Slashdot Mirror
On The Current State of WiFi Security
An anonymous reader writes "A Flexbeta article covers the basics of WiF security. The article mentions mentions various ways of securing a WiFi network, how easy it is to crack WEP, and what the IEEE is doing about WiFi security. From the article: 'In order to address the security issues of WEP and the current Wi-Fi standards of 802.11a/b/g, the Institute of Electrical and Electronics Engineers (IEEE) is developing a new standard that is called 802.11i. This standard was developed with security in mind. The new standard implements new security entitled Wi-Fi Protected Access (WPA), which takes advantage of the Temporal Key Integrity Protocol (TKIP), is easier to setup using a pre-shared key, and can use RADIUS authentication.'"
None of which will matter if people do not put passwords on their networks that arent "default" "administrator" or "home." Oh, first post!
This sig has not been evaluated by the FDA. It is not designed to diagnose, treat, prevent, or cure any disease.
Standard setup for the average home network user seems to be
Take box home
Plug in box
let windows xp do it's thing
Use.
Clearly for these advances to be of any use, customers must be informed of their necessity and setup must be kept as simple as possible (helped, i suprisedly add, by XPSP2's wireless configuration app)
The technology is all well and good, as long as it's being used.
Go ahead and search, you will never find it all, I am baking muffins as I speak. - ComicBook Guy
When my folks go to the car lot, they know to look at the Buicks. When they go to Best Buy, they don't know they're looking at the equivalent of a crotch rocket motorcycle that will surely get them killed.
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
According to Bruce Schneier, the security risks if WiFi are vastly exaggerated.
Karma: Positive (probably because of superiour intellect)
While I applaud attempts to secure WiFi, it would seem that wireless will always add another channel of vulnerability to any IT system, especially because WiFi is so often deployed inside the firewall. WiFi system are generally vulnerable to both internet-based attacks and wireless attacks. And even if the 802.11i protocol "secure," there is little guarantee that both the AP and the client wifi transceiver have a secure implementation of the protocol or that the user configures the system in a secure fashion.
As inconvenient as wires are (and even they are not totally secure), they do reduce the amount of one personal information freely broadcast into the ether.
Two wrongs don't make a right, but three lefts do.
While I agree in general, I don't think blaming the end user is really fair.
After all, wifi and computers nowadays get sold as something easy to use and setup. Just plug it in and it works.
Unfortunately, the reality doesn't really live up to the promises.
That is, even if the just works part is true (which of course everyone who has been the resident computer geek for friends and family knows isn't always the case, to put it mildly), in many cases the default setup is simply unbelievably insecure.
To sum it up, people are told things about computers and wifi that simply aren't true. As most people are not interested in computers and shouldn't be just to be able to use them, it's really unfair to blame them for believing the hype.
Supposing it was a terrorist or a pedophile? How would you like Homeland Security or the FBI knocking on your door, asking you deep questions and impounding all your computer equipment for investigation? The suspicious activity did all originate from your IP address, after all.
And how secure do you think your computer really is? When it is behind your router it has the advantage of being somewhat obscured to the rest of the world by NAT. A hacker inside your own network just has your software firewall to break down - one step closer. Furthermore, if he is able to get access to your router he probably also has access to everything you send - are you sure you want all that to be logged?
You are very naive.
"WEP is a joke and trivial to break into"
Yes, but some older hardware does not support it. Also, if protecting your data is really important, you probably should not trust WPA either, but use a VPN or encrypt your data in some other way. If the goal is to make enough of a barrier (like a window on a house) that nobody can say they "didn't know" they were using your network to d/l their illegal files. WEP is good enough to prevent "accidental" network connection.
Build a lightweight VPN server into every router, such as Openvpn which uses TLS/HMAC and RSA keys. The router could easily generate and distribute the keys (over the wire) for wireless encapsulation.
IPSec SHA256 AH AES128 ESP
We setup such a configuration at DEFCON and despite various attacks against both AP and client, including evil twin, WDS exploits, traffic replay, etc. the network was absolutely impenetrable.
The only secure configuration I would consider would be WPA2 with RADIUS authentication. Pre-shared key is vulnerable to dictionary attacks so be sure to key with a good random string if you use this mode.