Microsoft issued a warning travelers across the world, saying Russian hackers have targeted Wi-Fi networks at hotels, conference centers, and other hospitality venues.
Hotel can see every site you connect to and you’re exposed to SNI fingerprinting by their ISP. Metadata leaks over both LAN and WAN (traffic volume, timing patterns, dest IPs, connection frequency) and both netadmin and ISP can infer your browsing habits without actually seeing the content. Other guests with wireshark and too much time on their hands.
Moreover, many types of traffic aren’t HTTPS, including NTP, DHCP, SNMP, FTP, SSH (without HTTPS), most IoT devices, VoIP, gaming traffic, many application APIs, apps with embedded DNS overrides (really apps in general, especially mobile apps, especially meta and alphabet apps), even email unless TLS is explicitly configured. And many websites simply don’t serve HTTPS and will attempt to redirect to HTTP.
This is without getting into encryption strength and post-quantum standards. And I was referring to 802.1X/MDM enterprise profiles not CA.
NTP just tells you time. No confidential data here.
DHCP and SNMP dont go over the internet. A VPN won’t save you from this.
FTP is dead. Not even web browsers support it anymore.
SSH is already encrypted. In some cases, it can literally be used as a VPN.
Wireshark is useless on WPA3. Although hotel wifi typically doesn’t use it.
SNI is encrypted with ECH.
I disabled plaintext SMTP on my mail server years ago. Requiring TLS actually reduced spam by 99%. No reputable mail server will use plaintext.
Almost nothing uses plain HTTP. The only thing I typically see is my phone’s internet connectivity check, which simply returns an HTTP 204 (No content). It’s practically a ping.
HTTPS + DoH is enough because all of these problems are solved.
Hotel can see every site you connect to and you’re exposed to SNI fingerprinting by their ISP. Metadata leaks over both LAN and WAN (traffic volume, timing patterns, dest IPs, connection frequency) and both netadmin and ISP can infer your browsing habits without actually seeing the content. Other guests with wireshark and too much time on their hands.
Moreover, many types of traffic aren’t HTTPS, including NTP, DHCP, SNMP, FTP, SSH (without HTTPS), most IoT devices, VoIP, gaming traffic, many application APIs, apps with embedded DNS overrides (really apps in general, especially mobile apps, especially meta and alphabet apps), even email unless TLS is explicitly configured. And many websites simply don’t serve HTTPS and will attempt to redirect to HTTP.
This is without getting into encryption strength and post-quantum standards. And I was referring to 802.1X/MDM enterprise profiles not CA.
Wireshark is useless on WPA3. Although hotel wifi typically doesn’t use it.
SNI is encrypted with ECH.
I disabled plaintext SMTP on my mail server years ago. Requiring TLS actually reduced spam by 99%. No reputable mail server will use plaintext.
Almost nothing uses plain HTTP. The only thing I typically see is my phone’s internet connectivity check, which simply returns an HTTP 204 (No content). It’s practically a ping.
HTTPS + DoH is enough because all of these problems are solved.