My last post was about malicious update notices that pop up when using public network connections. I advised checking digital signatures on the updates. I want to add to that and expand a bit on public communication channels and storage.
First, when you use a public network, wired or wireless, your data may not be encrypted. It generally isn’t on that hotel Ethernet connection, and may or may not be on a public wireless connection. On my Windows 7 laptop, when I hover my mouse over a wireless connection, I get to see the connection’s encryption type. My office uses WPA2-PSK and can see networks with WEP and None.
WPA2 is Wi-Fi Protected Access II with Pre-Shared Key and it uses strong encryption. New devices all support WPA2 if they bear the Wi-Fi trademark. WPA2 also corresponds to the IEEE (Institute of Electrical and Electronic Engineers) 802.11i-2004 standard. All that says is, my communication between my laptop and the access point is strongly encrypted and it would be difficult for someone sitting outside the office to discover what I’m sending.
WEP (Wired Equivalent Privacy) on the other hand is far less secure. There are tools to discover the password to a WEP access point in just a few minutes. It is an older technique and, to be fair, computers then were not as fast as they are now. If you have a network using WEP, get a new access point or access points right away–you should not be using this at home or work.
The networks with none are, of course, not secure at all. Sadly, this is the case with many public Wi-Fi hot spots. CBS News did a good story on the dangers of open hot spots. Check it out on YouTube.
But what if you need to use public networks? Well in that case I recommend using your own encryption. Most sites where you would enter passwords or credit card numbers or other sensitive information use https, of course, and that information is encrypted. You can check to make sure by looking at the address bar in most modern browsers. (I hover over the icon at the left end of the Firefox address entry for more information.) That’s good but it means that since some sites are not encrypted, you might be sending sensitive information over that connection that is not secure.
Another alternative is a VPN (Virtual Private Network) service and the video mentions this. The idea is that you download a program or an app that encrypts data between your device and their site. Some products are designed for individuals and some for larger organizations. I’m not going to recommend a particular product, but check out this Lifehacker article. They also have reviews of some particular products.
Share with us what VPN you’re using and why you like it.
I’ll talk more about encryption in future posts–it is the only real way to ensure your data is confidential in public storage, on your computer and across the Internet.
If you’re interested in learning more, check out Learning Tree’s course, System and Network Security: A Comprehensive Introduction.