway, regardless of how much security it provides (some, but not enough), it's useless because you can't rely on it, hence the need to use encrypted and authenticated protocols (SSL) anyway, hence additional cryptography in the network is irrelevant. – Gilles Feb 19 at 9:44
up vote 0 down vote

I suggest you read the article here. there are some useful steps how to stay safe on public WiFi.

  • Make sure the public Network you are using is official (not made by the Attacker)
  • Turn off Sharing on your Computer
  • Enable your Firewall
  • Use SSL whenever possible
  • Use VPN if posssible
  • Turn off your WiFi when you do not need it
  • Do not work with sensitive information over public WiFi

Try out Witopia it is a software which will anonymize you online as well as encrypt your data across untrusted networks.

Also Google offers 2-step verification for their accounts, read here. After you log in to your Google Account with your email and password Google will send you a code via text or voice call on your smartphone device. After you put that code you will be logged in to your Google Account. With 2-step verification it is more difficult for someone to log in to your account because they must obtain your smartphone device too. If the Attacker somehow manages to get access to your account he will be able to use it for a short period of time, that is till you log out because than the code expires. The 2-step verification adds another layer of security to your account. It won't offer 100% security but with this additional option the password is not the only information the attacker needs to access your account information.

share|improve this answer
3  
Please do not post an answer with just a link. “read the article here” isn't an answer. This site is a questions and answers site, not a link collection. Include real content in your answer and provide the link for reference or for further information. – Gilles Feb 19 at 9:40
In particular, Google Accounts is already secured by HTTPS. You haven't given any justification for why two-factor auth increases protection against a hostile network. (AIUI the gains would come against online dictionary attacks, or if you're incautious enough to enter your password on someone else's computer). – sourcejedi Feb 19 at 10:29
- how? - questioner mentions only mentions phone and tablet & does not mention windows - ditto - Yep, though I hear mobile browsers are not necessarily as good at identifying SSL sites properly, so it would be useful if we could nail that down. – sourcejedi Feb 19 at 10:32
@sourcejedi With 2 Step Verification if the Attacker steals the password he can use it only for a short amount of time before it expires. That is why i think two step verification adds to the security. – Devid Feb 19 at 10:34
Mmm... I guess there's an issue with spoofing a non-SSL site like StackOverflow, then linking to an attackers site for password entry instead of Google. Though - as you'd expect, it looks like Google devices do single-signon already. If that applies, Google would be a bad example, because a prompt for your Google password would be so suspicious anyway. – sourcejedi Feb 19 at 10:53
show 1 more comment
up vote 0 down vote

It should be safe under the following conditions:

  1. You are using https
  2. There are no certificate errors (most browser show the bar as green). This means that the identify of the remote server is verified.
  3. You haven't installed any un-trusted certificate authorities (you would probably know if you had done this)
  4. You don't send any data outside of https that you wouldn't be fine posting on Facebook :-)

Please note that any traffic you send unencrypted (and outside of https) will be visible to any attackers monitoring the network.

Also, if your browser shows any certificate errors at all, DO NOT PROCEED.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.