N.Y. County Mandates Wireless Security

Mynister writes "CNN has an article about Westchester County NY forcing small business to use basic security on their wireless networks. From the article "The law also requires that businesses offering Internet access -- coffeehouses and hotels, for example -- post signs warning that users should have firewalls or other security measures.""

Comments

Hmmm

[mfh]

Sooooooo enforceable.

Re:Hmmm

[TubeSteak]

Actually, it is super-enforceable.

They can do it on the cheap with a few fulltime inspectors walking around with laptops & their eyes open for the notification signs.

In addition, I imagine they'll make some noise in newspapers and whatnot to get computer nerds & other concerned citizens to report any violations of the law.

Stuff like this is very easy to enforce. A friend of mine's father was made an honorary postal inspector and given a card saying so... because he would constantly report on people who were illegaly parked around the local Post Office. They even gave him freebie phone cards & disposable cameras to sweeten the deal and allow him to document the parking violations. And before anyone says the guy had too much free time, he was an insurance appraiser & was in the Post Office twice a day, every day.

Re:Hmmm

[N3TW4LK3R]

I don't think they want to enforce it.
They're just making this law so that the courts can blame someone in case of damages

Re:Hmmm

[DrXym]

It's easy to enforce. Someone does a spot of wardriving. Once they find an unprotected wireless network, they triangulate to where its coming from and then issue the appropriate fine.

Re:Hmmm

[Anonymous Coward]

I sure hope your friend's father paid taxes on the gifts he was receiving from the post office. : p

Re:Hmmm

[KarmaMB84]

When you go to court for child porn, you get to go to jail even if you claim someone else used your wireless to download it... ;p

Re:Hmmm

[bmo]

There's a name for that kind of guy...

"Busybody"

And it's not a good name. I'd hate to be his neighbor. Are you suggesting that Westchester county ask for vigilante^H^H^H^H^H^H^H^H^H volunteer network scanners? How about we ask that your neighbors check to see if you're violating any of the "laws of nature" in your bedroom?

--
BMO

Re:Hmmm

[Firehed]

But I just had to RTFA on this one, and it only applies to businesses where CC#s are stored on the network (which should be limited to Visa and Mastercard headquarters), not your average joe who couldn't be bothered to RTF huge notice duct-taped to his new router saying to enable wep/wpa/anything. Or that's how I read it anyways.

Re:Hmmm

[idesofmarch]

It is not super enforceable. According to the fine article, the law would only prohibit open networks where some kind of confidential data is kept by the business. And what if the confidential data is on a separate, firewalled network, away from the open network - who knows? Anyway, see how compicated this is getting? Your proposed wardriver would only be at the tip of the investigation.

Re:Hmmm

[TubeSteak]

Ummmm... pretty much every single enforcement agency (public or not, examples: the BSA, your local community board) has a mechanism for the public to report violations.

It really depends on how the enforcement agency feels about what you're reporting. If they don't care, you get ignored and called a busybody.

To put it in perspective: Would you make the same complaint about people who reported building or health code violations?

Re:Hmmm

[misleb]

But isn't wardriving illegal?

Re:Hmmm

[driddle]

IMO if someone goes around turning people in for stupid things they are total scum of the earth. Maybe instead of looking at other peoples faults they should look at their own. I think the only time one should report people is when it is something that is gravely immoral (i.e, murder, rape, etc.) or dangerous to others, etc.

Re:Hmmm

[Anonymous Coward]

where i come from, he's called a snitch. He'd get stabbed and his tires slashed. we'd fuck you up every day at school for having a limp dong for a dad. no wonder that guy's name is tube steak. he's a homo luser.

the authorities aren't your friends. most of the time they aren't protecting your rights as much as preserving the status quo, which by an large is designed to preserve the western equivalent of a caste system.

Re:Hmmm

[PhoenixFlare]

IMO if someone goes around turning people in for stupid things they are total scum of the earth. Maybe instead of looking at other peoples faults they should look at their own.

The trouble is, a "stupid thing" to one person (usually the person doing the activity, oddly enough) is a major annoyance to another, and/or in some cases, against the law - noise issues are a good example.

I'm sure the pothead I used to live under a couple years ago thought I was "total scum of the earth" after I called the police on his numerous violations of a town noise ordinance, and eventually got him evicted.

People think the laws against silly things like noise pollution, parking in fire lanes, etc. are optional, but hey...Not liking a law doesn't excuse you from following it.

Re:Hmmm

[PerfectSmurf]

Does it even need to be enforced? The warning could be a listing in the local newspaper. "The following businesses were found to have unsecured WiFi connections in violation of ordinance XXx.y: " Now, if you deal with customer data, you have angry customers after you so you secure your network. If you only have your own data to worry about you still secure your network because the whole county now knows it's open.

Re:Hmmm

[Babbster]

Nicely put. And in the example given up-thread, we're talking about jerks who were parked in places they shouldn't have been, spots that were presumably necessary for the orderly flow of a [mostly] government agency - our government agency. We'd probably be irritated if the government spent money adding a salaried employee whose only job was to check that parking laws around post offices were being followed, but we should be happy when someone is willing to take a little unpaid time to help fix things that need fixing.

One wonders if the GP feels that neighborhood watch groups are the "scum of the earth" because they're trying to keep their houses, and those of their neighbors, safe.

Just last night, there was a party across the street that started going wrong (a lot of people - more than 20 - screaming at each other outside). It was only about 10:00 at night on a Saturday but should I have felt bad because I called 9-1-1 to inform them that something very loud and concerning was going on in my neighborhood, even though I wasn't sure that any laws were being broken? Maybe I should have also felt bad that I called the police on my next-door neighbors when they were screaming and breaking things. Personally, I don't think so. I prefer to think that I might have averted something much worse by getting Portland's Finest out to check out what was going on. Or, maybe, I'm the "scum of the earth" because I'm getting involved in someone else's business...

Re:Hmmm

[driddle]

People think the laws against silly things like noise pollution, parking in fire lanes, etc. are optional, but hey...Not liking a law doesn't excuse you from following it.


I'm sure the pothead I used to live under a couple years ago thought I was "total scum of the earth" after I called the police on his numerous violations of a town noise ordinance, and eventually got him evicted.


I agree people should of course try their best to follow the law. On the other hand I think people should only use the police/court system as a last resort for solving what are essentially private affairs such as you mentioned about the noise issue you had with your pothead neighbor. I would hope before calling the police you had the courtesy of asking you neighbor to be more quite/considerate of your needs, etc. and if that failed followed that up with you landlord. Really that should have been sufficient but if he was really obstinate than I could understand you need to call the police if it was effecting your sleep, work, etc. I am assuming from you comment that you probably did try to resolve the issue on your own but I think must people would not especially the busybody types of the world and that is what really upsets me.

Re:Hmmm

[Anonymous Coward]

Apparently not anymore.

Re:Hmmm

[driddle]

One wonders if the GP feels that neighborhood watch groups are the "scum of the earth" because they're trying to keep their houses, and those of their neighbors, safe.


Well they sound nice in theory and I would hope/expect if my neighbor saw someone shooting me or beaking into my house to call the police. If that is what they are doing then great they are being good neighbors.


Just last night, there was a party across the street that started going wrong (a lot of people - more than 20 - screaming at each other outside). It was only about 10:00 at night on a Saturday but should I have felt bad because I called 9-1-1 to inform them that something very loud and concerning was going on in my neighborhood, even though I wasn't sure that any laws were being broken?


Well first I think using 911 for anything other than a major emergency is an abuse of the 911 service. You really should have just contacted the police via thier non-emergency number. Now I personally think what you did was wrong and unnecessary though I think you heart was in the right place. If you had heard screams for help, gun shots, etc. then you should of course have called the police but if all you heard was some verbal fighting then I really do not see the point in wasting the police's time on a trival matter.


Maybe I should have also felt bad that I called the police on my next-door neighbors when they were screaming and breaking things. Personally, I don't think so. I prefer to think that I might have averted something much worse by getting Portland's Finest out to check out what was going on. Or, maybe, I'm the "scum of the earth" because I'm getting involved in someone else's business...


Well I would not have called the police. Couples fight and they sometimes throw things that is there business not yours. If one of them is really in trouble they can call the police themselves or run to a neighbor, etc. they do not need a neighbor watching them to keep them safe. Of course if you knew that the husband had a history of wife abuse, etc. then I could see you being more concerned/justified in your actions but I doubt that was the case from what you have said. Unless you really witness a crime you should not be calling the police and especially not 911!

Re:Hmmm

[FLEB]

Actually, a law like this might be helpful in a wardriving defence. Since the law mandates security, one could say that an open AP was an implicit invitation.

Still, though, aside from that unintended consequence, I'd rather have it be an explicit liability rather than a requirement. (If data got stolen, you'd be much more liable if you had open WiFi, but it isn't mandated. Kind of like the UL seal.)

Re:Hmmm

[Babbster]

Wow. Your definition of appropriate 9-1-1 use is pretty limited. Had I called the "non-emergency" number, perhaps there would have been more than a short fight (a fight did break out last night between the time I called and the police showed up) before someone got to me and eventually sent out a cruiser.

As for husbands and wives fighting, again, what's the advantage of waiting until you hear a scream for help? Is it that perhaps the police officer who would eventaully come has a few more minutes to pull over somebody with a broken tail-light or going 45 in a 35 zone? Further, if you think that husbands and wives throwing and breaking things in their house during an argument is normal behavior, then I feel bad for your family. That sort of behavior is violent and I'd much rather have an officer arrive before someone gets a shiner (or much worse) than after. If the couple doesn't like that, then they're living in the wrong neighborhood. Perhaps moving next door to someone like you would be a good option...

Re:Hmmm

[PhoenixFlare]

r. I would hope before calling the police you had the courtesy of asking you neighbor to be more quite/considerate of your needs, etc. and if that failed followed that up with you landlord. Really that should have been sufficient but if he was really obstinate than I could understand you need to call the police if it was effecting your sleep, work, etc.

That I did - I think I spoke to him 3 times about the noise, and stuff like throwing junk over his balcony onto the patio, etc. First time we were civil, second time he was pissed but still shut the music off, third time we got into a shouting match at 3 AM and I called the cops afterwards, fourth time he was having a lovely party with blaring music and his buddies slamming the floor with (I hope) impromptu wrestling matches...That was it. About a month after the last time I had to call the police, I got a sudden email from the property manager saying he was moving out a couple months before his lease was supposed to end.

I am assuming from you comment that you probably did try to resolve the issue on your own but I think must people would not especially the busybody types of the world and that is what really upsets me.

Yeah, it's hard to say. I think my wife and I are more patient than most, but I can definately see how other people wouldn't even try talking first, especially someone older - and especially if the law in question doesn't require asking nicely first.

Re:Hmmm

[masdog]

Well I would not have called the police. Couples fight and they sometimes throw things that is there business not yours. If one of them is really in trouble they can call the police themselves or run to a neighbor, etc. they do not need a neighbor watching them to keep them safe. Of course if you knew that the husband had a history of wife abuse, etc. then I could see you being more concerned/justified in your actions but I doubt that was the case from what you have said. Unless you really witness a crime you should not be calling the police and especially not 911!

