How do you practice safe public wifi access?

What methods and/or tools do you employ to stay safe while using the internet from a public wifi connection?

Image via Unsplash

Comments

[Sony AK]

To stay safe is just not using public wifi connection. If you have to just use it for general browsing purpose, not for login with your crendential to any website. Better use your phone data package if available :)

[Bradley D. Thornton]

I don't care much for ad hominem, and can't understand why someone would be so incalcitrant about something as simple as a three string install invocation, producing a working, running instance of BIND, and then just a couple of configs like pointing your resolver to that daemon and placing something like search . on top in your /etc/resolve.conf because it really can be that simple to make such a huge difference in the autonomy that you'll enjoy - let alone safety.

This is simply what you do, or it was for decades, without even thinking twice. Why that tends to elude many folks completely escapes me - why wouldn't someone do this?

And Diane's suggestion of incorporating Dnsmasq is just a lighter weight version of that.

I simply do not find it plausible that a couple of sysadmins were unable to just whup it out in the course of yawning with half their brain tied behind their back.

These simple basics just aren't given adequate coverage in curriculum during this culture of containerization.

Heck, we've only been using DNS since 1985.

The question that the OP asked was about securing ones communications over public WiFi. It may not be what everyone should do (as one person dismissed), although it is indeed something that everyone should consider.

Here's a little litmus test:

The next time you (the proverbial you, no one in particular here) happen into a large, busy Starbucks, look around for that person, you'll see them. You're looking for someone who is inconspicuously conspicuous (maybe it's the blue mohawk; the safety pin through the nose; the anarchist laptop stickers; the pocket protector and Google glasses), and your spidey sense will tingle.

Now... Look at the room from their perspective...

Now tell me what you think you should be doing for your security :)

[Mikolaj Kubera]

VPN and a bunch of browser plugins (Privacy Badger, HTTPS Everywhere, an Adblocker).

[Keith Bremner]

I have a DigitalOcean droplet running WireGuard. Costs $5 per month.

I run the WireGuard client on all my devices set to auto connect to it on all SSIDs except my home network.

Pros:

• It auto connects seamlessly away from home.
• All traffic on all ports can be sent via my server.
• I get a known (and consistent) external IP address when I’m on VPN. Means that I can protect services I use and still access them when out and about.
• I have control of what the VPN server is logging.
• It’s much faster than OpenVPN and other solutions.

Cons:

• It’s on me to set up the VPN server and keep it secure.
• Because my IP external IP is consistent it could easily be traced back to me if big brother government wanted to find who it was.

[Trent Haynes]

I would love to find out more about this style of setup.

I personally use both Torguard and Windscribe VPN services.

[Keith Bremner]

This explains the steps pretty well:
ckn.io/blog/2017/11/14/wireguard-v...

[Matheus Zanetti]

Don't.

[Taylor Swift]

Https and firewall mostly. Also purevpn just to be extra safe

[Ali Mustufa Shaikh]

I Have made my own VPN using the outline and Google Cloud Platform. It works perfectly!

[Dāvis Naglis]

VPN.

[Talz Cloning]

with a traditional MITM attack aside from https of the websites you visits, you should install comprehensive internet security solution on your computer and always up to date.

[Ben Sinclair]

Like a couple of others, I'd like to say "I don't use public wifi" but the fact is that every now and then I have to.

The first thing I do is try to connect on a VPN. If there are any issues, like it not going through at all, I abandon the wifi channel and tell my device to forget the SSID. For instance, Virgin Trains will try to MITM so I'll put up with using intermittent 4G instead.