718
cross-posted from: https://slrpnk.net/post/25779751
The intative promises to be privacy-friendly with no tracking. Stating:
Your privacy is important. The WiFi4EU app ensures a private online experience with no tracking or data collection. Simply connect and enjoy free public Wi-Fi without concerns.
Source: https://digital-strategy.ec.europa.eu/en/policies/wifi4eu-citizens
Will be interesting to see how this spans and plays out in reality. Looks promising too, did a quick scan of their builtin permissions and trackers and looks good too. (Scanning tool is called Exodus)
oh dude, they promised to be privacy friendly! maybe I'm just too american to believe in promises.
You don't have to trust them any more than you trust your local Starbucks WiFi. We're at the point where your traffic should no longer be vulnerable just because you're on the wrong WiFi network.
I feel like the OP you're responding to. Explain how I should be comfortable? The idea creeps me out, but I admit I haven't delved into security for a few years.
HTTPS is used on virtually every site out there these days. That is used to encrypt your traffic from the get go. So specifics of the traffic/request won't be obvious/known. The EU could be big enough to force manufacturers to inject their certificates into devices... could be a man in the middle attack. But you can always just remove certs you don't trust from your devices.
DNS by default is often plaintext. You can setup your device to use DoH or other encrypted versions of DNS.
That leaves just the raw connection analysis... eg, that your device is sending traffic to some known IP... many site share hosts so that can be hard to determine though often not really... Proxy or VPN services can make it impossible to do this type of analysis... but then those services will be able to tell.
Ultimately being able to say that "Shalafi sent some packets to an IP that google owns and received a bunch back" could be email... could be youtube... could be any number of things... at some point it become educated guess at best. And what specifically happened (ex: Watched a video about tying shoes) is simply unknown. It would take a bunch of external additional data to actually tie you to anything directly, eg server logs or other sources... which usually means more than one party is already working together against you. At that point you've got bigger issues usually.
You don't HAVE to be comfortable. But if you use any sort of public WiFi, this is no riskier than any of those networks. They can grab some metadata unless you use a VPN, but likely less than what your ISP already has on you anyway. Basically, there's no reason this should be putting up any major red flags. We're past the days when a malicious access point could MitM most connections due to lack of encryption.
Every site uses HTTPS which encrypts your data in transit. Even if they sniff the packets, they would spend literal decades trying to decrypt it.
Just be wary of visiting sites or sending traffic not over HTTPS. Its rare, but it does happen.
What the others said. If you want a practical example of this working, have a look at eduroam. It's the joint WiFi of all European universities and I cannot recall that there ever were any privacy issues.
My traffic is not vulnerable, but my device might be.
When you connect to public WiFi, you also share it with others, and maybe someone on that network wants to test out their new hacker skills ?
Maybe not as much of a problem for phones, but that juicy developer laptop running unauthenticated MongoDB with a dump of the production database.. yup, that now “mine”.
Ideally all those services should be listening on 127.0.0.1 / ::1, but everybody makes mistakes. Maybe the service comes preconfigured to listen on 0.0.0.0.
Just keep your firewall set to public network and you will most likely be fine.
Anything can be hacked, even on your private home network.
Again, people make mistakes, so they may think the firewall is on, but that one time 3 weeks ago when they were debugging something and they turned off the firewall for it, yeah, we never got around to enabling it again.
Also, my home network is a lot more secure by default than shared public WiFi. At home I have decent control over who and what connects. Sure, people could in theory crack my WiFi password, but the risk of that is low compared to sitting on public WiFi.
Nothing we can do to prevent that, unless we want to turn all laptops into walled gardens. PEBKAC is not the fault of the WiFi network.
I mean, we could switch to Linux distros (so that you can fine-tune DNS and VPN settings without corporate BS), but the intricacies that introduces to connecting to the WiFi safely are not casual in scope. Most people are better off buying a lightly-used Mac (or not, it's been a while since people have been happy with Apple) or replacing their laptop with a Fairphone or Graphene OS phone than switching to Linux from Windows 10.
Windows 11+ however... is another story. Anything but letting the IngSoc Smart TV become the OS. The issue is that computers come bundled with Windows and so they use "Secure Boot" to trap you. You can't use Secure Boot without Windows, and you can't play many online games if you do not have Secure Boot (even if the excuse as to why is a filthy lie) so if you're gaming you basically have to hope that Steam OS triumphs.
Best option is to just go to places where the wifi service is affordable but not free so that the operator needs to keep tabs on whether users are doing something other than browsing the internet or playing games (i.e. stealing people's info or putting malware on their machine). Unfortunately, there doesn't seem to be any great demand for internet cafes anymore in my location.
Someone runs MongoDB unauthenticated, bound on 0.0.0.0 with production data, on a computer without a VPN, and the problem is the WiFi?
Like I get what you are saying, but this sounds like saying that we should ban speedbumps because imagine there is a guy with a loaded gun pointed at a kid with no safe, finger on the trigger, and high on coke, if the car hits the speedbump the toddler is gone. Yeah, but I would hardly say the speedump is the issue.
I don't really trust that either
That's the point, you don't have to. The system works on the assumption that the AP is untrusted.
Been that way since https became common
How do we know intelligence agencies are not in collusion with certificate authorities though? What if they actually have access to ROOT CA private keys and can just automatically strip https from most of the traffic in their mass surveillance software? This is something I found with a very quick search: https://en.wikipedia.org/wiki/DigiNotar
Yeah sure but defending against nation state intelligence agencies is a thread model few people have. It's also not really realistic unless you go to paranoia level mitigations.
The EU is almost just as bad, I know the bar is high compared to the US, but still.
There are tons of things the EU is doing well, dude.
From resisting the technocapitalist rethoric of the US, to standing up against imperial bullies like Russia.
I'm not saying it is perfect, nothing is. But sometimes it feels like the EU is the only reasonable beacon in a sea of corruption.
LOL 'dude'
The EU just bent over to get fucked by US tarrifs.
They shouldn't worry about Russia as much as they should about US imperialism that causes all the trouble.
But these sell outs will gladly suffer as good obedient vasals. 🤡
The EU only cares about blocking the private sector from getting their citizen's data. They actively harm privacy when it's about government access
That's why audits exist