I’m not sure I understand this. If I’m on my phone and connect using wire guard or teleport and I’m connected to a public wifi, I don’t understand the risks. Can you explain them? Thanks, I genuinely don’t understand. I thought encrypted tunnels were safe?
Comment on Do I need https on everything
quaff@lemmy.ca 2 days ago
Always use HTTPS. Especially if you’re using your services on mobile.
Imagine you’re on your friends WiFi, and you disconnect from your net bird/tailscale/wireguard connection to your self hosted network… Any and all mobile apps that require that secure connection, is going to be making calls to your internal services and trying to pass auth/session token details to them.
A bad actor on your friend’s WiFi network, could, in theory, capture these requests and now you’re at the mercy of how well those mobile apps are written.
It’s a bit paranoid, but this is what we are trying to mitigate here.
Policeshootout@lemmy.ca 2 days ago
quaff@lemmy.ca 2 days ago
Sometimes your connection might not work correctly, and you’re not connected to your secure network. Like how VPNs will have kill switches (prevents you from accessing the Internet if the connection to the VPN isn’t successful) to prevent leaks during those spotty connections. Without HTTPS, during those spotty connection times, you’re sending your auth/session details plain-text on an unsafe network.
lemmyvore@feddit.nl 2 days ago
It’s not even that hard to imagine, this is exactly what rogue wifi access points do. It’s surprisingly common for wifi access at places like coffee shops to be compromised and used to silently conduct these types of attacks. The people that set them up are not very knowledgeable and also they don’t ever check up on them as long as they keep working.
This is also why you want to enable HSTS on top of your HTTPS, so that rogue requests to downgrade the connection to plain HTTP are ignored.
Another good idea is to place all the services that should only be accessed over VPN only in private DNS (home LAN DNS and the VPN’s DNS), never in public DNS. A simple and effective way of doing that is to place them on a deep subdomain like
*.private.example.comrather than*.example.com. That way if your VPN drops when you try to resolve those subdomains you don’t get any response anymore and there’s no connection for the rogue wifi to hijack.quaff@lemmy.ca 2 days ago
Yep! Definitely don’t add any of your domains used internally on public DNS services. Be careful requesting SSL certs for the child subdomains too. They wil l show up on transparency logs like on shodan.io. Use internal DNS, and wild card certs for these things. And obviously, do not expose your ports publically.