Think that all you like, but if a couple is throwing multiple objects during a fight, chances are it is worthy of police intervention. Its not always possible for one to be able to call the police themselves or get out and run for help if it is a domestic issue.

Now, I agree that one shouldn't be using 9-1-1 for non-emergencies, but there are times when you have to get the police involved.

Re:Hmmm

[Babbster]

Now, I agree that one shouldn't be using 9-1-1 for non-emergencies, but there are times when you have to get the police involved.

And I agree as well. My issue with GP is simply the definition of an emergency. If I have reason to believe that there is a situation in which violence is imminent, I consider that an emergency - it would be at least a slightly better world if police personnel could prevent as much crime as they address after the fact, but they have to know where to be in order to do so. In my example, had a police officer been walking down the street and heard what I did I think s/he would have gone right up to the door to find out what was going on.

Now, if I see a car parked up on the sidewalk or next to a fire hydrant, someone habitually throwing trash over their fence into my backyard, or even two people involved in a drug transaction...In none of those instances would I consider 9-1-1 the appropriate place to call since none of those activities are serious imminent dangers in terms of people (aside from the person who's doing drugs) or property. If, however, I think a situation could be deteriorating into violence, I feel more than justified getting the cops out rapidement. Better an officer take a little time to defuse a situation rather than show up after somebody becomes a hospital case.

Deep, final thought: If a man has just killed his wife, is it really an emergency? After all, the danger's over...

Re:Hmmm

[driddle]

Wow. Your definition of appropriate 9-1-1 use is pretty limited. Had I called the "non-emergency" number, perhaps there would have been more than a short fight (a fight did break out last night between the time I called and the police showed up) before someone got to me and eventually sent out a cruiser.


Well is it really the police's/neighbor's job to stop every fist fight? I mean is modern society so neutered that a couple of guys can not engage in a honest fist fight? It was not that long ago people use to dual in this county legally. Not that I think people should settle things with dueling or with thier fists but this is/was a free country and I think people should be aloud to decide on their own if they need/want the help of the police or their local neighborhood pro-active crime stoppers.


As for husbands and wives fighting, again, what's the advantage of waiting until you hear a scream for help?


Maybe giving people the benefit of the doubt? I kind of thought America was about assuming innocence not guilt.


Further, if you think that husbands and wives throwing and breaking things in their house during an argument is normal behavior, then I feel bad for your family. That sort of behavior is violent and I'd much rather have an officer arrive before someone gets a shiner (or much worse) than after. If the couple doesn't like that, then they're living in the wrong neighborhood. Perhaps moving next door to someone like you would be a good option...


Well normal behavior is rather subjective and varies alot among different times and cultures. Now breaking things is not good and is of course unnecessary but it is not illegal neither is fighting, screaming, etc. so I really do not see the point of a someone who is not involved in calling the police. The police are not her to prevent every crime they can not nor should they even try that is unamerican. People should be given the benefit of the doubt we should not assume people are breaking the law.

Re:Hmmm

[ergo98]

IMO if someone goes around turning people in for stupid things they are total scum of the earth

"Stupid things" are relative, and selfish, self-centered people of course believe that everything they do is harmless. A shopping plaza near here endlessly has major traffic problems -- not because it can't handle the volume, but because lazy, selfish, douche-bags park their cars right on the store fronts to save themselves a walk. The parking enforcement should be equipped with hammers to smash their windshields and to give them a $2000 fine, because it's that sort of selfish, self-centered, costs-everyone-else actions that lead to people hating one another. Follow the god damn rules.

I think the only time one should report people

Give me a break. Do you live in Soviet Russia or something? Are you talking about reporting people to the Nazis or something?

I live in a city with some pretty basic laws and regulations -- unless you're a complete and utter twat, there is absolutely no problem following them. These rules are to ensure that people live not only for themselves, but with their neighbours in mind as well. It would be a better world if every asswipe that thinks the rules only apply to others were immediately and harshly dealt with.

Re:Hmmm

[RemovableBait]

Deep, final thought: If a man has just killed his wife, is it really an emergency? After all, the danger's over...

Yes, because if he has *just* killed his wife then he still has a murder weapon and is still on the loose. I'd call that a danger! :)

Re:Hmmm

[ergo98]

I would hope before calling the police you had the courtesy of asking you neighbor to be more quite/considerate of your needs, etc.

Do you think his neighbour was unaware that their actions were impeding on the lives of others? Asswipes do what they do largely because they know that most people are cowering in their corners, afraid of being titled a "busybody" (a term that usually means prying/intrusive people. What we're talking about are people dealing with intrusive people) or a snitch, and that most people are afraid of conflict.

Re:Hmmm

[masdog]

You're right, which is why most police departments have non-emergency numbers. In the instances that you mentioned, 9-1-1 would be appropriate only in the drug transaction (if it actually is a drug transaction). The ones where the car is parked incorrectly or where you have a neighbor throwing trash into your yard could involve the police, but there is a number you can use to contact them which won't have them running to your property with full lights and sirens.

Even in those cases, though, the police shouldn't be involved except as a last resort. It never hurts to talk to your neighbors first to try and resolve the problem.

Re:Hmmm

[MobileTatsu-NJG]

ERm, you're not, by chance, living in a complex called Wimbledon are you? Because that sounds exactly like my experience living in Portland. Heh.

Re:Hmmm

[Babbster]

You're right, which is why most police departments have non-emergency numbers.

That was indeed the point I was making, and, yes, I would certainly talk to neighbors first for those relatively minor problems - I probably should have been a bit clearer. :)

In the instances that you mentioned, 9-1-1 would be appropriate only in the drug transaction...

Really? See, there's an example of a witnessed crime that I wouldn't consider "9-1-1 worthy." I'd probably still report it, particularly in my own neighborhood, but I wouldn't consider it that vital for the police to get there quickly.

Re:Hmmm

[Babbster]

What is all this "benefit of the doubt" crap? It's for the police, judges and juries to give "benefit of the doubt." If a police officer comes after my call regarding a domestic disturbance next door, then it's that officer's job to evaluate the situation. My responsibility, as I see it, is to report the situation if I perceive it to be dangerous.

As for settling things with fist fights, I think you're out of touch. While it's true that, in theory, two people can fight each other if they've given consent, it's not something that's condoned in much of adult society. People who get in fights are, in my experience, usually considered either stupid or crazy. According to the law, if someone doesn't want to be hit, then the person doing the hitting is breaking the law. Now, if I witness someone get punched in the mouth and the person fights back, what's my responsibility? To stand back and say, "Well, they'll feel better once it's out of their systems"? Maybe I should stand around cheering them on? In truth, if I was close (and if it was only two people), I'd break that garbage up - and I have. If I felt it was too dangerous to get involved myself, I'd call someone (like the police) who could stop it.

Hitting people isn't acceptable and, in most cases, IT'S A CRIME.

PS- It's not "unamerican" to try to help out your neighbors, whether next-door or far away. If your only goal is to get people in trouble, that's one thing. If your goal is trying to help see that people don't get hurt, that seems about as human as it gets.

Re:Hmmm

[mattgreen]

Well said. If you think about the argument not in terms of neighbors, but in terms of friends, then you'll see why driddle's point doesn't hold water. Would you rather have a friend who just played it safe and left you alone all the time? Or would you want someone who is gonna confront you when they see you're making bad choices in your life?

Re:Hmmm

[Robocoastie]

and how many hours of tax payer time and paper was wasted on this which should be common sense by all computer users?

Re:Hmmm

[blackest_k]

"t never hurts to talk to your neighbors first to try and resolve the problem."

I think that depends on the neighbor. I know of one case in Lincoln uk in an area called st giles where two neighbors fell out over a hedge. The end result one of them killed the other.

As for domestic violence as its quaintly called, yes call the police everytime. There are a lot of women put up with this kind of violence by their husbands a lot of children terrified by thier fathers.
Every occurance that is reported will be recorded and when the wife or children are eventually damaged enough for the situation to no longer be ignored and a prosecution made. Then there is a history of violence that the judge will be able to see when deciding what sentence to impose.

So call please , call everytime.

Re:Hmmm

[Spazztastic]

Clearely the most influential statement made this entire article. Someone downloads child pornography on YOUR network, YOU are liable. YOU will have the FBI raiding your computer. YOU will be the one going to court. And I am sure they will be very interested in those few thousand MP3's you have stored on your hard drive, or those couple of movies that are distributed by the MPAA.

One quick drive down my street with a sniffer and you'll find 25 networks that are open and you can easily carry out an illegal activity or malicious attack with. It's common sense, but many don't have it when it comes to computers.

Half of them are still using the Linksys SSID for that matter!

Re:Hmmm

[Spazztastic]

You overlook that many do not have the knowledge of even typing in a simple IP address and using the default username/password. I was asked to secure my neighbors network the other day. I told him I could easily do it from home if it is wireless, which it was. Default SSID, administrator password, and he had half the neighborhood leeching his internet. His fault? No. He's a retired steel mill worker, not one of the pioneers of the information age. No, that isn't required to know how to RTFM, but it sure as hell does help.

Re:Hmmm

[Maxwell'sSilverLART]

Governments--particularly small governments--love enforcing stuff like this. Why? It's simple.

Revenue.

Small governments (city/county) usually make a large portion of their revenue from fines. Consequently, they love trivial little laws that everybody breaks, and they really love busybody informants. This is just another way for the government to make money, and it has the added benefits of A) not being a tax increase, and B) duping the ignorant into thinking the government is Looking Out For Them.

Re:Hmmm

[s31523]

I agree... They must have all their other problems figured out to be wasting tax payer dollars on this kind of crap. You know what, if someone uses a wide open net to do things that should be done in a secure manner and gets burned, it is their problem, not the great state of NY or any other government. Just another instance of the man trying to make it so people aren't responsible for their own actions.

Re:Hmmm

[drdewm]

You will of course get mod'd down for this becuase people don't want to hear it or believe that it's true but their lack of belief doesn't make it any less true. Land of the free, right.

Re:Hmmm

[Anonymous Coward]

Yes, you would be considered a busybody. You are too concerned with the actions of those around you. Focus more on yourself, and stop using 911 for non-emergencies, damn it!

But information wants to be free!

[needacoolnickname]

Espescially client credit card info, home phone numberes, social security numbers, purchase history...

Re:But information wants to be free!

[pilgrim23]

Being New York, I am suprised that this law does not mandate a 5 day waiting period from the request to reciept of a packet with requisit forms for each packet filled out (triplicate) and no more then 5 packets received in any 30 day period..

Re:But information wants to be free!

[takeya]

They do, but this only applies to encrypted packets.

Not really security

[flooey]

From the article:

The law requires each business to install a firewall or change the default SSID, the name that identifies a wireless network, if the personal information stored has not already been encrypted.

Umm...changing the SSID does nothing, in terms of security. If that's all that's required to satisfy this new law, I'm amazed.

Re:Not really security

[JazzCrazed]

Yeah, probably they mean to enforce changing the default admin login on routers.

