UKSecurityGuy wrote:Just to take this back to basis for my understanding.....
You're on the road all of the time, with your own laptop, but with no internet connectivity.
You use free wireless hostspots (McDonalds et al) to get internet connectivity, but you're concerned that providers/users of those wireless hotspots will manipulate/spy on your data.
You have access to a VPS, and you're unconcerned about the VPS provider spying/manipulating your data
I have a Virtual Private Server with a major U.S. Hosting Company.
Actually, this point, like most, is probably above my head...
Since I am using a VPS on THEIR Servers, in THEIR Environment, in THEIR Data Centers, I guess, "Yes", I do trust them.
Should I not?
While I encrypt User Passwords, it is not like I have encrypted my entire database.
And by definition, you couldn't encrypt your website's code.
(This is probably a whole other thread...)
What I do now - after I've let everyone jump on board my UNsecured MacBook, it to use either Plesk to access my Web Hosting Account with my Web Host, or for actually working with things like files, I use Secure FTP.
But back to what I believe to be your original question, yes I am assuming that I can trust my Hosting Company. (If you couldn't, you'd be in trouble...)
You have a hosted Ecommerce system somewhere that you're building, and your traffic between your machine and this Ecommerce system is encrypted (HTTPS).
I have an SSL certificate, and if a user goes to "Check out", then they are switched from an HTTP connection to an HTTPS connection, so that all communications from their computer - assuming it wasn't hacked at McDonalds too - and my website on my VPS on my Hosting Company's system is "secure".
Is that what you were asking?
In which case the advice I would give is the same as ajohnson's....use the VPS.
Not trying to be a wiseguy, but that makes no sense...
A "Virtual Private Server" (VPS) is a virtual share on a physical server.
It has NOTHING to do with security...
I have been asking if a "Personal Virtual Private NETWORK" (VPN) by itself is secure to use on a Free Wi-Fi Network.
Completely different concepts...
Setup OpenVPN (which is essentially the same as other VPN providers, except that it's free and you control all of the security around it)
Yeah, but WiTopia is only like $50/year, and I'm probably not smart enough to set up my own OpenVPN.
PLUS, after reading things, the reason for my points above are that "I have no way to host a physical server back home, because there isn't one..."
So I don't see how OpenVPN would help?
What does that mean?!
Have your browser proxy all of it's connections through Squid so that all of your web browsing is protected.
I don't understand how that relates to something like WiTopia or Hide My Ass, and why it would be better?
Essentially it's what I'm doing at the moment (although I have a stack more infrastructure running on the VPS) which protects my data when I'm anywhere away from home.
Plus it's a good learning experience!
I'm all about learning, but everyone here should no I'm really not qualified to do much of anything with security or networking...
I am just a serious consumerist trying to establish a reasonable amount of Privacy and Security, and avoid having a Data Breach with my Website's Data and Users...
I am also looking for solutions that are easy enough to implement, that I won't F*** them up and put myself at GREATER RISK than before, if you follow me...
If that's a bit too complicated for you, OpenSSH (as ajohnson said) works nearly as well.
Again, I'm not following that...
But coming back to my OP...
Could a person - who is not worried about the Feds, and who not doing anything illegal - establish enough Privacy and Security using just a "Personal VPN" (e.g. WiTopia) and Free Wi-Fi (e.g. McDonalds), to be able to ethically manage a Website with limited User Personally Identifiable Information?
Also, could a person do Online Banking, Shopping Online, etc. worry free?
I think my fear about connecting to the Internet via Free Wi-Fi while using WiTopia or HideMyAss, is that a hacker could somehow break up the "hand-shack" before I establish a "secure tunnel"...
If I had a JetPack from Verizon, in theory, unless you were sitting within 50 feet of me, and you knew my SSID, and you knew my passcode, them you couldn't break into Verizon's Wireless Network - at least not on my end.
By contrast, I just worry that it would be easier to hack into my WiTopia "secure tunnel" at McDonalds.
I do think that if a person truly established a "secure tunnel" with either Verizon or WiTopia, that either "secure tunnel" would be equally secure.
Although, the advantage of WiTopia, is that in practice, they are not logging the fact that I am a closet Justin Beiber freak... *JUST KIDDING*
Does all of that make sense?!