Study: Wi-Fi users Still Don't Encrypt

Shackleford writes "SecurityFocus has an article saying that two days of electronic eavesdropping at the 802.11 Planet Expo in Boston last week sniffed out more evidence that most Wi-Fi users still aren't securing their networks. Security vendor AirDefense set up two of its commercial 'AirDefense Guard' sensors at opposite corners of the exhibit hall at the Boston World Trade Center, the site of the conference, and for two days analyzed the traffic flowing between conference-goers and 141 unencrypted access points set up by the conference for public use, and by vendors on the floor. What they found was that users checking their e-mail through unencrypted POP connections vastly outnumbered those using a VPN or another encrypted tunnel. Only three percent of e-mail downloads were encrypted on the first day of the conference, 12 percent on the second day."

Comments

Application level encryption

[Anonymous Coward]

This only verifies the importance of application level encryption. Every socket communication should be encrypted so that security doesn't rely on the network connection itself.

Suprasphere encrypts all socket communication using a dynamically generated Diffie-Hellman key exchange. This is much better than SSL because it does not require using a CA so you can set it all up without any administrative overhead.

Furthermore, all authentication uses a zero-knowledge proof so that a password is never sent over the wire. Even though the traffic is all encrypted anyway, this adds another level of security so that a compromised passphrase at one sphere will not allow authentication at any other. You can store a profile at different places that can only give you access if you can prove beyond a statistically reasonable doubt that you are who you say you are.

Not surprising

[airuck]

I live in a small iniversity town. Even the shortest bike ride with my Zaurus running kismet finds many access points in businesses and homes unencrypted (war biking?). I often run ethereal for the few minutes it takes me to get up and order coffee at one of the local cafes. It never fails to catch pop and imap passwords, mail, and instant messaging conversations. I always use ssh or VPN, but I don't feel superior. Most of my own non-work related mail is sent in plain text.

Wi-Fi?

[TheRaven64]

I'm amazed that people still use unencrypted anything over the Internet (well, except http. I don't really care if someone knows I read /.)

A few years ago I was given a demo of TCP-dump by a resident BOFH. First step was to read all of the private communications between a certain user and other people in a chat room. The next was to take a look at some people's emails as they were relayed through the router (including their POP3 passwords). Since that day I have not sent any password unencrypted...

Need new version of WEP?

[FearUncertaintyDoubt]

That's great for e-mail, but what about general browsing? Or telnet? Or any other communication that I might use with a public WiFi? And I'm pretty sure the POP3 providers I use have the option of SSL. So what do I do? Either say, "well, it's not safe to check my e-mail," or "screw it, I'll take the chance that someone sees my penis-enlargement spam." The point is that it isn't very efficient, realistic, or even possible to expect users to be securing every internet-capable application on their PC. So why not encrypt at the common gate -- i.e., the point at which all data goes in or out of the PC?

If you use WEP, but everyone knows the key (e.g., at a trade show so you need to make the key public to let people on the WiFi network), I assume that's the same as unencrypted. However, why couldn't there be a RSA or symmetric encryption for 802.11[x]? So you make the public key for the access point, available, anyone with that can connect, but your PC/WiFi card encrypts every packet going out the door, so the traffic going from the client to the access point is now secure. Similarly, the client gives the access point its public key, so all the traffic coming back to the client is also secure. This probably requires a lot more overhead in the access point and client, but I don't think that it would be unreasonably so.

Use encryption! It's easy.

[vadim_t]

Encryption might take a while to set up, but it's a very good thing. Not only for your own data.

I'll explain. Many of us run web servers and let friends have sites or mail accounts on them. Now, I'm pretty sure that in most places reading your user's mail is illegal. Suppose you're logged in on your server trying to solve some problem by looking at what's going on with a sniffer like tcpdump or ethereal. Accidentally you see a friend's private email scroll by.

Now, of course, this wasn't intentional. But what if you make a slip? The email could have been about some event you didn't know about. Then, a week later you forget where you got that information from, you ask that friend about whether his grandma got better. The friend then asks "How do you know that? You weren't reading my mail, were you?". Depending on how this person feels about you, you might get into some trouble.

This is why on my server I provide IMAP accounts only though SSL. I never look in user directories unless needed. And I tell everybody who gets an account that if they want to be completely sure their data stays confidential that they should use PGP and that I can explain how to use it.

It's not that hard to set up, anyway. Set up a mail server with SSL and you'll be able to check your mail safely from anywhere. Install SSH for administration. Install Apache SSL even if you don't need it much, to give the users who want it the ability to log in with an encrypted connection. Use an instant messenger like Jabber with a SSL connection too.

Don't worry about self-signed certificates. A certificate from Verisign provides a rather small increase of security which people tend to ignore anyway. If you just want to avoid your traffic from being sniffed, it should be enough.

Excepting web browsing, most of my data is encrypted. I even found that I can browse kuro5hin.org throught https. It's a good thing too, when I login my password won't be sent in clear text.

Re:WEP is weak

[gilesjuk]

Humour aside, probabky won't be long before we have spam wagons. Spammers in converted trucks crusing the highways to find wireless access points for spamming.