Equipped To Survive Equipped To Survive® Presents
The Survival Forum
Where do you want to go on ETS?

Page 3 of 4 < 1 2 3 4 >
Topic Options
#276359 - 08/25/15 10:33 PM Re: Security using public wifi? [Re: chaosmagnet]
haertig Offline
Pooh-Bah

Registered: 03/13/05
Posts: 2322
Loc: Colorado
Originally Posted By: chaosmagnet
I don't entirely agree with benjammin.

Nor do I (no offense intended benjammin!)

There is a concept of "reasonably secure". For example, it is possible that I could be attacked by a shark here in Colorado. We could have a "Shardnado". But am I going to stay inside for the rest of my life because I'm worried about the possibility?

If you are using good encryption, there really isn't much to worry about. Yes, the NSA could probably hack you if they specifically targeted you and went to great expense and effort to do so. But you're more likely to run into a thief who would crack you over the head with a baseball bat and just take your silly computer from you, along with all the data it contains.

Personally, when using a WiFi hotspot (which is very rare for me), I VPN into my home network and then bounce out onto the internet-at-large from there. But setting up a VPN on your home router or other server is not for a computer lightweight or newbie.

Just about as secure, and an order of magnitude easier, is setting up an "SSH tunnel". Of course, that implies you know how to set up an SSH server on your home network. Again, not really for a computer lightweight.

My advice? If you wouldn't scream out everything you are typing to a crowd, don't send it over a WiFi connected web browser unless you are 100% sure you are connected using HTTPS (a little lock icon appears on most/all web browsers to indicate this type of connection). And even then, I wouldn't do something sensitive like banking or your online taxes over a public WiFi connection, even if HTTPS. Is it really that critical that you access your bank from Starbucks that it can't wait until you get home?

As far as trusting encryption provided by web file hosting or cloud services, I would never trust that. Of course they will tell you that they are ultimately secure. I'm sure that's what "Ashley Madison" told their customers too! I would only encrypt files locally, then send them up. if the hosting service wants to re-encrypt them, that's all well and good, but the salient point is that I controlled my own encryption and didn't rely on them. Note that doing things the way I recommend means that you cannot easily "share" your stuff between devices using the cloud. Each device would have to be set up to do it's own decryption (YOUR decryption, not the cloud hosting company's decryption). The solution to this is to set up your own personal cloud, controlling that with your own encryption. But we're back to "not for the computer lightweight" again, with that suggestion.

Top
#276363 - 08/26/15 07:20 AM Re: Security using public wifi? [Re: haertig]
Phaedrus Offline
Carpal Tunnel

Registered: 04/28/10
Posts: 3148
Loc: Big Sky Country
Originally Posted By: haertig


As far as trusting encryption provided by web file hosting or cloud services, I would never trust that. Of course they will tell you that they are ultimately secure. I'm sure that's what "Ashley Madison" told their customers too! I would only encrypt files locally, then send them up. if the hosting service wants to re-encrypt them, that's all well and good, but the salient point is that I controlled my own encryption and didn't rely on them.


Of course, the bigger problem is that you can't really trust the info sec of your bank, the IRS, etc. I think we've seen that information security is in danger of becoming security theater. The internet as we know it was never designed with security in mind. Really it was never designed with any inkling that it would become what it now is. It's like a huge tent that you only intended to spend a week in; then you build on again and again until your tent is big enough to host a circus in. But no matter how big it gets it's still a tent! And how you lock the a tent?

According to the government as many as 1/3 of Americans SS #s have been exposed! eek That's maybe 100,000,000 people in the US alone! And how many retailers have lost the CC numbers of 40 or 50 million customers?

I'll tell you what's really scary, to me at least- biometrics. Because for it to work your input must be compared to a db somewhere that has your vital statistics. And if your SS# is compromised you can get a new one. But how do you get a new retina or fingerprint?

At some point when we move from IPv4 to IPv6 we need to enhance the security infrastructure of the entire net. But it's not like remodeling a house while you live in it; it's more like remodeling a spaceship while you're en route to Mars! Pretty hard to shut it down long enough to make the changes we need to make.
_________________________
“I'd rather have questions that cannot be answered than answers that can't be questioned.” —Richard Feynman

Top
#276367 - 08/27/15 02:48 AM Re: Security using public wifi? [Re: haertig]
benjammin Offline
Rapscallion
Carpal Tunnel

Registered: 02/06/04
Posts: 4020
Loc: Anchorage AK
I'm not offended, but y'all say you disagree with me, then go on to basically support my point. Not a problem, we just have different ways of delivering the same message I guess.

