Slashdot Mirror
Responsible Wireless Access For Your Access Point
bgood writes: "O'Reilly Network has an interesting article on authentication for wireless networks. The author discusses both the technical aspects, specifically NoCatAuth, and the overall context of why someone would choose (or not choose) to monitor or track the use of their wireless network. While geared towards network neighborhoods, the article definitely has applicability in more formal settings."
... would be if you could easily set aside a certain percentage of your bandwidth (say 10-15%) for use by other people, and more if its available. That way you aren't taking a backseat to freeloaders on your own network, but you also aren't curring people off whenever you start a big, bandwidth-heavy transfer.
___
Cogito cogito, ergo cogito sum.
Otoh, any marketing folks from Verisign reading here? Could be a whole new niche...
NeighborCert (tm)
I live near Sonoma County and heard about the community networks, problem is that using a anything other than a regular computer with a wireless 802.11b device can't get access. I had my Ipaq with linux installed, and with a good signal. Maybe it just needs tweaking.
"Get them before they get....
I would gladly open up my wireless network, but the firewall/switch/access point puts the wireless network on my side of the firewall. That kindof defeats the whole purpose of the firewall - Sure it's secure from 99.999% of the internet, but people can get in via wireless. Ideally, I'd like to manage the rules between the wireless part and my wired desktop computer, but I guess that would require the purchase of a real firewall. It's a shame; it would just take a little more software!!
HIV Crosses Species Barrier... into Muppets
- All clients get immediete dhcp lease with minimal bandwidth from local gateway
- client optionally posts credentials via SSL to auth service (using server SSL, no client cert required, although this could save steps)
- auth service sends PGP-encrypted credentials in a message to local gateway
- local gateway decrypts and validates data from master and matches to client credentials
- client is upgraded with more bandwidth, or other goodies (if he's neighborly
:-)
All in all, sounds like a cool perl script to me!No, MAC address based firewall rules won't solve the security problem, either. They'll raise the barrier slightly, but it's fairly easy with most 802.11b cards (and with regular Ethernet cards, for that matter) to use a different MAC address than the one assigned to your device. Under Linux it's "ifconfig eth0 hw ether [new MAC address here]". Not nearly difficult enough.
And with most cards in windows such as the lucent cards, the software it comes with allows you to change the MAC address as part of the standard process of admining your network.
:)
So run etherreal for about ten minutes and you can use all the mac addresses you just dumped.
Nblug power
"Not my manner of thinking but the manner of thinking of others has been the source of my unhappiness." - M
I plan on using NoCatAuth in the future but currently I have my 802.11 network setup free and clear (minus a simple wep key that is only on for a joke reason (ask me what the key is :)).
I don't really have to worry much about the bandwidth because no one that would use a wireless freenet comes into my area of town. Most of them have their own dsl, thats the irony of setting it up so far. If your in Santa Rosa near railroad square and you want free access (while traveling etc) send me an email.
"Not my manner of thinking but the manner of thinking of others has been the source of my unhappiness." - M
Something that requires the use of HTTP and human intervention just to get IP-level access is no good. Your laptop can't connect itself up and poll for mail without manual intervention. Back to the drawing board.
Good. I was going to scream if this was another article whose only set of instructions began 'right click on Network Neighborhood'.
Free Java games for your phone: Tontie, Sokoban
Hello. I might be considered an "insider" in this field. I work at a semi-large ISP where we provide wireless connectivity using BreezeCom network equiptment. Employing large (from 9-24 inch) antennas, and uni-and omni-directional antennas mounted on prominent structures, we are able to send up to 3Mb/s to hosts.
The security here is terrible. We use no authentication via radius or any other method. Anyone with a 802.11 network card, and a sufficient antenna could steal connectivity, and we could not currently tell.
There exists ways to detect this, by monitering the MAC addresses connecting to the APs on the towers, but this is not employed. Neither is each radio catalogued, and IPs, for the most part, are assigned by the DHCP server with no logging.
I do not know if this is typical of most wireless companies, but if it is, then things should be ripe for the taking. I'm posting anonymously, because my company has a history of firing and suing for less
.
Sounds like you need to create another side to your network.
If you have one machine running a firewall with the public internet connection (that is, it has a real IP address), you can have one set of rules for computers that you trust, one for wireless access. The wireless network has different rules for Owner, Co-Op, and Public, and does not have to use the same firewall rules as your wired network. You can still block the wireless access (different blocking for each group, ie owner might have access to the wired network, Co-Op and Public do not).
Stateful firewalls do not have to filter only one direction, and you could not run No-Cat without a stateful firewall.
Troll Like a Champion Today
The biggest issue for freenets, IMO, is liability - if someone wanders past your access point and sends a huge amount of spam, or starts a DoS attack on remote sites, you may well find your ISP cuts off your access. In the worst case, you might be legally liable under various anti-spam or other laws.
Just as ISPs have contracts with their customers, and authenticate them, it may end up being necessary to have contracts with your freenet users and to authenticate them. Of course, if they are friends it may be enough to just authenticate them... IANAL but something that indemnifies you against lawsuits etc would be very useful.
This goes against the freenet ideal but unfortunately providing Internet access can be a legal minefield.
And then later:
No, it also requires Javascript. I'm sure I could script a workaround, but it's one more damn thing to go wrong. And if ubiquitous 802.11 existed, I'd want to use it primarily for ssh, not web. Reading between the lines, 'the public' would not be allowed to ssh. This scheme is oriented towards the idea that internet==web, and of course everyone has javascript.
On the whole, however, I'm impressed by this system. The idealistic idea of free open wireless was threatened by the possibility of anonymous abuse and bandwidth hogging. Nocat appears to make it viable, even in the face of real-world threats. This could have far-reaching effects in undermining the emerging broadband monopolies. The ability to charge for unrestricted access could lead to financially healthy networks with lots of upstream bandwidth. And the ability to use before buying means that you would already know a network's reliability and coverage.
Lastly, I'm a little concerned by the centralization of power implied in the article. If I read it correctly, there is a single trusted authentication service at nocat.net. If the nocat scheme takes off, this center will be a natural target for foes of the internet such as MPAA/RIAA/etc. I hope that if the system takes off, multiple authentication sites will emerge.