Caution : Stay Safe on Public Wi-Fi

[DevRaj80]

Stick to SSL for Webmail

First, to combat mail snoops, use a Webmail system with HTTPS for the whole session. Almost all Webmail systems use HTTPS when asking you to log in, so your password is transmitted securely. However, after authentication, they usually switch back to HTTP because it reduces the computational strain on their servers and makes serving advertisements easier.

[DevRaj80]

That means that everyone who is on the same wireless network (either unencrypted or with a shared password) can read the content of your e-mail. In some cases, a person can steal your session cookie and log in to your Webmail session without your password. (That is, until you click the 'Logout' link--which you do every time, right?)

[DevRaj80]

Two very notable exceptions are Gmail and your corporate e-mail system (such as Outlook Web Access). Earlier this year, Gmail switched from the common practice of using HTTPS just for logins to using HTTPS throughout the entire Webmail session.

[DevRaj80]

Google Apps users were previously able to opt in to this feature, but it is now the default with the ability to opt out (if you hate security). This change, combined with Google's new suspicious-login detection algorithms, make Gmail a standout among free Webmail providers. If you were looking for a reason to switch from your AOL, Hotmail, or Yahoo account, you've found it.

[DevRaj80]

Your company's Webmail system is also likely protected by HTTPS at all times, because that is the default configuration for most systems. However, if you check your work messages using local software (Outlook, Thunderbird, Mac OS X's Mail) instead of HTTPS Web-based e-mail, you may or may not be using encryption.

[DevRaj80]

Paid Hotspots: Safety Not Included

While researching this article, I found a common misconception among travelers and coffee enthusiasts--namely, the idea that commercial hotspots that require pay-per-hour or monthly subscription fees (AT&T, Boingo, GoGo, T-Mobile) are more secure than their free counterparts because a payment and a password are involved.

[DevRaj80]

In fact, these hotspots are almost always unencrypted, and they employ what is called a "captive Web portal" only to prevent access to the Internet until you enter a payment method (or subscriber password). Though this "gateway" Web portal is usually delivered over HTTPS (to protect the credit card information or the password), once authenticated all the traffic is unencrypted on the wireless network.

[DevRaj80]

As a result, your $10 monthly fee gives you access but not security. In fact, due to the nature of radio frequency transmissions, another person--even if they aren't a subscriber--can still view any unencrypted traffic that you send, just by joining the same SSID wireless network.

[DevRaj80]

This means that outsiders can easily observe and capture any regular HTTP Websites you visit, any unencrypted POP3 e-mail you access, and any FTP transfers you make. Talented hackers can even modify their wireless card to clone the identity of your wireless card, thus obtaining free access through a commercial hotspot by "piggybacking" on your signals.

[DevRaj80]

Use Your VPN

If your company offers a VPN (virtual private network) connection with Internet access, you should take advantage of that functionality when using either free or subscription Wi-Fi hotspots. By enabling the VPN function on your laptop, you ensure that all of your communication is encrypted with high-strength ciphers and tunneled from the Wi-Fi hotspot, across the Internet, and into your company's data center, where it is unpacked and sent out on the company's Internet connection.