A dozen networks a week, with most of them not even given a second thought.
You arrive at DXB airport, pass through immigration, open your phone, and before you get to the taxi rank, you are connected. Residents of this location might be accessing a dozen shared networks without even thinking in a week between the airport, the mall, the hotel lobby, the co-working space in Business Bay, and the café in Jumeirah.
The vast majority of the time, nothing happens. However, the common misconceptions people have about these networks are incorrect, and corrective action can be easy and only take a few minutes.
What a shared network actually exposes
Two networks of the same name. They are indistinguishable on your cell phone.
The helpful mental model: On a public network, you are on the local network as everyone else is on the public network. In the same facility or in a different facility in the same building.
This is important in two respects.
The traffic is readable if it is not encrypted. Most of the major websites are now using HTTPS, which is the encryption of your content. But not all of what’s on your phone is a browser. Some smart devices and mis-configured software, and older Apps continue to transmit information in unsecured traffic, such as Bluetooth, WPA, and WPA2.
It is very simple to create fake networks. Anybody with cheap hardware can broadcast a network “Airport_Free_WiFi” or “Hotel Guest”. Your phone is added, and it appears fine, and all of your traffic runs through devices that you do not control. This is indeed the real risk, and it is not theoretical – it requires very little skill.
Then there’s the quieter problem: the network operator can see which websites you visit, even on a secure connection (HTTPS). It’s not the content, it’s the destinations. Some venues record this, and some monetise it.
Six things to do
Disable auto-connection. Your phone will store network names and reconnect to them based on their name. You could have a network with the same name as your gym, and your phone will automatically connect to it. Turn off the auto-join feature for public networks that you’re not frequenting in iOS and Android settings.
Get rid of the networks you are no longer with. Same reasoning. A small number of recalled networks is a smaller target.
Don’t count on a network that you don’t control. When you need to check a balance, take advantage of mobile data. This is not a significant loss, considering the fast, cheap, and reliable UAE cellular data.
Look out for warning alerts on certificates. When your browser indicates that a site’s certificate is invalid, stop. A warning is more likely to be interpreted as interception on a public network than as a website error.
Use two-factor authentication on your important accounts. When credentials are compromised, a second factor is what prevents the account from being compromised. Prefer an authenticator app over SMS.
Encrypt the link itself. A vpn encrypts the connection from your device to a vpn server before it connects to your local network. Only the user of the Wi-Fi or the person who created the fake network is able to decrypt the data. This is the single measure that encompasses all of the above.
On VPN use in the UAE
Just to be clear: there’s a lot of confusion online.
VPN for general privacy is lawful in the UAE. They are routinely run by businesses here, by banks for remote access, and by travellers. The law punishes the use of a VPN for committing an offence or hiding an offence; it does not punish the VPN itself.
The real deal: You are protected from using the hotel’s network, the work email while traveling on the network, and browsing from a café away from the network operator, among others. For any questions regarding the treatment of a specific service or activity, please use the official UAE Government portal, not a forum post.
Choosing one, briefly
In many ways, the following three questions pierce the marketing veil:
What is its business model? When a service is free and doesn’t have a paid version, there must be some source of revenue. There are some free VPN apps that have been compromised to sell browsing information or populate it with advertising. A free tier that is in existence to sell subscriptions is a healthier model.
Has the no-logs claim been audited? Anyone may add “we do not keep logs” to the homepage. It’s checkable thanks to an independent audit report.
What is the Company’s headquarters? Who can require data and how?
The short version
The UAE has convenient public WiFi, and it’s not too bad. The only two things that really cause problems are: Auto-connect to a network name you don’t control -Do sensitive stuff on a network name that you can’t vouch for. Disable “autojoin” and continue using the mobile network, and when using another network, use encryption.
About ten minutes of risk reduced, that’s.
Read Also: ACICO Business Park