Re:Not really security

[Intron]

I just changed my SSID to "MBNA_Client_Accounts". Now my wireless domain is safer from hackers!

Re:Not really security

[Peyna]

I always wondered why wireless routers allow the wireless network to access the admin login by default at all? It should be limited to the wired network by default.

Re:Not really security

[kryzx]

Let's also require that all vehicles have a red blinking light on the dashboard any time the owner is not in the car. But it's your choice on whether to lock the doors or leave the keys in the ignition.

Re:Not really security

[Peyna]

"Minimum security measures" shall include, but not be limited to: (a) installing a network firewall; (b) changing the system's default SSID (network name); or (c) disabling SSID broadcasting.

Any commercial business that stores, utilizes or otherwise maintains personal information electronically shall be required to take minimum security measures as defined herein to secure and prevent unauthorized access to all such information.

So it does look like just changing the SSID would be enough to fulfill the requirements of the law; however, the real purpose of the law was just to bring wireless security to the attention of these businesses. If it inspires a few of them to take a minute to evaluate their wireless security and then do something about it, chances are they will do more than just change the SSID. The fines available aren't severe enough to compel anyone into compliance.

Re:Not really security

[gEvil (beta)]

So, will I get fined if I change my Netgear router's default SSID of "Wireless" to instead read "linksys"?

Re:Not really security

[gameforge]

Well, if you also turn off SSID broadcasting, people won't see your router from the list of available ones; if some WiFi troll comes along looking for routers that don't broadcast their SSID, 'default' would be a pretty obvious one to try, if not using special tools designed to look for such networks (you may be able to see the SSID in WiFi packets, although I have no idea for sure)

Plus, anyone who has a network profile for a router called 'default' may inadvertantly connect to it if they wander into the same airspace (SSID broadcasting on or not).

Really pretty negligible considering that encryption alone would prevent all of this, although is not bulletproof itself.

Re:Not really security

[Acid-Duck]

Well if they leave their SSID as "Linksys" and said intruder happens to have a huge collection of exploits for diff routers I guess you'll just be making the task easier for him to figure out which of is 0day exploits will work :P

Re:Not really security

[networkBoy]

o_o
My sunday morning just got lots brighter. Thanks for the laugh.
-nB

Re:Not really security

[networkBoy]

yup, even with wep/wpa you can sniff the ssid off packets.
-nB

Re:Not really security

[Abcd1234]

So why pass a law in the first place?? Just start a public information campaign. Send fliers, broadcast commercials, that sort of thing. Laws should be our *last* resort when trying to deal with any sort of issue, and that includes technical ones.

Re:Not really security

[Kuciwalker]

Stores can ignore public information campaigns. They actually have to do something (and, by extension, think about it) if there's a law.

Re:Not really security

[causality]

Laws should be our *last* resort when trying to deal with any sort of issue, and that includes technical ones.

Oddly enough, the legislators don't see it that way. Fancy that!

It reminds me of how I see people discussing the whole abortion issue. Whether you are for or against it, I will not get into that one. But just the way the question is framed: "The question is, does the Constitution give the people the right to have an abortion?" This is bullshit. The appropriate question is, "Does the Constitution give the government the right to forbid them?" It's a bit like a firewall - the best way is to deny everything by default and only allow what is explicitly defined. The prevailing view of government's proper role these days seems to be to allow everything that is not explicitly forbidden, which is an unwise policy.

Once you make the basics like murder and theft and fraud illegal, what else is there for a full-time legislature to do but fight over the budget and assume that all of the world needs their "help"? If people refuse to either secure their networks or hire someone who can (much as people either maintain their cars and keep them in good repair, or hire a mechanic who can) then they need to experience the full consequences of their failure to understand what they are working with.

Re:Not really security

[Penguin's Advocate]

This is westchester we're talking about. Laws are ALWAYS the first resort. After they fail, then the broadcasts and the fliers start. These laws will not be regularly enforced. If they are ever enforced, they will only be enforced upon the people least able to afford it.

Re:Not really security

[Lesrahpem]

This could actually be a bad thing. One thing I have noticed is that most businesses do change their SSID's. They tend to change them to relfect which business owns the AP. So, if it's a targeted attack, this law makes the security worse by making it easier to figure out which AP belongs to which business.

Re:Not really security

[Anonymous Coward]

Once you make the basics like murder and theft and fraud illegal, what else is there for a full-time legislature to do but fight over the budget and assume that all of the world needs their "help"?

One might be surprised at the multitude of ways people have discovered to fuck each other over. The role of a legislature is to make all but theirs illegal.

Re:Not really security

[Anonymous Coward]

I always wondered why wireless routers allow the wireless network to access the admin login by default at all?

Probably all the support calls the makers get.

"WHAA! My Wired less is broken!"

"No, you have to change the settings from an ethernet connection"

"WHAA! What's ethernet, I bought WIRED LESS I want WIRED LESS! You suck I'm going back to AOL where they have the latest version of the intar web!"

Re:Not really security

[Rich0]

Once you make the basics like murder and theft and fraud illegal, what else is there for a full-time legislature to do but fight over the budget and assume that all of the world needs their "help"?

Uh, without wanting to open this can of worms any further, you do realize that the folks who want to ban abortion want to do so because they think it is murder?

Unfortunately, this debate is rightly one which government should take an interest in. Now, you can question whether in fact embryo's are covered by "life, liberty, pursuit of happiness" or not, but this is very much a constitutional issue.

Re:Not really security

[Joe U]

Changing it to Andrew_Spano_is_an_ass would be much more entertaining.

Re:Not really security

[Chandon Seldon]

Murder, like anything else, is allowed by default. The only reason it's illegal is because a specific law was passed against it. It seems like the specific wording of the law(s) against murder doesn't cover abortion (on the basis that there have been no murder trials due to abortions). Therefore, abortion will be allowed until a law is made against it.

Re:Not really security

[gad_zuki!]

>If it inspires a few of them to take a minute to evaluate their wireless security and then do something about it, chances are they will do more than just change the SSID.

Err, thats a big IF. Weigh the cost of passing and enforcing this law say versus a public information campaign. You're essentially using flawed reasoning of "if we could save just one life this whole thing would be worth it" which ignores opportunity cost and the reality of limited funds.

Re:Not really security

[Cheapy]

Because if people start to have secure networks, that means that people can't get online for free, and then they have to start paying companies.

Re:Not really security

[takeya]

"Sir, this router was open and accessible for all to see, and that man stole your credit card number. I am going to have to fine you $500 for this offense."

"But officer, I had changed the SSID! It was "lynksys" now it is "my house.""

"Oh, I see. This isn't such a terrible crime after all, well, go along then."

Re:Not really security

[guabah]

Yeah but by putting an SSID diferent than just Linksys or 2Wire would make it slightly more dificult for the bad guys to figure out wich equipment is being used. And a little of MAC address spoofing could add up to the confusion of the average wardriver's mind. And this law is not meant to stop the good hackers. It's more a way to keep the "Joe Wannabees" from trying.

Re:Not really security

[Domstersch]

The prevailing view of government's proper role these days seems to be to allow everything that is not explicitly forbidden, which is an unwise policy.

Oh, you mean we should be doing:
iptables -F legislation
iptables -P legislation DROP

Surely that's a bad idea. We'd have to have a seperate firewall rule (uh...law) for every legal activity (and there are a whole load more legal activities then there are illegal ones). I'd need to change my iptables configuration every time someone inverts a new word or discovers a new scientific innovation - just to, you know, ACCEPT it.

Re:Not really security

[masdog]

If they wanted to bring the matter of wireless security to the attention of businesses, then they could create a pamphlet or put up information on the county webpage. If they wanted to legislate wireless security, they would require encryption. If they wanted to keep public users from accessing company data, the law would require the hotspot to be on a seperate subnet or Internet connection.

This bill is like the PATRIOT ACT, a feel good measure that makes people think the government is actually doing something.

Re:Not really security

[langelgjm]

Umm...changing the SSID does nothing, in terms of security.

Well, if I'm looking to hop on someone's network, I always go for the ones called 'linksys' first... so maybe I'd be less likely to hop on theirs!

Re:Not really security

[MobileTatsu-NJG]

"So why pass a law in the first place??"

Because I don't want my credit card info stolen due to negligence from a company that's supposed to be holding my data securely.

"Laws should be our *last* resort when trying to deal with any sort of issue, and that includes technical ones."

Normally I would agree, but not this time. If my cc company were broken into because they had an insecure wireless router, I'd want to nail their asses to the wall as well as the person who stole in the first place. We're talking about securing sensitive data, here, not Joe Schmo sitting in his house playing quake over the wlan.

Re:Not really security

[Rich0]

Well, sure, which is why it is legal right now. However, that doesn't change the fact that there have been political fights over the last 20 years as to whether such a law should exist, and in various states laws are on the books to varying degrees.

Obviously this isn't an issue that is going to go away anytime soon. I was just pointing out that you can't just wave your hands and say "government shouldn't do anything but prevent theft and murder" and expect all of politics to go away as a result...

Re:Not really security

[MikeFM]

What about the number of busineeses brilliant enough to put network ports in places that are open to the public? I've been able to jack in my laptop in hallwalls, waiting areas, and even outside of many businesses and government offices. What about fully wired PC's running Windows that get infected, hacked, or otherwise owned?

It seems to me that busybody laws about specific technical choices aren't a good thing. Better to just make a general law about liability of businesses for leaked personal or financial information. Make them fully liable for all damages and throw in a hefty fine. Who cares how the information is leaked? If your lack of security hurts someone else then you should be liable. Maybe limit their liability and fines if they can document a good effort at securing that information. Not just having a security policy either - something solid such as daily security patches, virus scans, having proper firewalls, etc. I'd be tempted to fine anyone running Windows but I imagine Microsoft would use their money to kepe that from becoming law.

Re:Not really security

[Maxwell'sSilverLART]

So why pass a law in the first place?? Just start a public information campaign.

Because the government can't collect revenue from people ignoring a "public information campaign."

Re:Not really security

[causality]

Hey dumbass, I was talking about what the GOVERNMENT can do. I.e. the GOVERNMENT cannot do anything at all, until and unless the Constitution allows it to do so. I was not referring in any way whatsoever to what citizens can and cannot do; for them it would be the opposite; they can do anything they like until and unless it is made illegal.

Re:Not really security

[Domstersch]

Oh, damn, I am totally sorry. A dumbass like me get's quite mixed up when smart people like you start talking not about legislation, but about legislation about legislation. Got meta?

I'll assume we're talking about the American constitution and go ahead and ask you: if the constitution is (or should be) made to limit the role of government to a default deny all, wouldn't *it* need to be amended every time the government needs to pass a novel law?

Besides which, who would be amending the constitution? Oh, that's right, some other group who aren't restricted by a meta-constitution and can pretty much make whatever amendments they like. Another one of those pesky free until not-free situations that you seem to be so concerned the government has.

Bottom line is that abstracting up a level won't save your argument.

Re:Not really security

[causality]

I'll assume we're talking about the American constitution and go ahead and ask you: if the constitution is (or should be) made to limit the role of government to a default deny all, wouldn't *it* need to be amended every time the government needs to pass a novel law?

