Mobile Networking · Encryption in Transit · Lesson 5 of 5

Challenge: The Airport Warning

Help your dad stay safe after a scary warning on airport Wi-Fi.

The Case Brief

You're waiting for a flight with your dad. He joins the free airport Wi-Fi and opens https://bank.example in his phone's browser to check a payment.

Instead of the bank's page, he gets a full-page warning saying the connection isn't private. He shows you his screen and asks if he can just tap through. He says it's the real bank address, and he types it all the time.

You tap the icon next to the address and read the certificate details. The certificate claims to be for bank.example. Under issued by, it says Airport Guest CA.

At home, the same page loads with no warning. Your dad's phone is up to date, and he hasn't changed any settings.

Before he does anything else, you want to explain what the warning means and what he should do.

One Problem Fixed, Another Appears

While you were reading, the Wi-Fi portal popped up a message: Install our security profile to remove warnings. Your dad installed it and, following the steps on screen, switched on full trust for its root certificate in Settings.

Now the browser opens bank.example with no warning at all. But his bank's own app, which uses certificate pinning according to its help page, shows Can't connect on the same Wi-Fi. Other apps work fine.

He's confused. The website works now, so why doesn't the app?

A Text About His Account

You help your dad remove the profile, and he switches to mobile data. A minute later he gets a text: Your account is locked. Log in now at bank-secure-login.example.

He taps the link. The page looks exactly like his bank, there's no warning, and the browser shows the connection is secure. He says that means it must be safe, since the certificate checked out this time.

You know the certificate check passed. You also know what that check does and doesn't promise.

Telling the Family

Your dad didn't type anything into the fake page. He messages the family group chat to warn everyone. The chat app uses end-to-end encryption.

Later he asks you a follow-up question. His iPhone uses the standard iCloud Backup, and he has never turned on Advanced Data Protection. He wants to know if anyone besides the family could ever read those warning messages.