Author here. After seeing "TLS makes WiFi safe" repeated endlessly, I built this to walk through a broader thinking distance.
The /quiz version tracks contradictions in responses (surprisingly common, even among technical users). The /conversation format
is for people who just want the technical explanation without the assessment.
Happy to discuss specific scenarios or threat models, but there are some principles that just wont change, do you know what they are ?
> Does TLS protect all protocols from layer 2 to layer 7, prior to using something that enjoys TLS?
The right answer is "no", but this unnecessarily scares people, since everything important that needs to be protected still is.
> How do you verify that client isolation is enabled on an Untrusted (Public) WiFi network before joining?
You can't, but that's not something you need to verify or worry about.
> Where do you draw your confidence from that an Untrusted (Public) WiFi network is suitably configured, managed and secure before joining it?
This makes it sound like you need such confidence, when in fact, it's only the endpoints (your device, and whatever server you're connecting to) that need to be suitably configured, managed and secure. If they are, the network could be actively hostile and you're no worse off than if you were just offline.
> On an Untrusted (Public) WiFi network without client isolation, can one client directly attack another client's device?
If such attacks are cause for concern, then the real reason is the vulnerability on your device that it's exploiting, not the network not being isolated.
> Can the average user detect if their device is being attacked on an Untrusted (Public) WiFi network?
The average user can't detect that under any circumstances, but this question unfairly makes it sound like there's some characteristic of public WiFi that makes them not able to detect it.
> Select all attacks that can occur on Untrusted (Public) WiFi:
> ARP spoofing
Harmless due to TLS.
> DNS manipulation
Ditto.
> Port scanning of your device
If you have dangerous ports open on your device, that's a "your device" problem, not a "public WiFi" problem.
> Certificate solicitation via captive portal
Is this a made-up term? I can find zero references to certificate solicitation attacks.
> MAC address collection
Modern devices randomize their MAC address for each new network they connect to.
> Traffic timing and volume analysis
That's a thing you can do, but how is it an "attack"?
> Certificate pinning can prevent Attacker-in-the-Middle (AITM) attacks for TLS/HTTPS connections. Does certificate pinning protect your device's protocols and services that do not use certificate pinning?
Regular CA verification already prevents MITM attacks. The only thing certificate pinning does is make it harder for you to legitimately inspect your own apps' traffic.
> Do most personal computers have the same security controls as corporate managed devices (hardened OS builds, EDR, MDM, DLP, defense in depth)?
DLP, etc. is security against the user, so it's a good thing that personal devices don't have such things.
> What percentage of Untrusted (Public) WiFi networks do you estimate undergo regular security audits and penetration testing?
Again, it doesn't matter, since a well-configured device would be fine even on an actively malicious network.
3 comments of 13
[ 5.1 ms ] story [ 20.3 ms ] thread> Does TLS protect all protocols from layer 2 to layer 7, prior to using something that enjoys TLS?
The right answer is "no", but this unnecessarily scares people, since everything important that needs to be protected still is.
> How do you verify that client isolation is enabled on an Untrusted (Public) WiFi network before joining?
You can't, but that's not something you need to verify or worry about.
> Where do you draw your confidence from that an Untrusted (Public) WiFi network is suitably configured, managed and secure before joining it?
This makes it sound like you need such confidence, when in fact, it's only the endpoints (your device, and whatever server you're connecting to) that need to be suitably configured, managed and secure. If they are, the network could be actively hostile and you're no worse off than if you were just offline.
> On an Untrusted (Public) WiFi network without client isolation, can one client directly attack another client's device?
If such attacks are cause for concern, then the real reason is the vulnerability on your device that it's exploiting, not the network not being isolated.
> Can the average user detect if their device is being attacked on an Untrusted (Public) WiFi network?
The average user can't detect that under any circumstances, but this question unfairly makes it sound like there's some characteristic of public WiFi that makes them not able to detect it.
> Select all attacks that can occur on Untrusted (Public) WiFi:
> ARP spoofing
Harmless due to TLS.
> DNS manipulation
Ditto.
> Port scanning of your device
If you have dangerous ports open on your device, that's a "your device" problem, not a "public WiFi" problem.
> Certificate solicitation via captive portal
Is this a made-up term? I can find zero references to certificate solicitation attacks.
> MAC address collection
Modern devices randomize their MAC address for each new network they connect to.
> Traffic timing and volume analysis
That's a thing you can do, but how is it an "attack"?
> Certificate pinning can prevent Attacker-in-the-Middle (AITM) attacks for TLS/HTTPS connections. Does certificate pinning protect your device's protocols and services that do not use certificate pinning?
Regular CA verification already prevents MITM attacks. The only thing certificate pinning does is make it harder for you to legitimately inspect your own apps' traffic.
> Do most personal computers have the same security controls as corporate managed devices (hardened OS builds, EDR, MDM, DLP, defense in depth)?
DLP, etc. is security against the user, so it's a good thing that personal devices don't have such things.
> What percentage of Untrusted (Public) WiFi networks do you estimate undergo regular security audits and penetration testing?
Again, it doesn't matter, since a well-configured device would be fine even on an actively malicious network.