No, it's more like they interpret the "implied powers" in whatever way is most convenient... For example, if the founding fathers intended for the government to regulate what one can and cannot do with one's own body, they likely would have stated this plainly (and I strongly doubt that they would have wanted this; I can tell you what you may and may not do with my car because I own it and for the state to tell you what you may and may not do with your body implies that the state owns your whole person). As they did not, the "interstate commerce" clause is interpreted to allow Congress to conduct a "drug war." Nevermind that someone who were to, let's say, grow their own marijuana on their own land and use it on their own land (which would be a silly thing to do in this current climate of drug hysteria) is not conducting interstate commerce, nor commerce of any sort.

Also, I was talking more in terms of how I believe it should be; in US History classes I was also taught that this was the intention of the Constitution - that is, to grant the government powers that it otherwise does not have, versus placing specific limits on an otherwise all-powerful government. See also the 10th amendment.

Furthermore, an example of the Constitution being amended in order to pass a novel law was the 16th Amendment. The founding fathers saw no need for the government to have an income tax - one can only guess as to why this is, but I like to think that in their wisdom they understood how easily this can be abused to control behavior in the form of tax incentives and the enormous amount of information on, and tracking of, the citizens that is necessary in order to enforce an income tax. The founders probably would have agreed that where you work, where you live, how much money you make, whether you are married, what dependents you have, and all the other personal information we have been conditioned to give to the government without question today, is not the government's business. At any rate, the 16th Amendment was ratified for the sole purpose of allowing this form of taxation. Perhaps it would interest you to know that this was sold to the people as a temporary measure that was necessary only because of the war we were fighting at the time, which is the same old pattern being used now with the Patriot Act and other recent power grabs.

Also, I could have done better than to call you a dumbass but I was frustrated... it is frustrating when you have a point and you attempt to express it, and rather than find the interpretation that does make your point, people instead choose the interpretation that most harms the point you are trying to make. You cannot really do that without knowing what the point was, so the fact that it was missed comes across as willful and designed as a straw man device. If this was not the case, and from your reaction it seems not, then I am sorry for not finding a more graceful way to express my frustration with that.

Re:Not really security

[Domstersch]

Hell, I deserve to be called a dumbass. I spelt 'gets' with an apostrophe. Oh, the eternal shame.

In other news...

[HotNeedleOfInquiry]

Westchester County has outlawed all glass and china dishware, knives and pencils longer than 2 inches and water over the temperature of 120 degrees F.

Re:In other news...

[twitter]

You might not have noticed that they just made free software use more difficult. You will, at the minimum get Kwifi going if you have more than one wireless network you want to use. That won't always work, because of all the different little "standards" used by equipment makers. Windoze users, of course, will have a harder time too, but they expect and travel less to begin with.

It's not funny. Mandating "security" without mandating it be implemented with accepted and published standards is counterproductive. Half ass "security" measures like this do more harm than good. If they were really worried about securing personal information, they would outlaw keeping that information with an OS that has a 12 minute half life on any network. By enacting an admittedly useless precautions, they are enforcing the notion that security in general is nothing more than an inconvenience to the user.

Re:In other news...

[Anonymous Coward]

hi - are you going to reply to this soon?

Dupe

[BenFranske]

Maybe they think if the dupes are spread out by a few months instead of a few weeks we'll forget about them. This story was covered in November. Maybe if the Slashdot search system was improved the editors could find this out themselves.

Re:Dupe

[TubeSteak]

The old article was "they're trying to do this"
The new article says "they did it"

A lot of laws get drafted, proposed, and then rejected.

This one didn't. So how is it a dupe?

Re:Dupe

[HoosierPeschke]

Not a dupe, a continuation. You took all the time to search for the story but you didn't bother to read it. The first story was about the proposal. This story is about the enactment. The only dupes here are the comments about this story being a dupe.

Re:Dupe

[Anonymous Coward]

I like how you duped the guy right below you. Sorta funny.

I also like how when there is one minor change in detail that it somehow makes it not a dupe. Its a dupe. We knew about it happening. This belongs in a Slashback, not a new story.

I'm pretty sure he did read it, otherwise he wouldn't have known it was a dupe.

Re:Dupe

[Ohreally_factor]

The only dupes here are the comments about this story being a dupe.

I'm going to go back to the first article, cut and paste the comments modded insightful, and whore up my karma, so we'll have a greater variety of dupes here for this article.

Re:Dupe

[BenFranske]

I most certainly did read both articles. Really, there's nothing new other than the law has now been passed. The rest is just a rehash. The fact that the Slashdot article summary doesn't point out this was discussed before and the only new information is the law is not in effect makes it a dupe as far as I'm concerned. As others have mentioned, this belongs in slashback or should clearly be marked as a continuation of an old story. This is a dupe.

Re:Dupe

[MobileTatsu-NJG]

"I most certainly did read both articles. Really, there's nothing new other than the law has now been passed."

Um, that's a pretty big 'new'. Sorry, but 'Informative' mods and narrow rationalization do not make this a dupe.

How come SD is so slow anymore? Loss of interest?

[Anonymous Coward]

Is there no interest in geekland stories any more? Used to be dozen of replies to any story in minutes but now a story is lucky to get a dozen in an hour. What's up with that?

Secure by default

[DrXym]

The Netgears of this world should ship their devices secure by default. The device should be set up to use encryption by default, using a random key (printed on the unit underside and a slip of paper) and the appropriate instructions to let the user figure the rest out.

It can't be hard to do and with the appropriate marketing might shift a few more devices.

Re:Secure by default

[UnderDark]

So, what if you're blind you insensitive clod!

But really, if it uses encryption out of the box, people are going to get angry when there system can't connect to it because people don't read documentation: they just plug it in and let it rip most of the time.

Re:Secure by default

[Anonymous Coward]

The magical selling argument of wireless devices is that they work out-of-the-box.
If you make them "secure by default" you lose that and Joe Average will have a hard time even realizing that he needs to type a passphrase to make it work.

Re:Secure by default

[gabebear]

What encryption should be enabled? WEP is pathetic all the way around and WPA-PSK complicates things and isn't supported everywhere(i.e. Nintendo DS).

Anyhoo, encrypting public access points is stupid. It's impossible to make sure someone isn't snarfing your traffic(rogue access points) so any confidential information needs to be encrypted at each end with something like SSL w/ 1024bit RSA.

Re:Secure by default

[mapkinase]

Yeah, right. Like they are prepared to pay for additional support they will have to provide to living room "administrators"...

Re:Secure by default

[mapkinase]

How about: first connected node gets a wizard in its face obliging him/her to enter a secure mode?

Re:Secure by default

[ettlz]

Anyhoo, encrypting public access points is stupid. It's impossible to make sure someone isn't snarfing your traffic(rogue access points) so any confidential information needs to be encrypted at each end with something like SSL w/ 1024bit RSA.

The point about encryption between the start and end points should apply to any public network as one rogue router is all it takes. Nevertheless, there's no reason why public access points cannot be encrypted — use something like EAP-TLS WPA but without the authentication. The client obtains a public key from the access point, constructs an AES session key and sends it to the access point with whatever public key cryptosystem it uses.

Re:Secure by default

[Sexy Bern]

The first connected node might not be the owner, but a neighbour etc.

Re:Secure by default

[eh2o]

FWIW 2Wire's routers come this way, at least the ones that SBC sends out to customers. And in my experience networks with the 2WIRE* SSID are much more likely to be WEP secured than the average, suggesting that customers don't bother to go into the control panel and disable it.

Re:Secure by default

[PopeRatzo]

Actually, on some routers it is kind of tricky for the average person to setup basic WEP security. Think of the guy who just wants to be able to use his laptop around the house without running wires everywhere. For what it's worth, when I first moved into this neighborhood, a very densely populated area of a large US city, I went more than a year without ever having to pay for internet. I just installed a wireless NIC and immediately found more than a dozen unsecured routers within wifi distance. And the speeds weren't bad at all. Right now, Windows can see 6 unsecured routers nearby, not counting the high school down the street or new condo building that STILL hasn't set security on it's wifi network. If it wasn't for the fact that I have some "special" needs, I wouldn't be paying for internet access yet. And when I recently used bittorrent to get V for Vendetta, I turned off my own ISP and used one of the many open routers for the couple of hours it took to get the movie.

Re:Secure by default

[Anonymous Coward]

"I just installed a wireless NIC and immediately found more than a dozen unsecured routers within wifi distance."

It is unsecured in the fact that you can use it. It is also unsecured in the fact that someone could have stolen your online banking info or any other personal information you did on the internet.

"And when I recently used bittorrent to get V for Vendetta, I turned off my own ISP and used one of the many open routers for the couple of hours it took to get the movie"

Nice, so when you are doing low bandwidth stuff which wouldn't appreciably degrade the service of others you use your own network. When you commit IP infringement and use massive amounts of bandwidth you make it hard on those of us generous enough to share even though you've already paid for your own service...classy.

Re:Secure by default

[AnyoneEB]

Actually, I was a CompUSA recently and I saw a display for a Linksys AP/router with a button which was labeled that it auto-configured with default secure settings. I am not sure exactly what it did, but if something like that is standard on one brand, other brands will be forced to follow suit or appear unsecure (even though they probably all support essientially the same security features).

Re:Secure by default

[arodland]

WPA-PSK "complicates" things? The standard setup, which you're likely to see in home use, is like WEP, except you don't have to worry about bullshit like "why is this giving me four different slots for the key?" and "what's a hex?". All the information I need to provide to connect to my network is SSID, and PSK (an ordinary string, which gets securely hashed, the same way mind you, into a key on all of my devices).

Support is a little more of an issue, but actually not relevant for situations like TFA. If you're setting up a network in your business, you don't have to support Nintendo DSs. And you can just buy network cards with drivers that have made it out of the stone age.

Re:Secure by default

[Anonymous Coward]

It is also unsecured in the fact that someone could have stolen your online banking info or any other personal information you did on the internet.

No, they can't. How can you assume the internet is any more secure than a random unsecured private network, it isn't. You can just as easily have a compromised router on the internet sniffing your packets as you could on a random unsecured private network. You may also want to find out how SSL works, it will encrypt your data all the way from your PC to your bank's server, so there is no way anyone can find out your bank details just because you happen to use their network.

Re:Secure by default

[swillden]

It is unsecured in the fact that you can use it. It is also unsecured in the fact that someone could have stolen your online banking info or any other personal information you did on the internet.

Right, because all the other parts of the Internet that your packets cross between the WiFi AP and the bank are so secure.

Re:Secure by default

[Skater]

And lets face it - the encryption is frequently not done correctly. I set up a friend's wireless network with WEP and all, only to have to go there every time she got a new roommate because they could never get the connection to work correctly - and half the time, I couldn't, either. I recall one incident where I read the key off my laptop's screen, typed it into the roommate's computer, got it working ... but my laptop wouldn't connect (and was working just fine previously). Then a few weeks later her laptop stopped being able to connect, and she'd done nothing to it. Very frustrating. I finally had to remove the encryption setup so she could use her network reliably.

