Travel connectivity reality check

[Neeto]

[...][...]

Moderator: post deleted!
Note: this is a copy, the original starting post for this thread has been removed.

[Tsunami]

I never buy local SIM cards when traveling outside of the European Union.

I just disconnect roaming and then enter a pub once or twice a day, where free wi-fi is available. I have 1 or 2 drinks there, sufficient to check the most urgent messages (any non-urgent message can wait until after holiday) or to send a couple of pictures to family and friends back home. I've done so the last 2 times I was outside of the EU, no hassle at all.

The rest of the day I'm disconnected indeed as roaming is off to avoid costs. But during a holiday I also don't feel the need to constantly check the internet.

Never used any international card that just stays functioning wherever you go. To be honest, didn't know it existed. Here in the EU we are lucky to have free roaming in every EU member state. For travels outside the EU, I just use free wi-fi in a pub and hotel room. Maybe SIM cards are an option for longer stays abroad, but for a holiday I wouldn't make that expense.

[JeremyNicoll]

Originally Posted by Tsunami

I never buy local SIM cards ...

I just disconnect roaming and then enter a pub once or twice a day, where free wi-fi is available. ...For travels outside the EU, I just use free wi-fi in a pub and hotel room.

Considering the doubts you're expressing elsewhere (about phone permissions) I'm gob-smacked that you'd trust arbitrary pub or hotel wifi networks.

[Tsunami]

Originally Posted by JeremyNicoll

Considering the doubts you're expressing elsewhere (about phone permissions) I'm gob-smacked that you'd trust arbitrary pub or hotel wifi networks.

I know, you make a good point.

But a wise person (in this field) once told me: "don't argue with anxiety, because there is no ratio behind it. Just try to cope with the anxieties you experience, and be glad about the other things where you don't feel anxious."

That said, I would never connect my laptop to a random wifi network. And I try to use wifi networks that are protected when using them in a pub or hotel.

The only country outside of the EU (where roaming is too expensive and where a wifi network in a pub or hotel is a good option) where I travel to regularly, is the UK. I guess I could buy a UK SIM-card (that would also give me my own UK phone number, which may be handy) but I wonder if that's not too unpractical as you always need to change SIM cards with each visit to the UK.

Other non-EU countries I only visit rarely, so there it wouldn't make sense buying a local SIM card. Maybe it'd make sense for the UK as I go there somewhat frequently, but then I don't know if it's worth the hassle.

[TenFour]

It really depends on where you are traveling. Coming from the USA we have several mainstream phone services available that are excellent for travel. T Mobile roams in over 200 countries I believe, as does Google Fi. Depending on your plan you may have up to unlimited data and calls without doing a thing. I use an MVNO that gives me 200 minutes and a few gigabytes of data in Canada and Mexico. I used it recently in Canada and had to do nothing--just drove across the border and kept using my phone.

[Tsunami]

Originally Posted by TenFour

It really depends on where you are traveling. Coming from the USA we have several mainstream phone services available that are excellent for travel. T Mobile roams in over 200 countries I believe, as does Google Fi. Depending on your plan you may have up to unlimited data and calls without doing a thing. I use an MVNO that gives me 200 minutes and a few gigabytes of data in Canada and Mexico. I used it recently in Canada and had to do nothing--just drove across the border and kept using my phone.

Within the EU, all member countries have roaming agreements, which means you have nothing to do. Your phone automatically connects to the local 4G or 5G network and you can use your phone as you do in your own country, without additional payment too. It is however once you leave the EU you have to be creative.

I visit the UK regularly, but there are some other non-EU destinations on my bucket list.
New York City, Cuba, Iceland, Morocco, North Norway (including Svalbard), Bosnia & Herzegowina, Russia and Israel (both subject to it being safe again), and at least 1 African country other than Morocco. In those places you have to be creative. You can probably buy a local SIM card easily in each of those countries, but doing so would mean you end up with a lot of SIM cards that you use only during the week(s) you're there.

I also would like to visit Transnistria (Transdjnester), which is a de facto independent state but unrecognised by UN member states, who consider it to be a breakaway region of Moldova.
Moldova itself is already outside of the EU, but even a Moldovan SIM card generally doesn't function in Transnistria as they have their own local provider. So there it gets very complicated (but that's one of the issues when traveling to an unrecognised country. But it's too fascinating in terms of history and architecture to skip that one).

[JeremyNicoll]

Originally Posted by Tsunami

That said, I would never connect my laptop to a random wifi network. And I try to use wifi networks that are protected when using them in a pub or hotel.

What do you mean by "Protected"? https: ? That - IIUC - only guarantees a secure connection between you & the other end of the connection. It doesn't tell you that the system at the other end can be trusted.

In the UK (where my mobile phone is with O2) I'd be MUCH happier connecting to an O2 hotspot than one owned by a pub. Even then I'd not be keen to do anything confidential.

[hadaso]

When I travel abroad (about once or twice a year) I always purchase a roaming plan with my local provider, because I want to be reachable at my own telephone number. I never purchased or rented a local SIM at the destination, but my phone (one of the cheapest Galaxy models) has slots for two SIM cards, so it is possible to use a local SIM for local calls and the SIM from home to be reachable at my regular phone number.
I know there's something called eSIM that allows one to use multiple virtual SIM cards. I don't think my phone has this, but I know that many people use this when traveling, and if you travel a lot you should probably look into this possibility. If you have this capability you don't need to deal with physical SIM cards, and you can purchase the SIM online and immediately download it to your phone and use it.

