Networks & relative security

Question

Hi,

I was wondering which of these networks would you feel most comfortable logging into e.g. your bank account and why

• 3g mobile phone connection
• University campus LAN
• university campus wifi, wpa
• University campus wifi no encryption. Proxy login

does the choice matter if the site uses ssl? Won't that encrypt the login info anyway?

also for no ssl how would you generally rank the relative security reliability of the networks above?

Answer 1

All connections over SSL (or https in this case) are very safe. However encrypting just the login information is completely and totally meaningless if you just spill the session id. At no point can the session id be transmitted over http, this is covered in OWASP A9:Insufficient Transport Layer Protection. Although I admit this is probably the most ignored of the OWASP top 10.

In terms of security i would say 3g is marginal the most secure followed by WPA and then rest are trivial to intercept. 3g isn't very secure because it can be intercepted. If you are on the WPA connection then you can also intercept other users traffic using a new attack. A switched lan can be attacked with arp spoofing. A broadcast LAN or open wifi is just transmitting the traffic to everyone, just fire up wireshark.