My new dream for wireless routers is to have an authorization screen where the user has to give it a password to do any surfing, much like hotels and some restaurants have. My friend could easily post the password in her house for her roommates and friends to use, but it would be (relatively) secure from people using her connection without authorization. Rely on SSL encryption for security at websites. Obviously each computer would have to have its own firewall as well, but that's no problem these days either.

Re:Secure by default

[Anonymous Coward]

Actually, I was a CompUSA recently and I saw a display for a Linksys AP/router with a button which was labeled that it auto-configured with default secure settings. I am not sure exactly what it did, but if something like that is standard on one brand, other brands will be forced to follow suit or appear unsecure (even though they probably all support essientially the same security features).

If you push a button on the router's front panel and then click a button in the wireless card's Windows control applet, then the two will automatically negotiate a WPA key. Of course, this only works if you buy a Linksys router and wireless card. (Not that that's necessarily a bad idea: Linksys makes very decent consumer routers, and nowadays their wireless cards use one of the few 802.11g chipsets with a fully open-source Linux driver.)

Re:Secure by default

[gabebear]

The comment I was responding to was about enabling encryption on units before they ship; any business using the default configuration is, well..... anyway, LEAP/PEAP is a much better solution for businesses.

Most home users would be perplexed by HEX keys with four places to put them.

Nanny state alliteration troll.

[Anonymous Coward]

Forcing fellows to face fines for failing to follow fallacious fads? Fuck!

Preposterous postulations by porcine politicians pretending to protect the proletariat will proceed to provoke the passion of a pissed population, leading to lazy losers loquaciously loosing lamentations for civil sovereignty on slashdot.

Re:Nanny state alliteration troll.

[Khyber]

Your pathetic attempt at a spoofing of V's monologue from V for Vendetta is horrible. I need to rinse my eyes out, now.

Text of the law

[Peyna]

The text of the law can be found here.

Re:Text of the law

[snarlydwarf]

Oh, my.

It really is as lame as reported: disabling or changing SSID's is not security.

"I changed my house number from 8903 to 8309! Hah! Now the burglars won't find my house!"

or "I took the house number off my house, now it isn't even visible! No one will know it's there!"

Those are almost exact analogies to the amount of security difference changing SSID or disabling broadcast gives.

Re:Text of the law

[Anonymous Coward]

It doesn't seem to cover configuring your devices not to use 2nd-tier NTP servers... haven't the lawmakers been reading the news?

Stupidity.

[hyfe]

Next step is to draft and enact a law making it a criminal offence not to lock your door. Won't take long 'till the whole family is gathered, together again, in prison/workcamp. It'll be fun!

Re:Stupidity.

[BSAtHome]

Yes, throw 99.999% of the population into prison and you will not have any problems anymore. Lets start with locking away the politicians. Maybe the penalty should be death, then you do not need to provide for those law-breaking suckers anymore. Another winning point in this scenario is that the trafficjams get resolved.

Re:Stupidity.

[MobileTatsu-NJG]

"Next step is to draft and enact a law making it a criminal offence not to lock your door. Won't take long 'till the whole family is gathered, together again, in prison/workcamp."

This is more like a law requiring businesses that house sensitive info (like credit card #s) to lock their doors when nobody's around. There is no 'next step' to arresting your family. You really should read the article.

Commodore

[Two9A]

If I'm not mistaken, Westchester was the town where Commodore set up its headquarters, in its heyday of the PET/VIC series. Would they be required to conform to this law, or would they not fall under the 'small business' provisions?

(Ignoring the fact that Commodore would probably implement their own wireless standards with lowest-cost components, to exempt themselves.)

Re:Commodore

[benzapp]

There is no town of westchester in Westchester County. At least, there hasn't been for a long time. There is a neighborhood of the Bronx nominally known as Westchester, from before it was part of New York City. There is however a town of Eastchester.

Anyway, its IBM that is located in Westchester, Armonk to be exact.

Re:Commodore

[Name Anonymous]

You're thinking West Cheste in Pennsylvania and not Westchecter County in New York.

Also, if you hadn't noticed, Commodre is kinda dead.

Is Starbuck's Secure?

[nickfrommaryland]

From the article:

Some of the unprotected networks were at cafes, hotels or other establishments that offer wireless hot spots to patrons. Other networks, like those at Starbucks, were protected.

The last time I checked, T-Mobile's service is not any more encrypted than a Netgear router taken right out of the box. Likewise, a sign will probably not protect you from much, unless you're a business. Then you can use the sign to protect yourself from liability.

Re:Is Starbuck's Secure?

[Anonymous Coward]

The last time I checked, T-Mobile's service is not any more encrypted than a Netgear router taken right out of the box

The last time I checked, T-Mobile's service wont get you any network access other than their captive portal, unless you pay them a fee

so i would say thats pretty secure, unless t-mobile have suddenly started giving it away for free

Re:Is Starbuck's Secure?

[HermanAB]

They do not use encryption, but the routers do provide a firewall - meaning that they will not allow unrequested incoming connections to the patrons. So there is some basic client protection. For that matter, even the worst linksys/netgear/whatever routers do that.

Re:Is Starbuck's Secure?

[Beryllium Sphere(tm)]

It's "secure" by the standards of this law, which only requires things like firewalls and (cough) changed SSIDs. The law has as little to do with real security as -- as -- help me, BadAnalogyGuy!

Re:Is Starbuck's Secure?

[not5150]

Starbucks T-Mobile offers WPA encryption and has offered it for several months. However, customers are not required to use WPA. Most probably choose wide-open unencrypted mode.

That being said, you must enter in a username/password to get past their captive portal page.

Re:Is Starbuck's Secure?

[quantum bit]

False sense of security. A firewall may prevent incoming connections from random parts of the internet, but will do nothing to protect clients from each other. Since the network is unencrypted, anyone in range can hop on and hack away (or better yet just sniff the packets).

Security really needs to be enforced on the individual clients -- there's just too many unknowns to try to do it at the network level. After all, the Internet is based on the idea of a "dumb" network and "smart" hosts.

Re:Is Starbuck's Secure?

[HermanAB]

Of course, but Fourbucks or T-mobile, can't reasonably do more than what they are doing. If you want to walk in front of a train, it isn't reasonably someone else's fault.

No... I like my free wifi

[9mm Censor]

Please dont obey this law, unprotected wifi makes me using it easier.

Re:No... I like my free wifi

[IHC Navistar]

Kudos to that! I've been leaching off my neighbor for damn near forever.

If I can't sponge off of my neighbor's WiFi, why can the airhead legislators who have enough time to sit around and think of ways to protect me from myself sponge off of my tax dollars?

Re:No... I like my free wifi

[Sigg3.net]

Setup an open Wifi access point today!
WiFi Internet Access Everywhere
FON, share locally, enjoy globally!

The wrong goal

[kilodelta]

This is all to protect private information that might be on the local area network of the entity providing wireless connectivity.

At work we put our wireless access on the back side of our WAN connection, and that goes through a proxy with ClamAV on it. They never even touch our internal network.

Sure we took reasonable steps. When I first got my new machine with wireless I saw at least 4 businesses with wide open networks. Went over, introduced myself and showed them how to secure the networks.

What I'd be more worried about is home networks that don't use at a minimum one of the three possible methods of preventing unauthorized access. All one has to do is spend five minutes looking at the documentation for your new wireless router/access point and figure out that they want to employ one of 6 or so combinations of features to secure their network.

I broadcast SSID, but enforce MAC address recognition and WPA key encryption. Bit me in the ass when I had to replace a mini-pci wireless adapter recently. Had to insert the new cards mac address but made sure I deleted the old one. I know how easy it is to spoof but it's just one more layer.

Re:The wrong goal

[Anonymous Coward]

All one has to do is spend five minutes looking at the documentation for your new wireless router/access point and figure out that they want to employ one of 6 or so combinations of features to secure their network.

It appears that you nailed the problem in one. You give that manual to the average users and you are going to be fielding questions like "Do I need a WEP key if I'm using SSID security? If I'm running Windows should I just block all MAC addresses?" What the user (myself included) wants is ONE way of doing things. I'm not saying that there can't be others or that the router shouldn't support those but a security specialist (like the guy who designed the router) should know a lot more about which of those combinations offers the best combination of ease of use and security.

Another way to put it is to imagine walking an average user (the canonical mom) through a router setup over the phone. You probably won't ask whether she prefers WEP or WPA. You will use your knowledge to pick a decent (maybe not best) solution and walk her through the recipe for configuring it.

Warnings on pants zippers.

[Anonymous Coward]

Why stop with mandatory firewalls? We need to put warnings on pants zippers. There have been many a case of men getting their penile tissue caught in such devices. Frankly, I think some of those zippers may even be terrorists, whose only goal in life is to destroy the freedom that American cocks enjoy. A big warning label on the front of pants could alert vulnerable men to the danger posed by these rogue, genital-hating zippers.

Shutting off Wi-Fi

[HPNpilot]

I already have several calls from clients who want me to shut off open access in their places of business. Yes, they have firewalls and are protected, but the DA Jenine Pirro has come out and said how open wireless hotspots help pedophiles and stalkers and these business owners do not want to get involved with this political hot potatoe in any way whatsoever. Their feeling is that it simply is not worth the risk anymore.

Re:Shutting off Wi-Fi

[bigpat]

pedophiles are the new terrorists... politically speaking.

Gotta love fear mongering. Some people just seam to be born to want to make other people jump through hoops.

Re:Shutting off Wi-Fi

[chromozone]

A couple times a year I get Andy Spano (Westchester Supervisor) leaving me messages on my answering machine urging me to get my prostate checked. Does he have nothing better to do? The guy is a nanny state whore and everything he does is calculated for PR - like Piro. We have bird flu coming but a water filtration plant for a reservoir over run with geese has been held up while they dig for arrow heads.

Oh Spano is also president of County Executives of America. I'm sure he loves that "first law in the nation" tag. Doesn't surprise me a bit places just want to turn off the switch now.

.

Re:Shutting off Wi-Fi

[ScottCooperDotNet]

So you're saying DA Jenine Pirro is spitzering into Spitzer's job?

Re:Shutting off Wi-Fi

[Rich0]

I'm sure verizon et al aren't complaining - makes more a market for "legitimate" providers...

What's the point?

[Anonymous Coward]

I'm posting this from an unsecured wifi network in Manhattan. In the past ten minutes I've lost connection three times. Why bother securing it when people using the access point can't even stay on the net to post a comment to slashdot?

MOD PARENT UP

[backslashdot]

It'll only stop seeming unlikely until it happens.

Some people want their system "insecure" by choice, knowing not everyone in their neighborhood/family can afford it yet. And no i do not see it as stealing or morally wrong to allow others on your wifi if you're paying your provider the bandwidth fees they ask for. Same as allowing someone else to sit at your computer.

Re:MOD PARENT UP

[Anonymous Coward]

As long as you're willing to accept all the consequences of that decision (say if one of your neighbors is a fan of kiddy porn and the laws Bush & friends want become law), go for it. You could also secure your network and give the password to your neighbors (when you go over to introduce yourself to them just after they move in, for instance.)