[TenFour]

I know there's something called eSIM that allows one to use multiple virtual SIM cards. I don't think my phone has this, but I know that many people use this when traveling, and if you travel a lot you should probably look into this possibility. If you have this capability you don't need to deal with physical SIM cards, and you can purchase the SIM online and immediately download it to your phone and use it

My phone (Pixel 9) has two eSims available, so I can do this. As has been noted, so much depends on where you are going and what your current phone service offers from your home country. For example, I know of two people who have traveled from here i the USA to both Japan and Iceland, and in both cases one of them purchased a local SIM and one used T Mobile's native roaming. In both cases, the T Mobile roaming proved to be invaluable as it gave them service in more places than the local SIM which tends to be tied to a single service. Similarly, my wife went to the Netherlands and Norway with her sister amd they both had international roaming, one on T Mobile and one on Verizon. Again, T Mobile proved to work much better as they traveled around. Of course this could also be phone-specific depending on what bands your phone supports.

[janusz]

Originally Posted by JeremyNicoll

Considering the doubts you're expressing elsewhere (about phone permissions) I'm gob-smacked that you'd trust arbitrary pub or hotel wifi networks.

It depends what you want to access over a public pub or hotel wifi. Checking the local weather for the next few days, or public transport timetables, or opening hours of local museums is risk-free. And connections to most sites (in practice all financial sites and email services) are over https, therefore secure.

[n5bb]

Originally Posted by janusz

It depends what you want to access over a public pub or hotel wifi. Checking the local weather for the next few days, or public transport timetables, or opening hours of local museums is risk-free. And connections to most sites (in practice all financial sites and email services) are over https, therefore secure.

Google seems to disagree and warns to not connect to any such public networks:
https://www.forbes.com/sites/zakdoff...rtphone-users/
Other sources agree that public WiFi networks are not safe unless you use a VPN:
https://ubifi.net/blog/dangers-of-using-public-wifi/
https://us.norton.com/blog/privacy/public-wifi
https://www.kaspersky.com/resource-c...lic-wifi-risks

Bill

[janusz]

Originally Posted by n5bb

Google seems to disagree and warns to not connect to any such public networks:
https://www.forbes.com/sites/zakdoff...rtphone-users/

If you read this article, you'll find the following opinion:

Federal Trade Commission has waded into the debate. ?Public Wi-Fi networks, or hotspots, in coffee shops, malls, airports, hotels, and other places are convenient.? And while ?in the early days of the internet, they often weren?t secure, things have changed.?

The FTC says ?in the past, if you used a public Wi-Fi network to get online, your information was at risk. That?s because most websites didn?t use encryption to scramble the data and protect it from hackers snooping on the network.? But today, ?most websites do use encryption to protect your information. Because of the widespread use of encryption, connecting through a public Wi-Fi network is usually safe.?

Of course it's up to you how much security-conscious (or security-paranoid) you want to be.

[n5bb]

Originally Posted by janusz

If you read this article, you'll find the following opinion:
... ...
Of course it's up to you how much security-conscious (or security-paranoid) you want to be.

Yes, I read that comment in the Forbes article. I notice that you (and several other posters) are not located in the US. I'm surprised that you would follow the advice of a US government agency (especially one with the word trade in their name) on such matters.

Here is the current US Federal Trade Commission webpage which gives advice on such issues:
Public Wi-Fi Networks - Security Tips

Many hotels… … coffee shops… … airports and other places offer free Wi-Fi hotspots. They’re convenient. Unfortunately, they often aren’t secure.

The bottom line? Secure Wi-Fi hotspots require a password. Secure websites start with https.

From a European governmental source (EuroPol):
Risks of Using Public Wi-Fi

Don't assume that a Wi-Fi network with a trustworthy SSID is genuine.

I think that the main thing to watch out for is WiFi spoofing. The attacker sets up a WiFi access point which broadcasts a SSID name which the user confuses with the legitimate business access point. See:
WiFi Spoofing Explained

Unfortunately, there is more newly discovered bad news:
SSID Confusion Attack
New AirSnitch attack bypasses Wi-Fi encryption in homes, offices, and enterprises

The best way to get around these issues is to use a VPN connection on your device.

Bill

[SideshowBob]

Originally Posted by n5bb

Yes, I read that comment in the Forbes article. I notice that you (and several other posters) are not located in the US. I'm surprised that you would follow the advice of a US government agency (especially one with the word trade in their name) on such matters.

Here is the current US Federal Trade Commission webpage which gives advice on such issues:
Public Wi-Fi Networks - Security Tips

From a European governmental source (EuroPol):
Risks of Using Public Wi-Fi

I think that the main thing to watch out for is WiFi spoofing. The attacker sets up a WiFi access point which broadcasts a SSID name which the user confuses with the legitimate business access point. See:
WiFi Spoofing Explained

Unfortunately, there is more newly discovered bad news:
SSID Confusion Attack
New AirSnitch attack bypasses Wi-Fi encryption in homes, offices, and enterprises

The best way to get around these issues is to use a VPN connection on your device.

I'm not seeing any threat to TLS here - these attacks just create the type of environment that TLS was designed for.

A lot of what's being written about this seems to based on the assumption that there is still plenty of HTTP around. It's not my experience, but it may be true of some, and a lot of safety advise is aimed at a minority of people.

[JeremyNicoll]

It seems to me that someone setting-up a malicious Wifi network could serve spurious DNS addresses to their customers directing (say) attempts to login to internet-banking websites to fake sites. They could serve proper addresses for every other query.

Although some people explicitly choose to send DNS queries to (say) google ... I think many - if they know about this at all - just expect DHCP to furnish their device with a server address ... & failing that don't know how any of this works. The DHCP stuff surely happens as the Wifi network connection is being set-up.

It's still not common for people's computers to do DNS queries over a secure connection. But even if they do ...if it is to a malicious DNS server how would 'secure' help them?

If someone gets directed to a fake bank site that has a valid certificate, using https for that session will not protect them.