How much would you ‘pay’ for ‘free’ Wi-Fi?
Would you give away your birthday? Your travel details? Your home address? Your phone number?
Well, a couple of weeks ago, a security researcher in the UK was looking around online, as you do…
…when he came across yet another company that had joined the 100 million club.
That’s the name we jokingly coined – we hoped we were making a joke at the time, though we quickly realised we weren’t – back in 2013 when Adobe infamously suffered a breach that exposed 150,000,000 encrypted password records in one go.
Despite the encryption – which Adobe hadn’t gone about in the right way – a significant minority of the passwords in the list could be figured out. (Adobe had stored the password hints in plaintext, and lots of users had just repeated their passwords in the hint field, as absurd as that sounds.)
Big breach society
Back then, we rather naively assumed that membership of this notional “100 million club” would remain thankfully rare.
But the low cost and ready availability of cloud storage has, sadly, made it easier than ever for just about anyone to leak just about as many records as they care to share.
And that’s what seemed to have happened in the case that Jeremiah Fowler of Security Discovery stumbled upon in mid-February 2020.
Although the data, 146 million records’ worth of it, didn’t include deeply sensitive details such as as passwords (or even password hashes), payment card details or financial transactions, Fowler could see what looked like travel details in there.
He quickly tracked the source back through domain names in the data to a company that turns out to operate ‘free’ Wi-Fi’ hotspots, including at a number of train stations in England.
The company reacted quickly to Fowler’s report by sealing off the data it had accidentally exposed in the cloud – though it didn’t tell Fowler, leaving him to worry that his report wouldn’t get looked at until the following week).
So, why would anyone want to worry about 146,000,000 database entries relating to free Wi-Fi users connecting to a free Wi-Fi service?
The problem is, of course, that – in the UK at least – ‘free’ Wi-Fi seems to divide into two categories.
There’s ‘free if you come into the coffee shop and buy something, here’s the password, help yourself, no need to register, and why not try the carrot cake while you’re about it, you will like it more than you think‘ (true).
And there’s the ‘free in return for a bunch of personal data that will help us market to you in a way that makes your retail/station/airport experience so much more enjoyable‘ (not-so-true).
The problem with the second sort of ‘free’ Wi-Fi is that the company that’s giving you the ‘free’ service can only really make money out of it – by which we mean that they can only make you pay for it – if they keep track who you are and what you do when you connect.
That’s why Fowler found all sorts of scammer-friendly information logged in the records of the database he came across, including names, email addresses, age ranges and device data of users of the service.
As Fowler remarks:
In this case anyone with an internet connection could see what station the user was at, a time stamp, ads they may have seen, the postcode where they live and much more. Every little piece of information is essentially a puzzle piece that can be used to paint a bigger picture of the user.
So, just how much personal data should you give away in return for a ‘free’ service such as Wi-Fi?
In an era of affordable mobile data – especially in the UK, where pay-as-you-go SIM cards are cheap and can be bought without much fuss at just about any supermarket checkout – do you even need free-as-in-paid-for-indirectly Wi-Fi at all?
What to do?
Here’s an idea: sit down one evening, decide how much your various items of personal data are worth to you, and then stick to your valuation whenever you hit an online sign-up page.
For example, in our opinion, your age in general and your birthday in particular – still treated as a factor of identification by many organisations – is worth too much to hand over in return for free Wi-Fi, even though it’s a data point many Wi-Fi services seem to want.
If a company demands data that you think is worth more to them than you are getting in return, our advice is simple: “Stay away.”
After all, if they don’t value your data as highly as you do, there’s not much incentive for them to look after your data with the zeal you might expect.
Incidentally, it seems that in this case, the Wi-Fi provider did offer a “don’t want to give you that data” option during sign-up, and that would have been the wise choice.
Remember: you don’t have to fill in optional fields in web signup forms, and life is a lot simpler if you routinely leave them blank.
After all, if you don’t hand over data in the first place, there’s no way the company at the other end can ever lose it in a data breach.
Beratung Consulting are dedicated to Security solutions and are a trusted Sophos Partner.