Work under the assumption that there is no real security. Then you can prepare for if/when your security really is compromised.

It's like why I carry a concealed weapon. Chances are I will never have to use it to defend myself. Odds are that my lifestyle will preclude me from those sort of confrontations. I don't hide in my house to avoid crime, but I plan and take reasonable precautions because it is always a possibility. I take the same view about using the internet for anything. I still do business on the internet, including accessing public Wi-Fi connections and using mobile devices. I assume I have been/will be hacked somewhere along the line, so like y'all, I've taken steps to insure that no real damage could be done. Since I am not as tech-savvy as others, my methods for mitigation are to control the source more than the method. Hackers probably won't have a hard time accessing my info, but it also won't benefit them much either if they do. Seems like the easier route for me. YMMV.

We may not agree on the approach, but the objectives are similar. Making it not worth the bad guy's effort to come after us is good strategy.
_________________________
The ultimate result of shielding men from the effects of folly is to fill the world with fools.
-- Herbert Spencer, English Philosopher (1820-1903)

Top
#276369 - 08/27/15 03:51 AM Re: Security using public wifi? [Re: Phaedrus]
Mark_R Offline
Old Hand

Registered: 05/29/10
Posts: 863
Loc: Southern California
My .02...
1) A WiFi network is only as secure as it was setup to be. As a general rule of thumb, public WiFi is not secure.

2a) The next generation of security is not going to be biometrics. It's two factor authentication. In addition to your username and static password, a second, changing, password is required. Microsoft offers an app with a code that changes every 30 seconds, Google will text you a one-time-use code. It all but eliminates brute force attacks, and unless someone is very very clever, requires physical access.

2b) With the recent SCOTUS ruling regarding compelling alphanumeric passwords (warrant needed) vs biometrics as passwords (no warrant needed), the industry is going to be very shy about biometric passwords.

3) Regardless of the connection to the net, anything more complicated then a basic cell phone is going to require antivirus. And, if used for two factor authentication, the ability to remote erase the memory.

4) Either don't store anything valuable on a mobile device, or encrypt the drive. Systems like the IronKey flash drives, with self destruct capabilities, are about as good as you're going to get for mobile memory.

5) There's not a flipping thing you can about somebody else's infosec. Operate on the assumption that they will be hacked. Encrypt whenever possible.
_________________________
Hope for the best and prepare for the worst.

The object in life is not to be on the side of the majority, but to escape finding oneself in the ranks of the insane

Top
#276389 - 08/28/15 02:52 AM Re: Security using public wifi? [Re: Bingley]
Bingley Offline
Veteran

Registered: 02/27/08
Posts: 1576
How complicated our modern life is! I have to back up my computer locally and on the cloud. Then I have to encrypt the computer, the local backup, and the cloud backup.

Then I have to encrypt the phone and the USB thumb drive. I have yet to look into how to back up the phone, too. And encrypt the backup.

Thanks for the reminder about mobile devices, Mark!

Top
#276406 - 08/28/15 11:07 PM Re: Security using public wifi? [Re: Bingley]
ireckon Offline
Pooh-Bah

Registered: 04/01/10
Posts: 1629
Loc: Northern California
I used to backup my computers on a cloud backup service. However, the concept never sat right with me. What if I have no wifi to recover the backup? What if the corporation hosting the online backup suddenly closes its doors? What if their servers are damaged? Where are the servers that have my data anyway? What if their encryption algorithm malfunctions when I need to recover?

So, I currently use a combination of Dropbox and local real-time backup. I know Dropbox is not that secure, but the convenience outweighs the lack of security for me. Also, I encrypt sensitive data before it's uploaded to the Dropbox servers. With Dropbox, all three of my computers have the same data in real-time. Thus, each of the three computers and Dropbox is a backup.

Further, I run a dedicated local backup that goes to an external hard drive by using the simple Yadis Backup program. It makes a real-time mirror backup with versioning. The whole system works so smoothly that I don't even notice it until I need a recovery.
_________________________
If you're reading this, it's too late.

