This is actually a pretty serious legit concern that I'm surprised we haven't seen a proper solution for.
I feel like there should be some sort of trusted certificates or other method to determine whether or not you can trust the access point and alert the user when they may be moving sensitive info over that network.
For a variety of reasons it doesn't really matter if you authenticate the hotspot if the rest of the traffic goes in the clear as unless you also do key exchange as part of the authentication and then use it for protecting your traffic someone could just forward the authentication to a real box and then take over or simply hijack your connection after you've authenticated. There is also the problem of wide deployments like coffee shops making it pretty easy to steal certificates.
WPA Enterprise / WPA2 Enterprise with PEAP (and several other flavors) includes a server certificate as part of the authentication process that you can validate before supplying your credentials. While it's not perfect, you can run public wifi with WPA2 Enterprise and just set the login to guest and a blank password (and say that in the ESSID). That allows anyone to connect but still allows them to authenticate the hotspot and have a fair level of protection from session snooping or hijacking.
Realistically future versions of 802.11 should use some type of system like that for unprotected connections, but they don't seem very interested.
Yea, EAP-TLS was one of the oldest EAP methods, and the client certificate is actually optional per the spec, though most supplicants require it (using a dummy cert is the workaround).
If a Van near the hotspot spoofs the network name running the equivalent of BlueCoat, even SSL traffic can be silently monitored or tampered with.
The problem is 99% of folks don't know how to setup a stunnel and the remaining 1% understand the performance implications of being paranoid all the time.
Hong Kong already does this. Practically all their pay phones are WiFi hotspots operated by PCCW. In fact, it's hard not too find a WiFi hotspot within 100m in Hong Kong.
"Mobile" phones come full circle. Cell tower coverage still isn't even sufficient for a lot of my use. Unless I'm at home or work, I almost never am in range of a wifi hotspot. I am very frequently not at home or work.
My employer has "roaming" wifi. I can walk around, change floors, change buildings and not lose connection. I don't know how they do it. It's very cool.
Compared to... I was contracting at AT&T Wireless for a few months. Worst enterprise IT I've experienced. Getting a desk phone to work was near impossible. No one could access their voicemail. No voicemail - email bridge. The in-house chat/voice conferencing didn't work (stutter, dropped connections, couldn't login). You'd lose wifi connection walking down the hall, requiring full reauthentication for everything (signin, VPN, db connections, etc).
Random event: I just walked by one of these (Grand Central-UN area) on my way to the library today and said "Wow. I wonder why I didn't hear about this before...or see it before?" So I started looking for other payphones/WiFi-stations and didn't see one.
I wonder if hotels, and other businesses that want to attract taxi
drivers awaiting fares, will push to convert nearby pay phones to
WiFi, thinking drivers might prefer to wait near a WiFi hotspot.
I always wondered why telcos haven't made a business model out of this. It is too late now that 3g/4g is pervasive and fast enough, but for a period of about 7-8 years they could so easily have wired DSL to all those idle pay phones around the city and I would easily have paid $10/month (or more) to have Wifi connectivity when I was out and about.
I remember in 2000 or 2001 a company in Chicago negotiated with Ameritech to put hotspots on the top of telephone poles around the city for something like $3/mo. The deal ended up falling through... I think too many parties had to get involved that it just became a nightmare to deal with.
I'm wondering what some of the legal consequences would be if a project like that were implemented in Europe.
In Germany (and other countries), if you as a private person do not secure your wi-fi, and someone else piggybacks on it to do something illegal (say, download pirated data) you are liable.
What is the situation in the states? If the legal situation is similar, does it make a difference if the open wi-fi is provided by a city rather than a private person? Obviously it wouldn't be piggybacking when the free wi-fi is intended to be used by others, I wonder if that makes a difference. Also, could ToS be used to avoid the liability issue for a city?
Also, in the EU, ISPs are required to store the connection data of all customers for six months. Would a city that provides free wi-fi be considered an ISP and thus have to store all connection data too?
... while the bikers attempting to use the bike lanes get ticketed for riding in the street when a bike lane was available. (yes, this does happen, despite the law saying that a biker can leave the bike lane if an obstruction makes it unsafe to ride within it)
If people like the government setting up wi-fi hotspots, would people be open to sharing their wi-fi hotspots (securely) for the chance to roam across other wi-fi hotspots? As in, blanket the city in a grass roots network.
Love to see cities that care about their users..er citizens.
I don't get the 'free' bit. I mean a pay phone was just that an opportunity to plug into the communication network for money, why not a 'pay hotspot' ? Now I could see that NYC could create a token system which would make using a licensed paid hot spot practical, but don't see what they are trying to achieve with free access here.
I don't see what they are trying to achieve with free access here.
Probably the same thing they're trying to achieve with free streets, trees, parks, and so on: making the city more livable for those that pay taxes there. (And trust me, we pay a lot of taxes.)
Fair enough, I think you can make a reasonable argument that network communication is a basic city service like sewers and sidewalks, so why wouldn't that argument also require a taxpayer funded phone service? If you go the whole basic service argument then not only do you provide a wifi hotspot but you also provide a way for someone to browse the web, send and receive email, and maybe chat at these same kiosks. If you don't provide that then you run into the social justice argument that you are discriminating against the poor who can't afford a smartphone or laptop to hop onto the 'free' WiFi in favor of the rich. Whereas if you charge for the access and dump that money into the general fund (after expenses of course) then its a service fee that achieves a socially acceptable taxation of people with more disposable income to provide services to those without. So do you see my confusion?
All I can tell you is that's not how the world works. My taxes pay for a ton of things I can't use; I don't have a car, so I can't drive through the Lincoln Tunnel. That doesn't mean it's not in society's best interest to pay for it anyway.
Woah! I didn't realize you were a New Yorker! If you can make it, you should come by the next Hack and Tell on the 25th! http://meetup.com/hack-and-tell
I said that tongue-in-cheek but that is the counter argument to free or municipal wifi projects.