Ask Jack: How can I use airport and hotel wifi safely?

Why are all the free wifi services offered by hotels and airports etc unsecured?

Why are all the free wifi services offered by hotels and airports etc unsecured? I scan networks with AVG and then use TunnelBear’s VPN (virtual private network) whenever I want to use them for anything other than checking weather or news. Steve

There’s often a trade-off between security, convenience and cost. This doesn’t just apply to wireless hotspots but to houses, cars and other things.

You could make your house more secure by adding deadlocks to all the doors, putting bars over the windows, and installing floodlights, burglar alarms and security cameras. However, it would be expensive, and it would make life less convenient. It also wouldn’t make your house impregnable: an army would just blow the doors off.

Real security choices actually depend on two other things: the value of what you’re protecting, and the perceived risk. For example, you’d expect a jewellery shop to spend more on security than, say, a patisserie. The question is not how much security you can get, but how much you need.

Airport hotspots etc

When it comes to airport, hotel and similar hotspots, convenience rules. Both the suppliers and the users want their networks to be as easy to use as possible. Anything that would require IT support is an anathema because support is expensive and there are no long-term benefits.

In general, the perceived value of hotspot communications is low, and that applies to both the traffic and the customers. First, hotspot users are mostly checking the weather, or news, or posting social media updates rather than, for example, trading stocks and shares or exchanging sensitive medical information. The perceived value of the traffic is low.

Second, hotspot users are generally transitory. It may be months or years before they use the same hotspot again, if ever. The perceived value of the customer is therefore low.

Third, there are millions of hotspots, and hundreds of millions of people use them. How often do people get hacked – or at least, how often do they know they’ve been hacked? I don’t have any numbers, but I don’t even have any anecdotal evidence. The perceived risk is low.

Under the circumstances, I don’t expect airports, hotels, coffee shops and other hotspots to invest in better security. People who want or need better security will have to provide it themselves, as you do with TunnelBear.

Minimising risk

Like jewellers, people should pay more attention to security if they have more to lose. That includes activists, politicians, diplomats, some journalists, and people with sensitive commercial or industrial information. Frequent users should also be more careful than casual users. I’d take more precautions if working from the same coffee shop for several hours a day than if using it for 10 minutes in passing.

You should obviously make sure your PC’s security patches are up-to-date, and have anti-malware software and a firewall in place.

For extra security, turn off file and printer sharing: open file-sharing could allow a hacker to put malware on your computer. Also, turn off both wifi and Bluetooth when you are not using them: they allow you to be tracked.

Worse, smartphones and laptops may connect automatically to any available networks, including rogue and ad hoc networks running on nearby laptops. It’s therefore important to know each hotspot’s exact name before you try to connect. If not, you may log on to an “evil twin” network with a similar name, which someone has set up to collect names and passwords.

Otherwise, the best defence is to have nothing to lose. This has become much easier nowadays. Thanks to the cloud, very few people need to keep sensitive information on a laptop. It can be backed up in multiple places and accessed from almost anywhere.

If you are travelling, you can reset Windows 10 to factory condition very quickly, then sign on with an empty Microsoft account by creating a new email address at outlook.com. Your laptop now contains no personal information. When you arrive at your destination, you can log on to your “real” account. If you need any sensitive information on the trip, you can get it from a cloud service such as Dropbox, or stow it as a heavily encrypted blob on an anonymous file sharing site.

When you get home, you can reset your laptop back to factory condition then restore your old data from a backup.

Safer hotspots

The riskiest hotspots have no security at all. Obviously, it’s best not to use them if there’s an alternative, but you can use them with a VPN or by only accessing sites that provide secure https not http connections. The EFF’s browser extension HTTPS Everywhere makes this easier.

Nowadays, most hotspot names appear with a lock symbol next to them, which means you need a password to log on. Home and office networks work like this. All networks should now be using WPA2 wireless protected access security not WPA, WEP or WPS.

Airport, hotel and coffee shop networks are not necessarily unsecured: most of them now use web-based security, where you sign in via a web page. These networks should be safe enough if you use https encrypted communications, but even with a VPN, you are at some risk because your initial connection to the web page is unsecured.

For this reason, it’s a good idea to shut down all web browsers and email programs before you turn wifi on. Browsers and other programs may try to download new data as soon as they see an internet connection, which could expose personal information.

Using a VPN

In the early days of computing, corporate computers were often connected by dedicated private lines. Today, they connect over the open internet using a VPN or “virtual private network”. In other words, all the communications between your PC or smartphone and the VPN supplier are encrypted so that nobody else can read them. It’s like having your own line.

Browser-based VPNs have been popular for some time, thanks partly to the marketing efforts behind products such as Hotspot Shield. More recently, Opera has added a VPN to its browser. The consensus seems to be that, unlike the free ad-supported Hotspot Shield, it’s a remote proxy rather than a “proper” VPN. However, it’s still better than nothing.

A VPN like TunnelBear works at the system level, so that everything gets encrypted, not just browser traffic.

In either case, there are two problems. First, you are moving trust from the hotspot provider to the VPN provider. Your usage data could still be tracked and sold to third parties. Second, once your communications leave the VPN server, they’re back on the open internet, so you still need https (SSL/TLS) as well.