Evan Schuman's StorefrontBacktalk

How dangerous is free Wi-Fi? Dangerous enough, says U.S. Senator Charles Schumer, who on Monday (Feb. 28) called on Amazon.com, Twitter, Yahoo and other major Web sites to tighten up their security. He wants users to be safe from the threat of network-based identity theft while visiting those sites using the free Wi-Fi at coffee houses and bookstores.

Schumer’s effort is to push HTTPS for a much higher percentage of sites. HTTP Secure is the easiest way to block most attacks that come via public Wi-Fi. It’s not perfect, but it’s largely effective. Unfortunately, it’s not that simple. For one thing, HTTPS isn’t cheap. Encrypting every session for every Web surfer chews up more processor power and fills more bandwidth than plain-vanilla Web connections. Just setting up the coding is non-trivial, and complexities like content from multiple sources make it even more complicated. Good luck getting Amazon.com to convert its entire E-tail operation to HTTPS before the noise from Schumer’s news conference has faded to silence.

What’s worse, HTTPS doesn’t attack the problem at its source, which is free Wi-Fi that’s offered through access points that are subject to address resolution protocol (ARP) poisoning. Those bookstores, coffee houses and other retailers that use cheap access points are trying to keep costs down—after all, they’re offering Wi-Fi for free. But spending a little more on equipment that’s better at blocking ARP poisoning might be less expensive that upgrading every major Web site, and it would improve security for all sites and surfers.

Or perhaps a better place to make a push is in Web browsers and protocols. Right now, HTTPS produces a tiny padlock on most browsers. Want to raise awareness of secure Web browsing among consumers, senator? Why not start pushing browser makers to make that padlock much bigger—and give unsecured sites a nasty, threatening border to warn users that they’re potentially at risk?

Then again, instead of fear mongering and finger pointing, maybe a better approach is for everyone simply to recognize that the world has changed. Wi-Fi is everywhere now, and it’s not getting any safer. How about HTTPS and more secure access points and browsers that warn users when they’re using creaky old HTTP?

And for grandstanding politicians? Maybe a short course in clear thinking. Schumer’s own Web site has a form that requires a constituent’s name, address and phone number to send him an e-mail—and there’s not an HTTPS padlock in sight.