How do I use an open WiFi hotspot safely?

Turn On The Firewall

This is easily and frequently overlooked.

When you're at home, you may use your router as your firewall and keep the Windows or other software firewall on your machine disabled as redundant. That works well, as the router stops network-based attacks before they ever reach your computer.

When you're on an open WiFi hotspot or connected directly to the internet via other means, that software firewall isn't redundant. In fact, it's required.

Make sure that the firewall is enabled before connecting to an open WiFi hotspot. Various network-based threats could be present on an untrusted connection, and it's the firewall's job to protect you from exactly that.

Consider Not Using Free WiFi

As I said, it can be safe to use open WiFi, but it's also very easy for it to be unsafe.

The solution that you used while you were at that same coffee shop (and asked me about in this question) is a very common and solid one: use your phone instead.

While it is technically possible, a mobile/cellular network connection is significantly less likely to be hacked. I use this solution when I travel.

Most mobile carriers offer one or more of the following options:

• Use your phone. Many phones or other mobile devices, such as iPhones, iPads, Droids, Blackberrys and others, are quite capable email and web-surfing devices, and typically do so via the mobile network. (Some can also use WiFi, so be certain that you're using the mobile broadband connection for this option to avoid the security issues that we're discussing.)

• Tether your phone. Tethering means you connect your phone to your computer - usually by a USB cable, but in some cases, via a Bluetooth connection - and the phone acts as a modem, providing a mobile broadband internet connection.

• Use a dedicated mobile modem. Occasionally referred to as "air cards", these are USB devices or PCMCIA cards that attach to your computer and act as a modem, providing a mobile broadband internet connection, much like tethering your phone.

• Use a mobile hotspot. In lieu of tethering, many phones now have the ability to act as a WiFi hotspot themselves. There are also dedicated devices, such as the MiFi, that when turned on, are simple dedicated hotspots. Either way, the device connects to the mobile broadband network and provides a WiFi hotspot accessible to one or more devices within range. When used in this manner, these devices are acting as routers and must be configured securely, including applying a WPA/WPA2 password so as not to be simply another open WiFi hotspot susceptible to hacking.

I travel with a MiFi, and also have a phone capable of acting as a hotspot as a backup. I find this to be the most flexible option for the way I travel and use my computer.

Secure Your Desktop Email Program

If you use a desktop email program such as Outlook, Outlook Express, Windows Mail, Windows Live Mail, Thunderbird or others, make certain that it's configured to use SSL/secure connections for sending and downloading email.

Typically, that means that when you configure the email account in your email program, you need to:

• Configure your POP3 server for downloading your email selecting "SSL", "TLS", or "SSL/TLS" security option, and usually a different port number, such as 995 instead of the default 110.

• Configure your SMTP server for sending email selecting "SSL", "TLS", or "SSL/TLS" security option, and usually a different port number such as 26, 465, or 587 instead of the default 25.

The exact settings and whether or not this is even possible depends entirely on your email service provider; you'll need to check with them to determine the correct settings to use. How you configure these settings, of course, depends on the email program that you use.

With these settings, you can feel secure downloading and sending mail using an open WiFi hotspot.

It's what I often do when I don't have my MiFi with me.

Secure Your Web-based Email

If you use a web-based email service like Gmail, Hotmail, Yahoo or others via your browser, you must MUST MUST make sure that it uses an httpS connection and that it keeps on using that httpS connection throughout your email session.

I believe that this might well be the source of many open WiFi-related hacks. I expect that people simply login to their web-based email service without thinking about security and as a result, the username and password are visible to any hackers in range who care to look.

Some email services have "require https", which is an option you should definitely enable. The problem is that of the major services, I trust only Gmail to remain in https throughout the entire session (and even then, you need to take care if you then use other Google services using your Gmail account credentials). Some services will use https for only your login, which is insufficient as your email conversations thereafter could be viewed by others. Other services may "fall out" of https, reverting to unsecure http without warning.

Facebook also falls into this category. Facebook has a "require https" option, but apparently can fall out of https, particularly when various Facebook apps are used.

Any and all web-based services that require you to login with a username and password should either be used only with https from start to finish, or should be avoided completely while you're using an open WiFi hotspot.

Use a VPN

This one's for the road warriors. You know them - the folks who are always traveling and online the entire time they do so - often hopping from coffee shop to coffee shop in search of an internet connection as they go.

A VPN, or Virtual Private Network, is a service that sets up a securely encrypted 'tunnel' to the internet and routes all of your internet traffic through it. Regardless of https or not, SSL/secure email configuration or not, as all of your traffic is securely tunneled, no one sharing that open WiFi hotspot can see a thing.

This service typically involves a recurring fee. As I said, they're great for road-warriors but probably overkill for the rest of us as long as we abide by the other security steps described above.

Use Different Passwords

Finally, it's a good idea to keep the passwords of the accounts that you access different from each other and, of course, secure.

That way, should one account be compromised by some stroke of misfortune, the hackers won't automatically gain access to your other accounts that they may then learn of.

•

As you can see, it's unfortunately easy to get this stuff wrong. When that happens, that guy in the corner with his laptop open could be watching all your internet traffic on the WiFi connection, including your account credentials as they fly by.

And when that happens, you can get hacked.

Fortunately, with a little knowledge, forethought, and preparation, it's also relatively easy to be safe.