Re:MOD PARENT UP

[SonicSpike]

While I agree with you, there is a bit more to it that what you presented.

First off, even though you pay for it, doesn't give you the right to share it. Why? Because you have nulled that right in a contract by way of a Terms of Service/user agreement. So if anything, "sharing" the service would be considered a breach of contract between two parties (you and provider), not theft.

Either way, the government should stay the hell out and let the markets work it out!

shit.

[twitter]

the real purpose of the law was just to bring wireless security to the attention of these businesses. If it inspires a few of them to take a minute to evaluate their wireless security and then do something about it, chances are they will do more than just change the SSID.

All they are going to do is push a button or tell their IT dude to do the same. Most people don't have time to wade through the vendor BS to learn anyting.

It does nothing for real data security. The easiest way to get data is not to drive, it's to bomb your target's IE or Outlook, at home or at work. Your ISP gives you access to the world and the world access to you. Your WAP gives access to the portion of the world within 100m of your WAP. There are considerably more bad guys in range of your network through one than the other.

Not gonna happen

[PeeAitchPee]

We live in an instant gratification-based society where a very large percentage of the population can't be bothered to do things like read instructions or even a slip of paper. If it doesn't work when it's plugged in and / or switched on, people assume it's broken and return it. And since the competing router comes with security switched off (and seems to "work" when powered up), the consumer translates that into well-thought Amazon reviews such as "WHAT A PIECE OF CRAP ... COULDNT GET TO WORK AFTER AND HOUR, TOOK IT BACK TO BESTBUY AND GOT THE LINKSYS NOUF SAID." That's really the only reason Linksys / Netgear / et al ship their stuff with security disabled.

What about community networks?

[Damek]

What if they're trying to offer free, open wireless access? I guess they can just change the SSID to comply, but really...

Re:What about community networks?

[Bellhead]

Damek,

IMNSHO, this law was written to prevent community networks, or any other free wireless access. It's a FUD tactic to intimidate business owners into closing all open hotspots and thus force all the rich laptop users in Westchester to pay for access. I'll bet T-Mobile and the other players made a campaign contribution.

Now, open your wallet and let them in!

Bellhead

Re:What about community networks?

[egypt_jimbob]

I guess they can just change the SSID to comply

They should change the SSID anyway. Say you're in a cafe that has a sign on the door that says, "Free Wireless Internet!" You start up kismet and see 4 ACTIONTEC 2 linksys and 3 default, all unencrypted, which one can you connect to legally?

What type of security are they enforcing?

[IntelliAdmin]

After reading the article, this line is of interest:

"The law requires each business to install a firewall or change the default SSID, the name that identifies a wireless network, if the personal information stored has not already been encrypted. Penalties would range from a warning on first offense to a $500 fine on third offense."

How would any of this help with the security of a wireless network. I did not see anything regarding the use of encryption - unless I missed it.

Seriously, is this even legal?

[The Second Horseman]

They could probably mandate the signs and they have some authority over the operation of businesses, but if the place is offering free WiFi on (all together now) "unregulated spectrum", they can't do much about it. If your landlord, University, airport operator, etc. can't prevent someone from setting this up or doing it in a particular way, why the hell should Westchester? And, btw, the law doesn't just cover 802.11a/b/g - it would cover using a GSM/Edge/CDMA/whatever-based data service, the way I read it. It just refers to any company offering "wireless internet" as doing business in Westchester, and merely hooking up to the "internet" without cables as "wireless internet". Seems like that would cover Verizon, T-Mobile, AT&T/Cingular, etc.

Re:Seriously, is this even legal?

[ScrewMaster]

And as soon as Verizon, T-Mobile, or AT&T/Cingular, etc. notifies them of that fact I bet the law gets amended in a hurry.

They have no Jurisdiction here...

[Newer Guy]

THIS IS NOT WITHIN A LOCAL GOVERNMENT'S JURISDICTION!!

The FCC regulates radio spectrum and the Internet, because both are Interstate services.

Local laws making bandwidth stealing a crime will also likely get overturned in federal court.

There's something in this country called the SEPARATION OF POWERS. It gives the federal government the right to regulate: "Interstate Commerce". Since radio waves don't respect state boundaries, courts have determined they are INTERSTATE in nature!!

The Internet has also been defined as an Interstate service.

Local Govts have NO RIGHT to regulate EITHER of these! Recently, Florida passed a law making the operation of a pirate radio station within the state a felony. It WILL be struck down by the first appeal of any conviction. Why? AGAIN, because the states DO NOT HAVE THE RIGHT to regulate Interstate Commerce!!

Re:They have no Jurisdiction here...

[Guppy06]

"The FCC regulates radio spectrum and the Internet, because both are Interstate services."

I'd rather have a local government trying to save me from unsecured WiFi than a national government trying to save me from stray boobies, thanks. Especially when I don't live in that local government's jurisdiction.

"It gives the federal government the right to regulate: "Interstate Commerce"."

Unless you set up your WAP at the state line, 802.11b/g/a seems pretty intrastate to me.

"Since radio waves don't respect state boundaries, courts have determined they are INTERSTATE in nature!!"

References?

Maybe back in the days of when everything was in the mediumwave or shortwave spectrums, but now all anybody ever does is tune in to UHF and VHF radio and television signals, which more often than not stay wholly within a single state.

The federal constitution doesn't simply say "The Congress shall have the power to regulate commerce," there's an adjective in there for a reason.

Re:They have no Jurisdiction here...

[Anonymous Coward]

THIS IS NOT WITHIN A LOCAL GOVERNMENT'S JURISDICTION!!

The FCC regulates radio spectrum and the Internet, because both are Interstate services.

Westchester Country has the authority to regulate the aspect of the businesses in its jurisdiction that are not regulated by the state or federal government. Westchester County couldn't decide that businesses didn't have to collect state sales tax, since that's regulated at a state level. It couldn't decide that businesses didn't have to obey federal labor laws, since that's regulated at a state level. It could _tighten_ the restrictions, if it wanted to, but it could't relax those restrictions.

The FCC has certain laws in place regulating wireless networks. Nothing in this law violates those laws. It simply adds more restrictions on top of the existing laws.

There's something in this country called the SEPARATION OF POWERS. It gives the federal government the right to regulate: "Interstate Commerce". Since radio waves don't respect state boundaries, courts have determined they are INTERSTATE in nature!!

Sorry, that's not what separation of powers means. You should read about it here. You may be confusing that with section 8, clause 3 of the Constitution, or perhaps some section of the Interstate Commerce Act.

Frankly, what I would have loved to have seen in this law would be a reporting clause; one week after informing a business of such a violation, the county government would put a notice in the local newspaper indicating that such and such business had been fined for a violation of this law. The delay is to give the business time to add security; the notification would inform customers that the business could have put their financial information at risk.

Re:They have no Jurisdiction here...

[masdog]

I'd rather have a local government trying to save me from unsecured WiFi than a national government trying to save me from stray boobies, thanks. Especially when I don't live in that local government's jurisdiction.

This isn't something that the government has any business getting into. Using unsecured WiFi is a choice I make, and if I am dumb enough to a)transmit sensative data over that connection or b)make purchases where I have to input my credit card over said connection, then that is my choice. There are already laws in place that make stealing personal data and using it a crime.

This is just some self-important government official trying to make a name for him/herself and manufacture a problem to solve.

Re:They have no Jurisdiction here...

[Anonymous Coward]

Governments do not have rights.

Governments only have the powers which are apportioned to them by the people.

Re:They have no Jurisdiction here...

[Nakarti]

No. Wireless access is a very local service(~150ft in most cases) with local jurisdiction. This is what the law is about.
That these networks are accessing an interstate service is inconsequential (although making that a trigger requirement is probably borderline.) The law is intended to prevent abuse of or damage resulting from open access to a wireless network connection.

I leave the examples to you.

I have *got* to get into consulting

[williewang]

Delicious! The firewall piece is just brilliant, isn't it? Hell, put in a baker's dozen firewalls. Then it will be *really* secure--Ft. Knox, Baby!

One has to wonder how these nanny apes think putting a firewall in front of and/or behind a wireless access point--or on the PC for that matter--helps anything. The whole point of sniffing on wireless networks is to sniff traffic that (gasp!) is going through a radio signal, last I heard. And people, ummm, connect directly to it. It's like putting a pack of ninjas in front of a radio tower to keep people from picking up the signal.

Besides, anyone idiotic enough to send personal info in a phukin email or unsecured web site should be flogged in front of their parents. My mother knows not to do that and she can barely get past turning a computer on. Meanwhile, businesses there have to incur extra expense and create frustration with their customers to not be in violation of this ordinance. Positively brilliant. Aren't there a couple potholes in Westchester County, NY that need attention?

hold on..

[eeeeee]

Unsecured RESIDENTIAL wireless networks have already been illegal in westchester county for about 6 months. These laws aren't made to be enforced, per se, they just raise awareness of wireless encryption for the average westchester county layman. Most non-technical people see encryption as an unnecessary hassle. This problem is even worse in Westchester, which is one of the wealthiest counties in the country, where people tend to not want to be bothered with things they deem too much of a bother. I set up networks all over the county and often hear "well I don't want to remember another 'password'" or "but then i'll have to call you when I buy another computer" or "why would anyone want to steal anything on my network?". It's a lot easier to reply with "Well it's county law" than to try to make the common sense/good practices/file-share liability arguments.

Re:hold on..

[lubricated]

>> Most non-technical people see encryption as an unnecessary hassle.

because wep is insecure, and wpa isn't universally supported.
encryption should be used in protocols(e.g. https).
YACA
you are no more liable for your internet pipe, then you are for accidents if your car gets stolen.

Re:hold on..

[eeeeee]

>> because wep is insecure, and wpa isn't universally supported.

Most non-tech people don't know that, they just don't want the hassle of entering/remembering a password (even if it's stored).

>> you are no more liable for your internet pipe, then you are for accidents if your car gets stolen.

Try to tell that to the RIAA when your neighbor gets caught filesharing on YOUR network.

And most people lock their cars. If you encrypt your network and someone cracks the key - you probably won't be held liable. If you don't have encryption at all, you're negligent.

Re:hold on..

[lubricated]

>> And most people lock their cars. If you encrypt your network and someone cracks the key - you probably won't be held liable. If you don't have encryption at all, you're negligent.

yet even if you leave your car unlocked, keys in the ignition you won't be held for an accident.

>> yet even if you leave your car unlocked, keys in the ignition you won't be held for an accident.

I refuse to be intimidated by bullys.

>> Most non-tech people don't know that, they just don't want the hassle of entering/remembering a password (even if it's stored).

that's another good reason. WEP passwords are always giberish. Windows does a shitty job of storing them. Most linux dists are better about remembering it, but it can be a PITA. You want a new computer to have the WEP, ok, walk to the old one, write it down, oh wait go find paper and pen(something being used less and less), write down the giberish and then shred it. It's a PITA. All for nothing, I'm sure the RIAA will not care if your neighbor was using p2p from your WEPed network or your open one. At least with the open one you have more deniability.

Re:hold on..

