“It’s wireless! How hard could it be to not install wires?” - Pointy Haired Boss, Dilbert The most coveted words for travelers these days are ‘Free Wi-Fi’. We book ourselves into hotels that offer free Wi-Fi. We pay obscene amounts for average tasting coffee, just to access the free Wi-Fi. Although we use it extensively, we have our own set of questions around it:

• Is it secure?
• Can I do my online transactions through it?
• Can I connect to my company VPN?
• What should I do to ensure that the Wi-Fi connection is really secure?

As usual, PracticalInfoSec tries to answer this question in a practical and simple way. This may not be a complete list, but at least it will give you a start.

1. Choose your friends wisely - Choose the right Wi-Fi

The first and the most important step in ensuring a secure wireless connection is choosing the right connection. We have all been to places where there is a pay-through-your-nose wireless connection available and, just for fun, tried to see what other networks are available. Mostly, there is at least one free network that we see. It is either some weird number like ‘mn0977ewm21’ or a name like ‘John’, etc. We would have tried to connect to it as well. This is the time to step back and think. Why would there be such a network?  We all know there is no free lunch. There are a few reasons for it. One, there could be a Good Samaritan who thinks that since you have already paid too much for the coffee and should not have to pay for network as well. He or she willingly sets up an access point close to the place and pays for everyone’s wireless connections. Two, someone has been sharing a 3G connection (or playing multiplayer games) by setting up an ad-hoc wireless network and kept the connection open without bothering about who else can access it. Three, there is a malicious person who wants to get as much data as possible and see if he can capture anything interesting. He or she sets up a bait for all freeloaders. Which do you think is the most likely scenario? The first and most important point in secure wireless surfing: Choose your network wisely. Connect only to networks where you know its origin

1. Choose who will direct you - Choose your DNS

Before I get into the details of this, a bit of technology. What is a DNS? To understand this, we need to know a little more of how your computer communicates with other computers. For any computer to connect to a network, it requires a unique address. This is called the IP address of the computer and is typically a set of 4 numbers from 1 to 255 separated by dots (to see the IP address of your computer now, go to www.whatismyip.org.). This IP address identifies your computer in the big mesh of wires and wirelesses connecting the world. The website that you want to visit, is hosted on a computer somewhere in this mesh. It too has an IP address. To communicate with it, you need to know the IP address of the computer where your website is. Do a simple exercise. Open your browser and type 173.194.36.0 and press enter/return. Which site did you reach? You must have guessed by now that it is easier to remember the name of the website than to remember some random number. This is where DNS comes into the picture. DNS stands for ‘Domain Name Service’, or ‘Domain Name System (I really do not know which one). DNS does the tough job of translating the fancy names that you remember, like Google, to an IP address. It is thanks to DNS that you never have to remember any IP addresses. All you need to remember is the cool domain name or web address. When you open your browser and type the domain name, your computer will first ask its DNS server for the IP address of the domain. How does your computer know where the DNS server is? This is where the Wi-Fi device (access point) that you are connected to comes into picture. The Wi-Fi device already knows the IP address of the DNS server. It merely forwards your request there. So where is the problem? Some Wi-Fi access points have not been setup securely. They are already compromised and some of them point to DNS servers that do not maintain the correct mapping. These are typically called ‘rogue’ DNS servers. It might so happen that if you type the name of a particular website, they will redirect you to some other website (as the DNS entries do not match) or worse, they will pose to be the website you typed and glean critical information from you such as usernames and passwords. The good news is that you do not need to depend on your Wi-FI device to tell you the address of your DNS. You can tell your computer the address of a secure DNS that you know and ask it to go there every time. Whatever computer you are using, go to the network options and the place where you can change the IP address of your computer. Chances are that it would be set to ‘Obtain IP address automatically’. Here you will be able to set your DNS server as well. Again, typically it would have been set to acquire the DNS server name from your access point. Click on the option where you can set the DNS server manually. Enter the IP address of well known, secure DNS servers such as Google’s, DNS servers (https://developers.google.com/speed/public-dns/) or the servers offered by OpenDNS (http://www.opendns.com) You are good to go. One more point in your checklist ticked in the journey towards a secure wireless Internet experience. Keep watching this space for the next update of Practical Wireless Security.