Wifi hotspot security

[paulsheff]

Hi

Have a company that is looking to set up in a shopping complex, who will provide access to a wifi hotspot as part of the pitch. The company wants to allow shoppers to register and pay for items there and then using this connection through Paypal, cc's and paypal accounts.

I've done their site design for them and they kind of ran this past me as a 'this is what we're going to do' and I said I wasn't entirely convinced it was such a good idea as it was unlikely the connection was sufficiently secure for the people's details not to be captured by other parties.

I don't really know as I've never used a public wifi spot, is there anything they could do at either end of the connection to ensure the details couldn't be grabbed?

They said something about using some sort of 3 phone connection instead, but I thought I'd ask those in the know first.

Cheers

 

[oddjob62]

I've done their site design for them and they kind of ran this past me as a 'this is what we're going to do' and I said I wasn't entirely convinced it was such a good idea as it was unlikely the connection was sufficiently secure for the people's details not to be captured by other parties.

I don't really know as I've never used a public wifi spot, is there anything they could do at either end of the connection to ensure the details couldn't be grabbed?

They said something about using some sort of 3 phone connection instead, but I thought I'd ask those in the know first.

Cheers

With any public hotspot, it is up to the user to make sure any connections they make are secure.

Eg, if they are connecting to work they should be using encrypted VPN. If they are doing online transactions it should be over an SSL connection. This will stop people snooping on packets. Another thing is having a firewall on their system.

You can't be expected to protect them from their own stupidity/ignorance of wireless security

 

[J.B]

Even if they did encrypt it, how would their customers know the encryption and not the bad guys! Theres also quite a few articles online about "fake" hotspots where people replicate an SSID of a ligit hotspot then hope someone is going to put in their bank details!

I would say that this company are a not really thinking this through