But there are still tons of sites with their own IPs, or pool of IPs, in which case seeing the destination IP will reveal what domain you're visiting with no need to observe DNS traffic or SNI. i.e. 199.232.125.140 is Reddit and only Reddit. If you visit https://199.232.125.140 you get an error that the cert is for *.reddit.com.
If your goal is to prevent your network operator from seeing even the domains you're accessing, encrypted DNS + encrypted SNI helps but doesn't get you all the way there. A VPN (or Tor) is the only true solution there. However I imagine this is a relatively uncommon need, at least for most people on HN.
https://blog.apnic.net/2019/08/23/what-can-you-learn-from-an... https://news.ycombinator.com/item?id=28103770
I would call that a half-truth. When I was a kid (in the early 2000's) it was exceptionally easy to crack public wifi networks. A lot of that had to do with misconfiguration and every company scrambling to create public wifi APs. It makes sense that these memories and experiences live on and have become slogans of companies vying for privacy.
Once I figured out packet injection (before cellphones) I actually cracked some random company WEP in a parking lot when my friends and I got lost in order to look up directions.
Nowadays things are a lot less fun. :(
I remember buying a network adapter with packet injection capabilities SPECIFICALLY for this haha
Driver support for packet injection in Kali Linux is fantastic now, making it easy to spray de-auth packets with most hardware and capture your auth packets without having to wait.
I tested out Hashcat recently with my GTX 1060 (a modest card), and could burn through 170k WPA2 hashes a second. That's a long way from brute force, but doable for most wordlist attacks.
But you're not a kid anymore and nowadays it's way harder to crack public wifi networks.
Fearmongering by VPN vendors is very real.
I wouldn't have a problem browsing my home banking on a public wifi network. Everything is tls-encrypted, my browser can do dns-over-https, and anything important (including the login) requires me to enter an one-time code from my non-smart token.
And by the way, on a public wifi you might be pray of the occasional wifi attacker where as if you're using a vpn from a vpn vendor you're by definition giving all your traffic to a company whose main specialty is networking, usually under the vague promise not to log your traffic.
This may be because public wifi networks are public, which means they're open, which means there's no wifi password or encryption. Cracking a public wifi network takes all the effort of merely joining the wireless network with a mobile device.
What usually happens these days is a redirect to the HTTPS site, but that first request can still be attacked.
[Kind of a plug: I made a test for this in my tool, DomainProactive (https://domainproactive.com). I would appreciate feedback on this kind of error.]
This is why an https only mode is important. In Firefox it can be enabled somewhere in the settings.
[1]: https://blog.chromium.org/2021/03/a-safer-default-for-naviga...
should be the default.
*where instead of returning the proper "name not found" DNS error, the recursive server redirects to a site owned by the provider to show ads. Not to be confused with typo squatting where domain speculators register domains showing ads hoping people mistype URLs.
[0]: https://github.com/trailofbits/algo
[1]: https://pivpn.io/
I just learned about Algo but have been a long time user of PiVPN (from when they only supported OpenVPN!) on my Raspberry Pi, so in the case that I wanted to reinstall the server, I wonder if the change would bring something new to the table.
[1] - The community fork at least. Upstream is no longer updated: https://github.com/subspacecommunity/subspace
Unless you've manually specified them in your network/adapter settings, which means they won't be taken from the DHCP lease.
Many devices include ipsec hardware acceleration, while wireguard ciphers are purely in software. With your typical Ubiquiti or Mikrotik device you can have much more performant connection encrypted with aes+sha than with chacha+poly.
This led to serious vulnerabilities and backdoors.
> while wireguard ciphers are purely in software
This is a feature, not a bug. It's quite difficult to trust commercial routers.
> you can have better performance with ipsec than with wireguard
Citation needed. Modern CPUs are very cost-efficient at this.
This is a matter of implementation; not whether the implementation is in hw or sw. Do you have any examples, where there was a such issue for example in Cavium Octeon (used by Ubiquiti in their USG routers), Qualcomm IPQ-xxx or Marvel Armada SOCs (used by multitude of other vendors)?
> This is a feature, not a bug. It's quite difficult to trust commercial routers.
It is difficult to trust many routers; even if they are open source, their maintenance might be not exactly transparent.
> Citation needed. Modern CPUs are very cost-efficient at this.
Typical routers do not have desktop or server class modern CPU. They run on 700-1400 Mhz, and they are busy with things like firewall rules (why do you thing that Fasttrack on Mikrotiks exists?) or, when a beefier CPU is available, with BGP. You can test it for yourself and see, that with hw accelerated AES and SHA you can saturate your available bandwidth and with Wireguard you can saturate only a fraction (unless you have low enough bandwidth...).
Is there a source confirming this, or is this just speculation?
Most of the "shame on public WiFi" comes from VPN companies, which are just trying to fearmonger into a sale. Sure, DNS over HTTPs isn't as widespread as it should be. Sure, some websites aren't encrypted, still. But that doesn't mean that routing all of your insecure traffic to a VPN provider so they can handle it instead is going to increase your security. It just moves the threat model from "your public WiFi network and people on it" to the VPN provider.
If you really want to be safe, you could run your own VPN with algo (https://github.com/trailofbits/algo) or manually setup WireGuard and route traffic e.g., back to your home ISP, instead. That's probably my best suggestion, rather than using any of the cliche VPN providers that advertise everywhere.