[masdog]

These laws aren't made to be enforced, per se, they just raise awareness of wireless encryption for the average westchester county layman.

If that is the case, then this is a gross misuse of government power. Its great that they want to raise awareness of wireless security, BUT there are better ways to do that than passing laws.

If you want people to learn about wireless security and encourage them to secure their wireless routers, draft a pamphlet and mail it to each person in the county. If that is too expensive, create a website that contains information on wireless security and how to secure some common routers.

Stupid, un-enforceable laws don't solve the problem. They only create, at best, half-baked proposals that don't actually solve anything.

Re:hold on..

[eeeeee]

That's true, but it is a step in the right direction and probably won't end up causing harm.

Stepping on FCC authority?

[schwit1]

I was under the impression that the US wireless spectrum and wireless devices were regulated exclusivly by the FCC. Have they given locals the authority to do this?

Not really security-First Responder.

[Anonymous Coward]

"Laws should be our *last* resort when trying to deal with any sort of issue, and that includes technical ones."

Like DRM, and Littering.

law should and does allow unprotected networks

[tech-law-ny]

The law in question has two distinct parts. First, if you're a business that stores personal information on a networked machine, and you have a wireless access point on this network, you must implement a security measure. The county's choices of security measures probably aren't the best, but the concept of requiring a security measure in this situation is reasonable.

Second, if you offer Internet access to the public, you must post a sign suggesting that customers' personal machines implement a security measure. It's not necessarily the best way to protect customers, but a sign is a low-cost requirement and probably rarely burdensome.

The law doesn't forbid offering unrestricted Internet access to anyone within range. This is a good choice. A person or business should be allowed to share use of an Internet connection, provided they are willing to take the risk that someone might use this connection to do very bad things. For example, you might want to offer your Internet connection to the (semi-)anonymous public by running both an unprotected wireless hotspot and a Tor exit node.

He must be right - he used ALL CAPS

[Dachannien]

Far be it from me to argue with someone so well-versed in the art of being louder than his opposition, but "separation of powers" refers to a model of government where the activities of the government are divided into multiple branches.

Besides that, local governments could argue that the usable range of a wifi signal is very short, occurring fully within their jurisdiction. They could also argue that they aren't regulating the physical communications layer (the radio signal), but rather the configuration of the data link layer, which doesn't necessarily depend on transmission via wireless signal (even though, in practice, that's the only way it's communicated). While there is the potential for a battle up into federal court, I don't see it as being nearly as cut-and-dried as you do... unless you have some legal precedents you'd like to share with us.

Re:He must be right - he used ALL CAPS

[Anonymous Coward]

Nah, the parent is STILL right.
It's analagous to CB radio - you know, 27Mhz?
What YOU are saying is that you have the right to use the "free" CB spectrum, but the town has the right to control it's content - that you speak nglish only for example.

Parent is still right - Modem' up.

Re:He must be right - he used ALL CAPS

[Joe U]

Interesting points:

An access point is, by definition, an extension of the Internet.
The spectrum being used is by definition, unregulated spectrum.

So, does the county have the right to regulate a connection point to an interstate network? They do seem to put toll booths on the Interstate highway system, but they don't have the ability to force all trucks off the highway.

Re:He must be right - he used ALL CAPS

[Newer Guy]

There have been many court cases that claimed the FCC has no jurisdiction over radio signals that do not cross state brrders. In EVERY case, the court has sided with the FCC. Some of the latest ones are Radio Free Brattleboro and Radio Free Berkley. This precedent goes back to the early 1920's. As far as toll roads go, states have always had the right to have private roads. For that matter, people can own roads too...But toll roads receive no federal $$ whatsoever. The owner must take care of them completely.

Re:He must be right - he used ALL CAPS

[Dachannien]

I suspect that in those cases, the defendants were claiming that the FCC had no jurisdiction, not that the state or local government also had jurisdiction. Those are two different beasts, so the question still remains whether a state or local government can bring an action against a person in addition to the FCC.

Read the bloody article!

[topham]

If you read the article the networks must be encrypted if the business stores credit card or financial information of it's customers on it's network.

I don't know about you, but I think this is a very good thing. It is quite possible that it is within the jurisdiction of the local government as the business' which are licensed by the local government must conform to local business laws.

Personally I think the FCC should consider enacting similar regulation such that if it CAN be challenged on the grounds the FCC regulates it that they give the authority for that to the local community, or fully enact it themselves.

The number of business which employ wireless networks will only go up over the next few years, and any reduction in methods of easily obtaining credit card numbers is a good thing. I don't actually think these steps are sufficient though.

Re:Read the bloody article!

[CastrTroy]

Why would anybody store customer information on the same network that they are giving free-for-all wireless information on. Are businesses becoming that cheap that they can't even get 2 different routers, to suffice for the two different network, or are they just stupid? I can understand Joe sixpack not wanting to secure his home network, but if you own a business and are generating revenue from the use of your network, then you should take the time to set it up correctly.

Re:Read the bloody article!

[bjohnson]

Because it's Joe Sixpack at work here. They're idiots...

The law that should have been passed:

[MsGeek]

Wired connectivity ONLY on networks that pass information about credit cards around. That shit has no business being on a WiFi network. I will *not* do anything on a wireless network that requires sensitive data being thrown around.

All WiFi networks, even those with WEP (Ha! It is to laugh! Wired Equivalent Privacy my ass!) or WPA, should be dealt with as *untrusted* networks. As in be careful what you do on them and don't give out any personal info on them.

I was horrified when I was working at this one place that sold computer media online. This was about three years ago. The computer I was using for order entry was connected via WiFi to their network. Any dumbass with a sniffer could have had a lot of fun with the info that was being thrown around in the clear. I complained about this and told them they should have my computer on a wired link. They fired me for insubordination. Fuckers. I bet they still have that same in-the-clear WiFi link to that same computer, and they still use it for mail order entry.

Re:The law that should have been passed:

[planetoid]

In order to crack your wireless network's WEP key (which I understand is easy to do over a course of an hour or two, considering how weak that encryption is) does someone have to also know your router's SSID in advance, or do they just need a radio signal to incercept and nothing else? I live in an apartment with my parents, and since HomePNA products are no longer on the market, wireless is the only other way we can get multiple computers in different rooms on the same network that doesn't involve drilling holes in walls or running a cable through three different rooms. But living in apartments with crowded residences and who-knows-who living here in all directions, concerns me a bit. I took every other security measure (limiting network logins to just specific MAC addresses, for example), but I still worry that the weak encryption and the fact that packets still just 'fly' out in the open could be the Achilles' Heel of every WiFi network that no other precaution can really mitigate.

I've considered using IPv6 internally on my home network, as I understand that has built-in encryption via IPsec and is probably not quite as easy to crack as WEP, so even if someone intercepts my home network's packets from the aether, they'd still see yet another layer of encryption.

Re:The law that should have been passed:

[Anonymous Coward]

If only there were some way to create a "Secure Layer" of some sort so that regular sockets could be used to send sensitive information over untrusted networks. Sheesh. I don't know who sold you the idea of a "trusted network," but it seems like a bad idea to me, unless you have armed guards patrolling your wire paths.

what if i want to give away service?

[nurb432]

All AUP issues with my ISP aside, what if i want to give away part of my business's bandwidth? im NOT a 'coffee house' or other such 'hotspot', Im just a nice guy.

That mean i get fined if they manage to find me?

Poor politicians don't understand technology

[Anonymous Coward]

Once again, we have proof that inept politicians don't understand technology. Why do we elect these baboons? We could get better laws from baboons. I don't get it. Why aren't people laughing at them in public? If I created such a law, I'd be ashamed to leave the house.

"if the personal information isn't already encrypted" is a HUGE way out of this whole thing. If you don't keep personal info available by wi-fi, then this law is a non-issue. There are so many holes in this law, it's basically worthless.

I really like the fact that businesses have to put up signs. Where? Out on the street? How about on the roof? How about in the business across the street? What are the limits of sign posting liability?

Poorly thought, poorly planned, and probably poorly enforced. So what did they accomplish? It's wide open for the courts. Do we need stuff like this tying up the courts' time?

I guess we're too stupid to regulate ourselves. We need more regulation. Let's look at Sweden, Denmark, France, and the other socialist countries where regulations KILL their economies, create LARGE numbers of unemployed, and generally wreak havoc on society. Kudos to NY County. Hopefully, the rest of the planet sits back and holds a wait-and-see attitude to see what effect this legislation has.

Re:Poor politicians don't understand technology

[Anonymous Coward]

Kudos to NY County.

Thanks, but this law is for Westchester County. Westchester is a New York county. Not, New York County, a.k.a. Manhattan, a.k.a. one fifth of New York City. (FYI, the others are Queens, Kings, Richmond, and Bronx counties, impress your friends and family)

Either way, I'm guessing you didn't read the article.

Re:Poor politicians don't understand technology

[thogard]

Is this the county where Master Card's headquarters are? If so I wonder if they aren't behind it mostly to find out if it can be effective. I know its very common to use wireless access points when testing out stolen or guessed card numbers these days.

Re:How come SD is so slow anymore? Loss of interes

[HotNeedleOfInquiry]

Everyone's at church/temple.

You have *got* to be kidding ......

[Gorshkov]

Jacknis said easily available firewalls would protect credit card transactions, for example, from being detected by a hacker posted outside a dry cleaner that uses a wireless network.

Please, God, tell me that that's shitty reporting, and not the considered opinion of somebody who's passing laws .........

Clue alert...

[HermanAB]

Yup, you are about the only person with a clue here, but why the Nigerian capitals? "This router uses FOUR MILLION BITS encryption!" ;)

Idiots!

[bedammit]

Requiring businesses to secure their wireless networks is analogous to requiring businesses to lock their doors. Locking your door is based on knowledge of ease of entry and possibly the intent of people in the area. There should be no mandate or law which states that a business should secure their network. This is the responsibility of the company to be aware how and why to secure their network. Furthermore, establishing a requirement for securing wireless networks puts government quarely in the middle of recommending standards which constantly change and are regularly exploited. If anything... vendors offering equipment should be required to state that the device a person has purchased is unsecured and data on their network may be accessible by unintended parties. Similar text can be used at coffee shops and other WiFi locations. BeDammit!

Isn't this done already?

[Kadin2048]

I'm pretty sure this is how Linksys ones are set up by default. I know that you cannot administer them remotely (from the WAN side) by default, it seems like they ought to set them up so that you can't administer them wirelessly without first changing from defaults (or at least checking a box somewhere, like the WAN option) also.

I'd check, but my WRT54GL doesn't have the default firmware on it anymore. (And obviously it's not using the default password.)

Re:Isn't this done already?

[masdog]

I run a WRT54 v5. I can administer it from the wireless or ethernet ends, but I don't allow it to be administered from the WAN connection.

I like having the ability to administer my router from the wireless end of the connection. If I am having problems with my DSL Connection, I don't have to get up and move to my router in order to check for problems.

Re:Isn't this done already?

[multipartmixed]

I think my v1.2 is setup like that as well... IIRC it doesn't differentiate between WLAN and LAN connections, just WAN and LAN.

Which is really stupid.

