Slashdot Mirror
Schneier Says 'Steal this Wi-Fi'
apolloose noted Bruce Schneier's latest entry on Wired where he talks about insecured wifi networks, and suggests that you
Steal this WiFi. Basically, since insecure WiFi is everywhere, why not? You're helping make the world a little better for someone else.
Why not? For one thing because it would pretty much guarantee total anonymity to everyone online.
If you want to commit a crime online, it's easy enough to drive your car to the next city, open you laptop and connect to a random open AP.
And if you were too lazy to do that, you can always say "It wasn't me, someone else connected through MY open AP!"
This is an ethics by analogy situation. Everyone arguing over whether it is right to use unsecured wi-fi connections bases their arguments on analogies, and depending on the analogy, reaches a different conclusion.
As I see it, if someone left their wi-fi open, then either it was intentional, or they're too clueless to notice (or care) that I'm reading my email.
I think it's more like bookcrossing You've already paid for it, now you're letting someone else use it. With books, publishers might not like it because they sell fewer books. With wifi, ISPs may sell fewer connections. Either way it's not stealing.
Intron: the portion of DNA which expresses nothing useful.
Everything Schneire says is true.. for Bruce Schneire. Not everyone is as adept as he is in configuring a computer to be secure. I'm OK, but I'm likely not vigilant enough to keep everything as secure as it should be (and thus I have WPA encryption on in my wireless network). The vast majority of the public is just plain terrible, and has no clue how to configure their computers to be secure in an open network.
Securing your wireless network with encryption isn't like flipping a switch, but it's a HELL of a lot easier and more accessible than knowing how to secure each and every device accessible on your network. Having ONE point of entry and configuring that properly is a lot easier to maintain than having multiple, different, changing points that take continued vigilance to remain secure. Is it better to keep each device secure on any network? Sure.. but how many people have the time, patience, knowledge, and ability to do that? Not many.
AccountKiller
"Can anyone point me to a simple tutorial on cracking a WEP password?"
1. Ask your neighbors for permission to connect to their WiFi.
2. If you get permission, use the password they give you.
3. If you don't get permission, don't be a dick.
If someone has their WiFi configured to allow public access, I don't see much problem in making limited (e.g. no hogging bandwidth, nothing that might get them in trouble) use of it. The internet is built on the idea that people set up unattended computers to give automatic electronic permission for total strangers to use them; Slashdot would suck if everyone had to call Rob before they felt they were allowed to use his web server. But finding a hole in someone's security isn't permission, it's just intrusion.
Even when you see an open access point asking permission isn't a bad idea. It shouldn't be a legal requirement, but it's a nice thing to do, despite involving the frightening prospects of going outside and meeting someone in real life.
That's just inviting trouble.
If "Something Bad" were to happen from your IP address, there -will- be a knock at your front door in the early morning. Trust me.
"Something" happened to my personal email server several years ago, and I had federal agents at my front door at 1am. I don't know what the heck happened - they wouldn't give me any details - but they seized my email server, and every computer in my household, even though their search warrant was only for the server. You don't tell them "no" - all that means is that they wait for the search warrant to be signed, and THEN they wreck your place searching. Much better for everyone involved to be cooperative.
Cost me thousands of dollars in a retainer fee to a lawyer, I had to take a polygraph exam, and it took almost 2 years to get all my "stuff" back. That was 2 years where I was fearful for my job, worried about keeping my family afloat, worried about just about everything. My wife lost ALL of her graduate school work, and had to re-do most of it to turn in her final portfolio. Talk about miserable.
And I STILL have no idea what that "Something Bad" was. And it didn't even happen at my house - it happened at my hosting ISP where the email server lived. It didn't matter that *I* didn't do it. I still had MY stuff taken from my, *I* still had to go take the polygraph exam, and *I* was still on the hook for 2 years.
So yeah - keeping an open wireless network is just ASKING for trouble. If you want to deal with federal agents in the middle of the night, well, be my guest. You can talk the talk about how you'd tell them to go away, and how they'd have no proof, etc. etc., but unless you've been there, you have no idea what you're in for.
Trust me.
That said, IANAL but the ones that he apparently spoke to seem awfully cavalier about the situation. I would be extremely uncomfortable explaining to a judge that I:
1) Published an article stating that I knew that my wireless connection could be used by others to commit crimes.
2) Left my connection unsecured anyway.
3) Was arrested because of illegal traffic.
4) Expect to be excused.
He's getting rather old, but he's a good mouse.
Not only might you want to give away unused bandwidth, but look at the reasons people are telling us we should not give it away:
- You might be blamed for illegal file sharing or spamming
- You might be held legally responsible for what other do
- You might be the victim of malicious users
- You might.... nevermind, all the reasons are to protect you from people who would sue you. What does that say about the world?
Lets throw some other analogies out there:
You shouldn't stop to help a stranded motorist because they might attack you or kill you
You shouldn't give people advice because they might sue you for using it badly (lawyers & doctors)
You shouldn't leave objects in your lawn in case someone trips and sues you
you.... getting the picture?
You are NO LONGER free to do as you wish with what is yours because other people control what you do, either directly, or indirectly as a consequence of fear of what they MIGHT do. If gun makers are not responsible for what people do with the products they make, you should NOT be responsible for what people do with the bandwidth you gave them to use.
If we can be held responsible for what happens across our open APs, then the ISP can be held responsible for what goes across its network.
In the end, common sense and reasonable thought dictate that the person who does the spamming or file sharing is responsible. If you leave a gardening tool in your lawn, and a person trips on it and hurts themselves, who is at fault? If you put a bench in your yard where people can sit and rest and some kid pushes another who then falls and cuts his head on the bench, who is at fault?
I know those don't fit perfectly, but the point is that just because you helped to create something, you are NOT responsible for the use of it. Leaving your car unlocked is a good analogy: if someone takes it, they are stealing, and just because you did not do all that you could do to prevent them from taking it does not change the fact that they stole it.
In another thought, holding the AP owner responsible is like trying to treat them as network security experts under the law. Insurance companies, police departments, all sorts of people work to inform you how to stop someone from stealing your property but does anyone do public service announcements to tell you how to stop people from stealing your bandwidth? Can you get insurance to protect you from bandwidth theft? or to compensate you when the **AA are suing you?
Is a bus driver culpable if he drives the bus that a bank robber used to get to the bank he robbed?
This goes on and on, but the point of holding you responsible for what others do with something you gave them (without the intent of doing so for malicious or nefarious reasons) has been proven in court already. Gun makers are not responsible for any deaths that happen from use of their products. Game over.
Support NYCountryLawyer RIAA vs People
jeez...security is great and all that but you sound paranoid as hell. does the word overkill mean anything to you?
never bring a twinkie to a food fight.
I am TheRaven on Soylent News
You mean the same ISP that agreed to give me unlimited downloads but cancels my service if I pass their secret limit? The same ISP that sold me unlimited high-speed but throttles it back for certain applications? Who is that needs the integrity?
Support Right To Repair Legislation.
That's actually an erroneous legal idea....if in fact you have shown due diligence in trying to secure your network, and someone gets in, you are less likely to be found at fault. If however the courts can show that you knew the risks and consequences to having your network opened, and you had the means to do it, yet did not, you are much more likely to be held accountable.
The only effective measure there is the WPA. If a hacker gets through that (and that's *hard*) they can break through the others in a matter of seconds just by sniffing packets.
All he's doing is making life harder for himself.