Lawrence Finch wrote:
Please explain how other users of public networks can access and manipulate your end-to-end encrypted traffic.
This isn’t the place for an in-depth tutorial, but a brief overview may help those interested in this topic. The following outline is intentionally limited in technical detail.
At the physical level, WiFi is effectively a shared-ethernet technology, managing network traffic. All client devices on the network segment can “see” network traffic from all other clients.
By definition, “open” WiFi networks (as typically found in public WiFi networks) don’t use WiFi encryption to protect the radio network from interception. As a result, all unencrypted traffic on the WiFi link is easily intercepted by anyone using readily available WiFi tools and packet sniffing software.
While much of a user’s internet traffic may benefit from TLS/SSL, many network protocols remain in-clear (e.g., DNS) and easily intercepted, analysed, and manipulated unless this unencrypted traffic is also tunnelled beyond the local WiFi network using VPN, ODoH, or similar techniques. Without additional protection, in-clear traffic is accessible to both the WiFi Operator and other WiFi clients. By necessity, IP header and packet-routing data is always in-clear.
Captive portal networks requiring a WiFi Password (as sometimes found in hotel and retail environments) use encrypted WiFi. While encrypted WiFi will protect against casual eavesdropping, unless the WiFi network itself employs peer-to-peer blocking, PSPF, or similar controls to inhibit communication between network clients, other WiFi clients will still be able to access all WiFi traffic on the network segment. As before, any in-clear network traffic remains accessible to other users sharing the WiFi network.
Captive Portals often block VPN, ODoH, and other encrypted traffic, requiring users to disable these encryption technologies to connect and use these networks. With these protections disabled, the user’s network traffic is unprotected.
In all cases, the WiFi Network Operator remains in a privileged position to easily monitor and manipulate in-clear traffic protocols. Some operators may also employ a transparent proxy to intercept traffic, or perform deep packet inspection of TLS/SSL traffic, effectively acting as a MITM attack on users’ traffic. While this may trigger a certificate warning, many users don’t necessarily understand the implications and simply click through warnings to continue the session, bypassing TLS/SSL protections.
In such environments, a commercial VPN service can provide additional protection over the least trustworthy network segment. A properly configured VPN connection ensures that in-clear traffic is not intercepted over the least trustworthy WiFi network and remains inaccessible to the WiFi Network Operator. While the VPN traffic only benefits from this additional protection between the end-user and the VPN Gateway, with careful configuration, DNS traffic can still be tunnelled to a trusted DNS provider using DoH, DoT, or ODoH.
In summary, public WiFi networks are high-risk environments that can benefit from a VPN. Commercial VPN services have limited (if any) benefit when used with domestic WiFi over which the end-user has control of access. VPN is not a security panacea - but used properly and with understanding of what it can and cannot usefully protect, can provide useful additional protection from a variety of threats and privacy issues.
