Mac® Security Bible

16.5. Using Public Wi-Fi Hotspots

I've already discussed the dangers of using public Wi-Fi hotspots a few times in this book, but the warning bears repeating. When you use a public Wi-Fi connection, anyone with a computer within about 300 feet of you (sometimes even farther) can easily watch and record all the data you send and receive over the Internet. The process is trivially easy — all anyone need do is download and run some free software, and a couple of clicks later, your data (possibly including important passwords) is in their hands. Because the eavesdropper could be in another room, in another building, in a car, or around the corner, you may have no idea that someone is monitoring you. This is not a remote, hypothetical possibility; Wi-Fi eavesdropping is extremely common in public places, and the only safe assumption to make is that someone else is sniffing all your wireless data.

The danger still exists even if you are required to pay for network access (using a captive portal, as discussed earlier in this chapter), and even if the data is encrypted using a WEP, WPA, or WPA2 password. Most public Wi-Fi networks aren't encrypted, but of those that are, the vast majority use the same password for every client. Therefore, even if your data is being sent over the airwaves encrypted, anyone else who has access to the network also, ipso facto, knows the network password and could therefore use it to decrypt your data. So, don't let any claims of password protection or encryption ...