Mainstrem media talk about evil twins, the security monkey points to stories of hotspot billing systems being so widely open that users can easily reconfigure hotspots to free-of-charge mode. Hotspots are insecure, it seems.
But what does "insecure" or "secure" mean when you talk about a wireless hotspot?
When thinking about the security or insecurity of a hotspot, one has to distinguish between two aspects.
On the one hand, there are the general risks that come from unencrypted wireless connectivity. These are well-known, and can be controlled by using VPN or actual end-to-end security technologies. These risks are relatively boring.
The more interesting attack avenues are created by hotspot operators' bad use of security technology when it comes to their payment systems: How often have you seen warnings about unknown CAs, about self-signed certificates, about non-matching host names, or about the unreachability of a revocation list when trying to securely connect to a commercial hotspot? In all these cases, hotspot operators undermine the security technology that is meant to protect your credit card information or your hotspot user name and password information. In all these cases, hotspot operators give their users a choice between securing their data or using the service.
