Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I watched a program on the BBC last night that highlighted the risks of using any public wireless hotspot.

http://www.guardian.co.uk/technology/2009/oct/29/wifi-watchdog-hotspot-security-vulnerable

They had examples of hijacking someones gmail session and getting some email usernames and passwords. I would assume they are talking about an intruder sitting in the wireless zone and using a packet sniffer to monitor unencrypted traffic, and some email usernames and passwords and web traffic are transported unencrypted. The way they were talking it was as if they could also hijack someones session, I assume by reading the cookies being transmitted and then using them to jump on their session.

However, I was very confused over this, as most important sites use SSL and gmail definitely works over HTTPS. Therefore, all traffic between the browser and the web server (including anything being broadcast over the local public network) would be encrypted and unreadable.

Am I correct in thinking that you're only at risk if you're using anything that's not using HTTPS & SSL? If that's the case and it seems likely that it is, then that stuff is pretty obvious, and the program was probably aimed at less tech savvy people than myself.

I'd be very interested how they got into someone's gmail though, as to my understanding that is totally secure!

Cheers,

Mike

share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

Gmail's SSL can be turned off. This has advantages and disadvantages. Security being the main concern.

Additionally, SSL isn't infallible. It's secure enough for now, but it's no longer the unbreakable fortress of encryption it once seemed.

share|improve this answer
    
Interesting, do you have any links for any information about the current state of SSL and how secure it is? All the info I can find while googling looks pretty ancient! –  Michael Waterfall Oct 30 '09 at 16:28
    
blogs.computerworld.com/ssl_cert_hash_hacked_on_ps3_farm is one example. It's not "oh no the internet isn't secure anymore", but it is worrying. –  Phoshi Oct 30 '09 at 17:16
add comment

A lot of people use the same password for multiple accounts/sites. Grab one that goes across unencrypted and try it as the password for an encrypted site. Odds are pretty high its the right one.

share|improve this answer
add comment

I was half listening to Watchdog last night, can't say I remember seeing anything to suggest that they had tried the following but it could be possible:

Someone could sit in a HotSpot with the equipment to create a "fake" Wireless Access Point in a back pack (reading Scott Hanselman's Blog suggests you may only need a Windows 7 Laptop configured correctly), this wireless access point could be used to perform a Man-In-The-Middle attack presenting a fake version of G-Mail or any other service. This should be thwarted by SSL, however, if the user did not heed the warnings or was using an older browser that used confusing terminology they may not notice the Certificate was invalid.

share|improve this answer
    
Hmm that's interesting too, didn't think of a fake access point serving up fake websites. I guess the way around that would be to ensure you connect to the correct wireless network! –  Michael Waterfall Oct 31 '09 at 9:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.