How easy it would be to harvest passwords at a bar

I’m here at my favorite bar to kick off the start of the NFL season (and some guy on TV keeps interrupting about some jobs “plan”) and I noticed there’s a strong wifi signal where there used to be none. Huh? Did this place get wifi since last time I was here? I asked around and apparently it’s news to them too.

But actually it’s not just one wifi signal… There’s three! But they all have the exact same signal strength even though they have very different SSID’s.

Now I have no idea if these 3 companies are in cahoots or what but it seems odd to me that three cable companies are providing wifi hotspots from the same device. There is a hotel next to the bar but it’s much too far to get a signal. Trust me, I’ve tried.

What the hell, all my shit is SSL protected, I decide to check it out. All three networks give the same private IP range and each one prompts for my credentials with their respective service. The pages are pretty authentic looking (as compared to the usual illiterate Nigerian Paypal hacker’s work).

Maybe they are legit, but I’m not taking any chances. But it got me thinking, how easy would it be to go around to various bars, malls, coffee shops, etc and just drop off a rogue battery-powered access point in a bush that just prompts people for their Gmail or Apple ID’s. Even people that are trained to ignore phishing emails will probably gladly hand over the keys to the castle in their desperate search for connectivity.

I’m paranoid about this stuff. And so far, (knock wood) I’ve never been hacked.