Top
#276417 - 08/29/15 04:24 PM Re: Security using public wifi? [Re: Bingley]
chaosmagnet Offline
Sheriff
Carpal Tunnel

Registered: 12/03/09
Posts: 3819
Loc: USA
ireckon's plan is well-thought-out and sounds good for his needs.

In addition to a cloud backup I take full image backups onto local storage. I figure the chances of there being a disaster that takes out the cloud backup service, my computer, and my local backup more-or-less simultaneously will leave me caring a lot less about my data.

Top
#276424 - 08/29/15 10:07 PM Re: Security using public wifi? [Re: chaosmagnet]
Bingley Offline
Veteran

Registered: 02/27/08
Posts: 1576
Originally Posted By: chaosmagnet
I figure the chances of there being a disaster that takes out the cloud backup service, my computer, and my local backup more-or-less simultaneously will leave me caring a lot less about my data.


That's what the last dinosaur said! laugh

Thanks for the ideas, ireckon and chaos. I, too, have a local backup in addition to cloud. I'm making it a project to be better and more organized about my electronic data.

Also, it appears my employer provides VPN. So I can use that while accessing this forum while enjoying my coffee and wifi at a cafe. I haven't started, though, unsecure me...

Top
#276435 - 08/30/15 05:05 PM Re: Security using public wifi? [Re: Phaedrus]
haertig Offline
Pooh-Bah

Registered: 03/13/05
Posts: 2322
Loc: Colorado
Originally Posted By: Phaedrus
Of course, the bigger problem is that you can't really trust the info sec of your bank, the IRS, etc.

That is very true.

Many people worry about theft of information in transit to it's intended destination. The "unsecured WiFi" angle. While there is potential for theft there, the bigger potential is AFTER it's reached it's destination. And it doesn't matter what route your data took to get to that final destination - over WiFi, sent in a physical letter, faxed, communicated over the phone. All these big hacks you read about almost daily are not intercepting data from unsecured WiFi connections. They are hacking into the final destination servers and stealing entire databases of many peoples data. And if that final destination database is not well encrypted and protected, you're hosed. Doesn't matter if your data got into the database via WiFi, or from you sitting at a desk with a loan consultant at your bank typing it in on their hardwire connected desktop computer.

Top
#276438 - 08/30/15 06:12 PM Re: Security using public wifi? [Re: Bingley]
Eugene Offline
Carpal Tunnel

Registered: 12/26/02
Posts: 2995
Thats where you can minimize the destinations. I went a few years ago and consolidated and closed down accounts at various places so my data is held by fewer destinations. I kept two banks and closed out all those credit cards and such at the others. Now instead of 10 different banks having my current information only two do. I now only have to connect to two to get statements, pay bills, etc.

Top
Page 3 of 4 < 1 2 3 4 >



Moderator:  Alan_Romania, Blast, chaosmagnet, cliff 
March
Su M Tu W Th F Sa
1 2
3 4 5 6 7 8 9
10 11 12 13 14 15 16
17 18 19 20 21 22 23
24 25 26 27 28 29 30
31
Who's Online
0 registered (), 269 Guests and 21 Spiders online.
Key: Admin, Global Mod, Mod
Newest Members
GallenR, Jeebo, NicholasMarshall, Yadav, BenFoakes
5367 Registered Users
Newest Posts
What did you do today to prepare?
by dougwalkabout
Yesterday at 11:21 PM
Zippo Butane Inserts
by dougwalkabout
Yesterday at 11:11 PM
Question about a "Backyard Mutitool"
by Ren
03/17/24 01:00 AM
Problem in my WhatsApp configuration
by Chisel
03/09/24 01:55 PM
New Madrid Seismic Zone
by Jeanette_Isabelle
03/04/24 02:44 PM
EDC Reduction
by EchoingLaugh
03/02/24 04:12 PM
Using a Compass Without a Map
by KenK
02/28/24 12:22 AM
Newest Images
Tiny knife / wrench
Handmade knives
2"x2" Glass Signal Mirror, Retroreflective Mesh
Trade School Tool Kit
My Pocket Kit
Glossary
Test

WARNING & DISCLAIMER: SELECT AND USE OUTDOORS AND SURVIVAL EQUIPMENT, SUPPLIES AND TECHNIQUES AT YOUR OWN RISK. Information posted on this forum is not reviewed for accuracy and may not be reliable, use at your own risk. Please review the full WARNING & DISCLAIMER about information on this site.