Chapter 15 - Transport Layer Security
So, with AES-encrypted Wi-Fi all our comptuer security problems are solved right?
Well, no. Mostly, because peope are terrible.
As the prices of Wi-Fi equipment came down, and computers became smaller and easier to carry around, people invented the idea of "public Wi-Fi". This causes two security problems that may not be immediately visible when just looking at / thinking about home wifi.
The first security problem is that, as I said before but without drawing attention to it, Wi-Fi is only encrypted on password-protected networks. When you're on an "open" network that has no password and is instead meant for public use, the connection is completely decodable by anyone nearby with a radio antenna.
Most "public" Wi-Fi networks are now configured with a simple password listed on a sign somewhere on the premises. Even if the company never changes the password, this still improves security tremendously because it enables the connection encryption.
The second security problem is that although a secure Wi-Fi connection ensures third-parties aren't listening from nearby, it does not ensure that the company you're connecting through is not listening. That is, I definitely do not trust the other people sitting at the Internet Cafe, but I probably also do not trust the Internet Cafe itself. This is a much more immediate concern than not trusting your ISP, though the tools invented to address this issue do protect you from ISP snooping as well.
Now, a lot of people are just completely apathetic about security. However with the rising popularity of internet payment process, internet banking, and electronic messaging, the companies who actually run the servers that their customers (and employees) connect to were not quite so apathetic. These companies broadly decided that relying on customers to never connect from public Wi-Fi was futile. Instead, over the past 20 years, basically everyone has adopted a new encryption layer that goes right on top of TCP, called Transport Layer Security (TLS).
TLS (and its predecessor SSL Secure Sockets Layer) applies the same kind of encryption you would see in a secure Wi-Fi connection, but instead of getting decrypted by the Wi-Fi router, it gets decrypted by the server all the way at the other end of the TCP connection. Protocols that include this extra TLS layer generally end in "S" to stand for "Secure". For example:
- File Transfer Protocol (FTP) -> File Transport Protocol Secure (FTPS)
- Hypertext Transfer Protocol (HTTP) -> Hypertext Transfer Protocol Secure (HTTPS)
- Internet Printing Protocol (IPP) -> Internet Printing Protocol Secure (IPPS)
When accessing a website using HTTPS, instead of the HTML being sent as raw ASCII-coded text over the wi-fi network, the HTML gets AES encrypted by the server's TLS layer, sent over TCP to your laptop, then decrypted by your web browser's TLS layer. This means that someone who's just listening on the radio can no longer see what you are looking at in the web browser*. This means that an evil Internet Cafe can't see what you are looking at in the web browser*. This means that an evil ISP or Government can't see what you're looking at in the web browser* (at least, not without a backdoor into either your PC or the Webserver itself. Many governments do have these kinds of backdoors. As I recall, this kind of backdoor is not just a secret in some countries like China, but is actually required by law to be inserted upon request. This is, in short, why the US does not allow Huawei phones to be imported).
* Generally, they can still see the IP address and Domain Name you connect to. Recently a new version of DNS has made it so (when used) they can't see the Domain Name you connect to, but they more or less have to be able to see the IP address because if the traffic was not tagged with an IP address then it would not be deliverable.
So for our example scenario here, let's imagine I'm over here sitting in some Internet Cafe and I want to print some sensitive document pages over to your printer. I don't want the people in the Internet Cafe to snoop on what I'm sending you, so when I go to print I set up the printer as an IPPS printer instead of an IPP printer. Now, when I go to print, every other layer works exactly the same but with an extra step in the middle that encrypts the contents of each TCP packet before it leaves my computer. Now I can send you whatever I want and nobody can see what it is.
Some VPN companies make claims that their VPN software will protect you from hackers trying to steal your credit card information when making online purchases. That could have been true 15-20 years ago, but because of the widespread adoption of TLS and HTTPS this is really just not true anymore. You're already very decently secure against that. We'll talk later about what VPNs can actually do for you and secure you against.