I went to my favorite mom-and-pop coffee shop this weekend. I’d heard she had started providing free wi-fi, so I decided to ask. And I was right. This was cool because I love this shop; it’s not a Starbucks, but who cares? I like the coffee better and the wi-fi is free.
On connecting my laptop, I realized … there was no security on the wireless LAN at all. I guess I shouldn’t have expected it. Did I expect her to have a RADIUS server? Nah. But that’s the only way, in such an environment, to be secure, without her giving out the key to every customer for either WEP or WPA … and that would be just as insecure.
So what does all this mean? Well, you might think if you log into Gmail, you’re fine, because the little SSL lock symbol shows up indicating the password will be encrypted. The problem is, that means the data will be encrypted from the router to the Internet, and beyond. But as the data flows from your laptop to the router, it’s broadcast in the clear … no encryption because there’s no WEP or WPA.
This means, you’d better not login to your banking site, type in and submit any credit card numbers, use passwords you don’t want others to know about, etc. because that’s all send in the clear, with no protection at all.
Many people may not give this a second thought. The SSL lock symbol to them, means they’re safe. But they’re not if the shop uses wi-fi with no security, and I hope, as more shops offer free wi-fi, more people don’t get bitten by people snooping the airwaves.