Bad AC, no cookie for you.

[Kadin2048]

It is unsecured in the fact that you can use it. It is also unsecured in the fact that someone could have stolen your online banking info or any other personal information you did on the internet.

What sort of bad crack are you smoking? Have you ever heard of SSL? Looked at the bottom corner of your web browser for that little "Lock/Unlock" security thingy?

The only way you'd be giving up any security by using a public WiFi access point to do online banking or shopping is if you were sending your information over the network unsecured, and in that case you pretty much deserve to see charges for massage parlors in Fiji on your next American Express bill.*

If you're not using encryption, it's insecure by default, I don't care whose network you're sending it over. The Internet is insecure by design -- deal with it.

*(This is assuming you haven't frequented any Fijian massage parlors lately.)

No - not stupidity

[Laebshade]

The scenario you paint isn't similar. They are requiring (certain) business -- which, by the way, require licenses from the government to operate -- to secure their networks; although I do not agree that the steps the law outlines is anywhere being close to secure, that isn't the point of this post. Making it a criminal offense to not lock your door is not the same as making it a criminal offense not to secure your wireless network. Does leaving your door unlocked allow multiple people to use your house to commit crimes? Yes, you could argue that someone could do this, but it wouldn't be very long before they were caught and arrested.

Business who run wireless networks need to secure them; I say, leave the broadcast and default SSID on, but require instead for a key to be used to get on the wireless network. Problem solved.

It's possible and was done years ago

[Beryllium Sphere(tm)]

By Microsoft! They used to sell wireless hardware with security on by default, and offered a way to copy security settings from one box to another so they could interoperate.

Buffalo came up with a one-button security approach called AOSS.

Or terrorists or suppliers of child pornography...

[TCQuad]

What if they're trying to offer free, open wireless access?

Then they're communists and should be thrown in jail.

howto crack WEP and WPA

[Bishop]

The problem with WEP 40/64bit is that the key is only 40bit and can be quickly attacked with brute force. The problem with WEP 128bit is that the standard implemented RC4 encryption poorly and known weak IVs, initialization vectors, are used. To crack WEP an attacker needs to collect a large number of packets that use the weak IVs. The time it takes to collect these packets depends on the ammount of traffic and can take days or months. Some access points and wireless cards have a driver option to disable weak IVs.

WPA is much stronger and WPA2 is even better. WPA is vulnerable to weak keys. This is more a problem for pre-shared keys (the common home setup) then for certificate based authentication. The authentication mechanism uses 4 packets. Those 4 packets can be captured and attacked using brute force offline. IIRC the attack is not that fast and typically uses dictionary based attacks.

Use WPA with a strong passphrase and you should be safe. A passphrase with 16+ chars and numerals should be good. Some access points have buggy webbased management and can't accept other puctuation or special chars.

Ofcourse this won't stop a well financed (state sponsored) attacker. It will stop the neighbour's script-kiddie teenager.

When you hear the phrase "chilling effect"

[Beryllium Sphere(tm)]

this is what it means.

So you go wardriving

[Beryllium Sphere(tm)]

It might be illegal to go on a fishing expedition like that for law enforcement purposes. But maybe not, they are broadcasting the signals.

But what will you do when you're halfway down the street and you see six access points, all named Linksys, and none indicates what business it's from?

Then you need radio direction finding equipment. Crude RDF things are cheap. Reliable direction finding in an urban environment (diffraction, reflections, multiple reflections) takes so much skill that's it's an organized sport.

Re:How come SD is so slow anymore? Loss of interes

[Anonymous Coward]

Or asleep.

Interestingly enough, the CAPTCHA for this post is "sleeps".

blackhole of suckitude^wliberalism, NYC

[Gothmolly]

After this, the State will just have to outlaw speeding, smoking pot, and underage drinking, and enact single-payer healthcare, and we'll all live happily ever after!

Short Story

[skidde]

I went to the Westchester County Student Legislative Day a few weeks back, and the WiFi law was actually one of the subjects of the "mock legislative session."

I played the role of a member of the press, which basically enabled me to engage in some level of dialogue with my fellow student representatives. I asked them how changing what the network is called when it pops up in Windows is at all conducive to creating a secure network, at which point they tried to convince me that businesses would have to install a firewall. It went something like this:

Him: "I'd like to call your attention to this section, where it specifically mentions a 'network firewall'."
Me: "I'd like to call your attention to the word 'or'."

The one kid I was arguing with told me he thought his copy of the law was different, but it wasn't. So they dealt with it:

Him: "Okay, to appease this reporter, I'd like to propose an amendment, and change the word 'or' to 'and'."

It passed, by the way. Kinda scary.

Re:Short Story

[skidde]

I also probably should've mentioned this: as part of the day we were able to speak to legislators, and the guy I spoke to said he didn't really understand most of it until it was "explained" to him by the IT guy. He said he didn't know anything about encryption but would be sure to ask about it when he got a chance.

For what it's worth, I did try and say that protecting one's own computer is better than pretending that a network name change will solve your problems. I accepted that businesses shouldn't use open WiFi to transmit credit card numbers or anything like that. I pointed out that there's a much greater risk of identity theft from someone responding to eBay's "threat" to suspend his account than from someone sitting right next to him at Starbucks snooping. I even said that the FCC probably had jurisdiction anyway and the law couldn't be enforced. (Westchester was, I believe, the first county to ban cell phones while driving, and I was told that like that law, this law was passed in the hopes it would lead to a similar saw being passed statewide and, presumably, at the federal level.)

I think the obvious solution is to require any legislator wanting to regulate technology pass a basic proficiency exam to understand exactly what it is they're passing. (Or, in the case of "or," an English test.)

Another giveaway to big biz.

[webweave]

The intent of the law is not to protect your precious data but to ensure that the bells and thier ilk gain unrestricted access to paying customers. If everyone put thier wifi routers outside of thier firewalls then the data on your home machines would be protected to the same level as they are protected from the internet. Do you really think this government cares about your security?

My bet is that this law was written by a lobyist for the telecomm industry and delivered to the law makers with a big fat cheque. On second thought, that never happens... Hey do your own search!

OT: Toll roads

[Anonymous Coward]

But toll roads receive no federal $$ whatsoever.

Not true, there are many roads in the Interstate highway system that have tolls and also get federal funding. I-95 is a good example. Between Philadelphia and NYC (Lets say the NY-CT state line) you'll have to pay at least 3 tolls.

This country over funds its highway system as is, if we put 10% of the annual road budget into alternative modes of transportation we would drastically reduce air and road congestion.

Typical Westchester Idiocy

[Anonymous Coward]

During the last election, the present DA Janet Defiore ran on the "we'll protect your kids from pedophiles" ticket. Not that it is a big problem here, but parents often come here for the school districts and anything sex offense related makes them nervous and prone to knee jerk reactions.

http://abcnews.go.com/GMA/story?id=1253920

About 45 registered Level 2 and 3 sex offenders who live in Westchester County, just north of New York City, will receive special invitations to attend an educational program between 6 p.m. and 10 p.m. on Oct. 31, under an initiative spearheaded by Westchester County Executive Andrew Spano. Those who don't attend will receive a personal visit from probation officers and police. Level 1 sex offenders and those on probation who have committed crimes of a sexual nature will also receive a home visit, according to a statement released by Spano's office.

Spend every halloween at our the "meeting" or get a visit from the police, isn't this presuming guilt? Especially for level 1, "low risk" offenders who have done their time and are not on probation.

http://www.thejournalnews.com/apps/pbcs.dll/articl e?AID=/20050324/NEWS02/503240355/1018
Rounding up non-citizen (but greencard holding) sex offenders with the backing of Homeland Security's "Operation Predator" program. Then deporting them.

http://www.westchestergov.com/currentnews/2005pr/t estimonycivilcom.htm
Forcing sex offenders to take polygraphs as a condition of probation. Now polygraphs have been invalidated by the scientific community, but hey, the county executive used the results to say that for 100 sex offenders put under polygraph examinations, they came up with 5000 incidents that went unreported. That is 50 per person! How long did they interview each person?

There is a lot of interest here in reducing "potential" crimes. Not just sex crimes, I chose that because that is what is being pushed at the moment, but this is happening general and is representative of the mentality that these politicians have. Westchester is filled with lots of anal retentive, sheltered suburbanites who when fear mongered will elect politicians at the drop of a hat. Few people stop to think whether the county's limited resources could be used more effectively.

This wifi regulation is just one among many bad ones in Westchester. Any time a potential problem crops up, the dipshits in office find the quickest way to pre-empt the problem from occuring all together, despite the cost and the unintended consequences of casting an overly wide net. Sort of like banning p2p to stop copyright violations or the distribution of child porn.

They're going to be in trouble

[Profane MuthaFucka]

The only body that can regulate any aspect of wireless communications in the US is the FCC. Nobody else has that authority. I doubt that this silly rule will stick. I wonder how many millions of county dollars those idiots will spend to figure that out?

I suspect

[petermgreen]

you could program a linksys wrt54g to do that. the crude and moderately secure way would be to dnat all http traffic to an internal webserver and drop all other traffic by default. then make that web server add and remove entries to bypass the dnat/drop.

someone could still steal an existing ip but that would require fairly advanced knowlage.

Re:I suspect

[Skater]

Cool. I was going to ask about that in the message but took it out before I posted. I have a WRT54G, so it's just a matter of getting around to installing some aftermarket software on it...

The friend in question has a Westel (I think) DSL modem/wireless router combination. Not good for hacking like that, though - and sadly she's the one that needs that setup more.

Re:Secure by default - blog post

[PoconoPCDoctor]

Just recently I did a little "war-driving,"

although I would more correctly call it snore-driving, because it's not hard at all to still find loads of unsecured wireless networks.

I totally agree that wireless equipment manufacturers should do more than make it real easy to set up a wireless network - maybe there should be an annoying pop-up reminding you to change the password and lock down the network - this could be built-into the configuration software and would pop-up every time you booted up or clicked on a web site

I can dream, can't I?/p

How to justify federal involvement in Abortion

[Sloppy]

you do realize that the folks who want to ban abortion want to do so because they think it is murder?

And with modern liberal interpretation of the Constitution, here is how the federal government gets authority over the matter: "Congress has the power to regulate interstate commerce, and when a person in Alabama is murdered, he no longer has the capacity to do business in Mississippi. Therefore, it is necessary and proper for Congress to regulate the ending of any life which may potentially engage in any sort of business."

Maybe the whole Drug War was just an opening shot in the Abortion War, to ease citizens into the idea that there's no 10th Amendment. ;-)

Re:How to justify federal involvement in Abortion

[Rich0]

I'm pretty sure abortion laws predate the war on drugs.

Murder is a federal crime and has been for a long time - probably long before the commerce clause went out of control.

Something as fundamental as the right to not be killed will always be an appropriate federal matter. If Iowa passes a law legalizing the murder of union organizers does that mean that said organizers should not be able to sue for relief in federal courts?

I think most libertarians wouldn't argue with having some level of federal civil rights protections.

Free WiFi AP wiki

[suso]

Something you might check out

http://freewlan.org/ The Open WiFi AP wiki.