The new forums will be named Coin Return (based on the most recent vote)! You can check on the status and timeline of the transition to the new forums here.
The Guiding Principles and New Rules document is now in effect.
How secure is unsecured Wifi?
Synthetic Orange
Registered User regular
Registered User regular
So for the moment, I have to use an unsecured wifi network. Hardly ideal, but it's the only option I have. A few things are worrying me, so I need advice on how paranoid I should be. Running XP, Opera for browsing and Firefox for banking, etc.
1- Internet banking. Right, my bank has their net banking with https and that, so is this safe? I've been avoiding doing this since noticing the next problem.
2- scary unannounced programs and links mysteriously popping up in my 'Network Neighbourhood'.
Right. This is the one I'm freaking out over. I've run Spybot, AVG repeatedly, with nothing coming up. Yet occasionally, I'll see new links pop up in my Network Neighbourhood going to other computers. And when shutting down, I'll see 'Ending program (hash of chinese and cyrilic symbols) before it shuts down. As the computer's shutting down, I cant grab a screenshot of this.
So, uh, what should I do?
1- Internet banking. Right, my bank has their net banking with https and that, so is this safe? I've been avoiding doing this since noticing the next problem.
2- scary unannounced programs and links mysteriously popping up in my 'Network Neighbourhood'.
Right. This is the one I'm freaking out over. I've run Spybot, AVG repeatedly, with nothing coming up. Yet occasionally, I'll see new links pop up in my Network Neighbourhood going to other computers. And when shutting down, I'll see 'Ending program (hash of chinese and cyrilic symbols) before it shuts down. As the computer's shutting down, I cant grab a screenshot of this.
So, uh, what should I do?
Synthetic Orange on
0
Posts
HTTPS, SSL encrypted, web connections are for all intents and purposes unbreakable. However if your computer were compromised (say, with a keylogger) it might be possible to pick up any passwords you enter on your keyboard. And depending on the version and patch state of your copy of Windows, your computer may be secure or it may not be.
That's pretty alarming. Do you have a software firewall? How about antivirus protection? Anti-spyware?
Install a free antivirus program (Avast! or AVG) if you don't have one; turn on Windows Firewall, and install Windows Defender. if you don't have an anti-spyware program.
the "no true scotch man" fallacy.
water spirals the wrong way out the sink
Of course, when I restarted the computer to finish NOD32's installation that mysterious program pops up again!
I was under the distinct impression that SSL was extremely secure, irregardless of the method of transmission. That wiki link wasn't particularly helpful either, and even the SSL wiki page mentions that there is protection against MITM attacks.
To the OP, I'd say just go for it, barring a whole lot of misinformation on my part. I wouldn't suggest doing it all the time, but if you just need to visit your banking page a few times through an unsecured internet connection, I'd say your odds of getting hit by a car while physically visiting your bank are much higher than your SSL connection getting detected, cracked, and your bank account accessed by someone.
I wouldn't recommend doing your banking on open networks like that, but you're pretty safe once your SSL session is set up.
B.net: Kusanku
The biggest worry about unsecure wifi is people stealing your internet connection. And any creepy shit people do on your connection can blow back on you. I know plenty of people who have gotten dropped by their ISP or capped speeds because people were raping their bandwidth over wifi.
You can't use a man-in-the-middle attack against an SSL website unless you can do one of two things:
- Somehow add a root CA to the victim's PC. This depends on the victim's PC being compromised.
or
- Convince them to ignore the conspicuous SSL certificate error they will receive when they browse to a site using SSL that you are hijacking the connection to/from.
That having been said, it is really unwise to have an unsecured WiFi connection at home. What nexuscrawler said is 100% true. Also, because the "LAN" (which is not really "local" because it includes your anonymous neighbours) is open, you are vulnerable every time a new Windows flaw is published.
http://www.thelostworlds.net/
I was also afk so there might have been a warning or something, and it was a while ago, but can't other people do shit like this also?
As Feral mentions, the SSL connection is relatively secure. Even if someone was sniffing packets on your local LAN (by connecting to your unsecured wireless access point while you were banking; practically-speaking it's probably much harder to attempt to sniff another user's traffic by connecting to the same AP than it is to just sniff it over the air), they wouldn't be able to see the contents of the encrypted SSL session.
However, if at the same time your machine has been comprimised by malware, well all bets are off, as the malware could potentially appear or give the same viewpoint as you as the user sitting at the keyboard.
That's not unexpected. Other Windows computer connecting to your unsecured access point. Many computers (and some other devices) will offer, or automatically associate with the nearest available (I think this was the default behavior for XP prior to one of the Service Packs). They'd announce themselves on the network by default.
Might be malware, but could just as likely be a misbehaving bit of software with a damaged or buggy dialog box. IDing the misbehaving bit of software really needs to be done to resolve that. Have you checked the Windows Event Log to see if anything relevant is contained there? It might help you locate the misbehaving program.
Warning, heh, yeah right.
Does he know your computer's name on the network along with an administrator user name and password for it? That will get him access if he's on the network.
Do you have a password on your account and the local Administrator account? Because if you don't, then yeah, pretty much anyone can do that.
http://www.thelostworlds.net/
Sorry, but I must point out that it's "regardless".
The entire point of SSL, and indeed cryptography in general, is to establish secure communications over an insecure channel. If somebody's using SSL to talk to their bank, it doesn't matter whether they're sending packets over a wire, by radio, or by shouting to a friend across a crowded room.
What's more worrisome about wireless networks for Windows boxes is open ports. If you're using a decent software firewall (even XP's built-in one is good enough) this isn't a problem. If you're not running a firewall, you are also probably not up-to-date on the latest patches, and sooner or later somebody will put a keylogger on your laptop.
He is my best friend and a real computer wiz in ways that I am not. He was the guy who set up all the passwords and everything for me. Even other shit like remote desktop to work with my other oldie computers. But yeah, he had all the passwords, identification numbers, etc. Hell, if he wanted to, he could probably get into my own router and disable my computers.
EDIT: Oh, and he actually sneaked in the movie, "The Untouchables" sometime after that, a file that was 997Megabytes.
And so you think there's a problem WHY?. He's essentially your sysadmin, and owns all your shit.
Convincing someone to click away those error messages is not hard, usually they convince themselves, the novice windows user is used to clicking at error messages until they go away and let them do what they were attempting in the first place. Plus, I am pretty sure IE 6 does not actually pop up an error in a dialog when this happens.
Yes, it does. It will tell you there is a problem with the certificate. IE7 makes it even more visible by taking you to an ominous-looking page recommending that you do not continue, and if you do continue the entire address bar turns red.
Anyway, what you're describing isn't a weakness in SSL, it's a weakness in the knowledge of a hypothetical person using a web browser.
http://www.thelostworlds.net/
I dont know why I didnt think of this before. Just grabbed a shot of it with my camera.
It doesnt appear unless I connect to the net for an extended amount of time. I'm still getting nothing on Spybot or AVG despite updating. Should I just reinstall Windows?
Do you have itunes running or crashed while your shutting down? itunes throws up an error like that if you try to reboot before its completely shut down, or if it crashed and you try to shut down.
Check out my band, click the banner.