How do I stay safe in an internet cafe?

There are three things you need to consider when using an internet service away from home: your internet provider, your internet connection, and your computer.

Your ISP can monitor everything you do. I'm not saying that they are, but they can.

Whenever you're using a wireless hotspot such as in an internet cafe, or even a wired connection in a hotel or somewhere else, they are your ISP for that connection. Again, I'm not saying that the coffee shop, hotel or their wireless provider is spying on you, but I would take care to make sure you trust the provider you're using. If you're at "Joe's Cafe" and it's Joe's teenage son that's just slapped a wireless access point on their DSL connection - yes, he could certainly be monitoring what you're up to if you're not careful.

But that's not really the biggest threat. So while you should of course exercise caution, for this discussion I'll simply assume we can trust whoever's providing the internet connectivity.

The people we shouldn't trust are the other users within range of that wireless connection.

Anyone within wireless range of your laptop could be monitoring your internet usage.

Scary, huh?

So, here's what you need to do:

• Use a firewall! Sounds like you're already doing this, but for everyone else, this is critical. And it doesn't have to be difficult; for example, I simply enable the built-in Windows firewall when I'm in an open WiFi situation.

  Yes, there may be a router or firewall at the hotspot protecting you from threats from the internet, and that's fantastic. It's also not at all what I'm talking about here. In an open WiFi situation and in any "internet provided" situations like hotels, you need to protect yourself from everyone else that's on the same side of the router as you are. They can see and connect directly to your machine unless you have enabled your firewall.

• Use httpS! That's https; note the "s" at the end. An https connection is encrypted. That means that while someone can see that you're accessing a particular web site, if you're using https they cannot see any of the data you send to or receive from that site. This is the only safe way to do online banking. If you can't connect via https, or the "s" disappears at some point in your exchange with your bank, then stop immediately. If it's not https it's not secure and anyone in the room could be monitoring what you're doing.

• Secure your Email! Email is perhaps the biggest open security hole in these situations. If you use a POP3/SMTP email client, the default configuration for most is totally unsecure. I could sit in a corner of the internet cafe and not only read your email with you, but also steal your account name and password. It really is that unsecure.

  With POP3 and SMTP you should contact your email provider and see if they support SSL connections. If they do, it's a slightly different configuration in your email program but once done all of the communication between your email program and email servers are securely encrypted.

  Online or web-based email services deserve special consideration. Most do not support https connections. The one exception is Gmail, which will use https if you make sure to login through an https connection, and have the "always use https" option selection in Gmail's options.

• Consider a VPN. Not all sites support https as it takes extra work on their part. For example, there is no https version of ask-leo.com; you can only access it through unencrypted http, and that's the norm for most sites that don't process confidential information. But that means that someone could still be watching where you go. If you don't mind them seeing that you're visiting ask-leo.com, or what you might happen to search for on Google, or whatever other sites you're visiting in the clear, then you don't need to do anything.

  And not all email providers will provide secure connections.

  However, if you're a "road warrior" and spend a lot of time in internet cafes, have an unsecure email configuration, or browse a lot of sites that you'd rather not be so easily sniffable, you might consider a VPN (Virtual Private Network) service. I've never used one personally, so I can't recommend one specifically, but there are several. http://www.hotspotvpn.com/ is one example. Using these services you create an encrypted connection to the service and route all your internet traffic through them. When you do this, the folks in the cafe see only encrypted data which they can do nothing with.

• Realize that a "login intercept" protects them, not you. In many free WiFi situations the first time you use the service no matter where you try to go you're first intercepted and sent to a page where you're required to "login" or otherwise accept the terms of service. This page does not protect you at all. It has nothing to do with security, wireless or otherwise. It's nothing more than a bit of legalese to protect the internet provider.

So, how big is the risk, really?

It depends.

I would expect busy hotspots near sensitive areas to be a fairly reasonable risk. Busy coffee houses, open airport WiFi, libraries and the like seem like "target rich environments" for the potential hacker. These are certainly places where I'd make sure to take these safety measures myself.

Less busy hotspots? Perhaps not so much.

But it is possible, and more frighteningly, it's not all that hard for someone who's technically savvy.

(This is an update to an article originally published February, 2008.)