• Septimaeus@infosec.pub
    link
    fedilink
    English
    arrow-up
    44
    ·
    edit-2
    20 hours ago

    Seriously, this is the lowest hanging fruit. Never trust hotel WiFi.

    E: infants and their alts

    • LordCrom@lemmy.world
      link
      fedilink
      English
      arrow-up
      9
      ·
      1 day ago

      Wrong. Never download and install any wifi profile package, escpecially if it has certs to install. That is just asking to have all your traffic decrypted and data taken.

    • Scrubber0777@lemmy.ml
      link
      fedilink
      English
      arrow-up
      23
      ·
      3 days ago

      Agree with your sentiment especially not trusting hotel Wifi (or heck all open network for this matter).

      I’d even err on the safe side and suggest not download any certificate and encryption profile at all.

      Even if I find myself as a tech literate person, I’d not trust my ability to identify the legitimacy of the download.

    • rozodru@piefed.world
      link
      fedilink
      English
      arrow-up
      6
      ·
      3 days ago

      extremely low hanging fruit. I travel a lot for work and all my laptops have VPNs with encrypted DNS. Even had to set that up on one of my FreeBSD installs (which was a god damn pain and with the shit wifi on that there really wasn’t much of a point at the end of the day).

      it’s even more mandatory for places that have NO captive portals. Those connections are opening themselves up to a can of worms. Looking at you Union Station in Toronto Canada. seriously, fix your shit. One of the biggest transit hubs in all of Canada and their wifi is completely 100% open.

      • Septimaeus@infosec.pub
        link
        fedilink
        English
        arrow-up
        2
        ·
        2 days ago

        lol same at Union Station WDC and all Amtrak trains (if the wifi even works). Finally switched to a gl.inet (openwrt) hotspot for work travel and haven’t looked back.

    • pHr34kY@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      ·
      edit-2
      3 days ago

      I don’t think anything can monitor or mess with your local web traffic once you have encrypted DNS.

      VPNs don’t add any privacy over HTTPS+DoH. Installing CA certs and whatnot is insane.

      Stop getting your opsec advice from influencers on youtube. It’s snake oil.

      • Assassassin@lemmy.dbzer0.com
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 day ago

        “VPNs don’t add any privacy over HTTPS+DoH”

        For someone so smug, you sure say some stupid shit. In what world would wrapping all of your traffic in an encrypted tunnel not provide additional privacy when using a public endpoint?

        • pHr34kY@lemmy.world
          link
          fedilink
          English
          arrow-up
          2
          ·
          1 day ago

          You’re routing all your traffic through a single inspection point. They too can scrape anything that isn’t HTTPS. They can list every site you visit without DoH.

          Corporations are just as unaccountable as ISPs and governments.

      • Septimaeus@infosec.pub
        link
        fedilink
        English
        arrow-up
        10
        ·
        2 days ago

        Hotel can see every site you connect to and you’re exposed to SNI fingerprinting by their ISP. Metadata leaks over both LAN and WAN (traffic volume, timing patterns, dest IPs, connection frequency) and both netadmin and ISP can infer your browsing habits without actually seeing the content. Other guests with wireshark and too much time on their hands.

        Moreover, many types of traffic aren’t HTTPS, including NTP, DHCP, SNMP, FTP, SSH (without HTTPS), most IoT devices, VoIP, gaming traffic, many application APIs, apps with embedded DNS overrides (really apps in general, especially mobile apps, especially meta and alphabet apps), even email unless TLS is explicitly configured. And many websites simply don’t serve HTTPS and will attempt to redirect to HTTP.

        This is without getting into encryption strength and post-quantum standards. And I was referring to 802.1X/MDM enterprise profiles not CA.

        • pHr34kY@lemmy.world
          link
          fedilink
          English
          arrow-up
          4
          ·
          edit-2
          1 day ago

          NTP, DHCP, SNMP, FTP, SSH

          • NTP just tells you time. No confidential data here.
          • DHCP and SNMP dont go over the internet. A VPN won’t save you from this.
          • FTP is dead. Not even web browsers support it anymore.
          • SSH is already encrypted. In some cases, it can literally be used as a VPN.

          Wireshark is useless on WPA3. Although hotel wifi typically doesn’t use it.

          SNI is encrypted with ECH.

          I disabled plaintext SMTP on my mail server years ago. Requiring TLS actually reduced spam by 99%. No reputable mail server will use plaintext.

          Almost nothing uses plain HTTP. The only thing I typically see is my phone’s internet connectivity check, which simply returns an HTTP 204 (No content). It’s practically a ping.

          HTTPS + DoH is enough because all of these problems are solved.