9

How paranoid do I need to be about allowing my phone to connect to open/unencrypted WiFi hotspots?

I don't really care if other people see my data (email being received or sent, stock quotes, whatever). I think all I really care about is whether they see my passwords (Gmail, Facebook, etc).

I understand I probably don't want to initiate a connection to a financial institution, and that I'm potentially subject to man-in-the-middle attacks even if my passwords aren't cleartext.

Please note that I am aware of this question and its answer, and it doesn't really answer my question because it's just about the data: What Android sync'd data is encrypted?

If this question has already been asked and answered, please point me to it. I searched with the built-in engine and Google and couldn't find it.

Improve this question
2
  • 1
    If you're concerned about twitter at all, I know that Touiteur has an option to always use an SSL connection, and it's one of the best clients anyways. (Full disclosure: I have recently flopped between Touiteur and Tweetcaster due to small bugs in both)
    – Matthew Read
    Dec 14, 2010 at 23:07
  • Basically yes, you should be paranoid. I really wish there were a simple way to encrypt all the phone's traffic: android.stackexchange.com/q/2962/693
    – endolith
    Jul 28, 2012 at 0:32

2 Answers 2

Reset to default
7

If you use the Android web browser to access any sites that you've logged into and that don't use an SSL encrypted page while you're browsing them, then you should be very paranoid.

Have a read up about the Firesheep add-on to Firefox, it uses the fact that on an open, unencrypted Wifi connection anyone can listen to anyone else who is connected's network traffic. It listens out for cookies that other people's laptops and phones send out while they're browsing, grabs those cookies and lets you use them to log into a vast list of websites as that person. It doesn't need to capture login names or passwords, so it doesn't matter if you're careful about not entering your password into anything over an open connection. All it needs is your cookie and then it can log someone else into your Facebook, or GMail, or Twitter, Amazon (they can even place One-Click orders on your behalf) etc. BoingBoing has slightly more on what this demonstrates about web security.

The scary thing is that Firesheep doesn't do anything magic. It just makes a process that anyone could do (listening to open WiFi traffic, and spotting the interesting bits) and makes it one-click easy.

Improve this answer
3
  • Very very interesting. I'd heard of Firesheep but didn't know what it did. But I would imagine that the Firesheep cookies are typically session cookies. Or even if they're not, most sites with some reasonable level of security make saved credentials expire periodically, say in 2 weeks. I'm not really concerned about someone in a coffee shop posting some stupid Facebook status for me. I'm concerned about hackers selling my accounts, which requires transferrable credentials with some level of durability. Or am I missing something?
    – Paul
    Dec 15, 2010 at 4:30
  • @Paul You're right that this only gives the attacker access to your session, if you're aware of this and not worried about Facebook spoofing then OK. However web mail is one thing you're missing. Temporary access to that is incredibly useful for an attacker. When you register for websites your logins are often emailed to you, that's very easy to search for in someone's email. Or an attacker can go to various sites and click the "Forgot password" button to get the password emailed to the account they can now access. For longer term access they can set up a rule that forwards all mail onto them.
    – GAThrawn
    Dec 15, 2010 at 10:49
  • Mmmm. Thanks. Security is so complex sometimes. Still, the bar is now much higher for them. Few sites with reasonable security are going to email them the actual password; instead they will reset it, at which point I will see something is broken. Also, I can see the forwarding rule. I just want to be secure enough that people steal from somewhere else instead of hacking me. It sounds to me like my usage is sufficient to meet that criterion, although I could be wrong.
    – Paul
    Feb 4, 2011 at 18:58
0

After investigating the question I linked above, I found the following page (translating from Germain), where the authors determined that the majority of common Android apps they tested did not send passwords in the cleartext: http://www.heise.de/mobil/artikel/Sicherheit-von-Apps-fuer-Android-und-iPhone-1103681.html?artikelseite=6

Turns out this isn't as helpful as GAThrawn's answer above; I didn't understand the full ramifications of cookies.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .