USA Has More Open Wi-Fi Hotspots Than EU

Mark.JUK writes "Some 40% of wireless (Wi-Fi) Internet access hotspots in the USA are unlocked and do not require a security password, which compares with 25% in Europe; according to WeFi based statistics. Across the world, approximately 30% of recorded Wi-Fi access points are unlocked, while some 70% are locked. Nice to see everybody taking security so seriously, then. It should be perfectly possible to 'share' Wi-Fi while using WPA or WPA2 security measures at the same time."

Comments

USA! USA! USA!

[elrous0]

Yeah, number one, baby!

Re:USA! USA! USA!

[Anonymous Coward]

Well, my neighbors have a router at home, and it's on all the time. The SSID is "linksys", but they never appeared to have an internet connection. This has happened in more than one neighborhood I lived in, here in the US. I get to access the router configuration, yet for a long time, the router has been sitting there doing nothing but contaminating the spectrum (I in fact moved them to another frequency, so I guess I did some frequency allocation in my neighborhood).

My point is, yes, there are several open access points... but yes, they are connecting to nowhere.

Re:USA! USA! USA!

[conureman]

I have a tenant who is lamely trying to up the QOS on the eight neighbor's routers that he gets his free internet from, so he can drop his phone service as well. I don't know what type his router is, I tend to shun felonious operations.

Re:USA! USA! USA!

[SebaSOFT]

[sarcasm]
Yeah yeah who has it longer? uh? Eat that Europe
[/sarcasm]

Re:USA! USA! USA!

[Anonymous Coward]

yes but if EU member states like romania and bulgaria have 1 wifi hotspot each and they are both secure, that means 100% of wifi hotspots in those countries are secure. If you think about it it doesn't make usa look bad anymore

this article is a biased numerical manipulation to make usa look bad. the fact is usa invented internet altogether, not eu. probably wifi too, but im too lazy too look.

Re:USA! USA! USA!

[Anonymous Coward]

nigeria is better because they have even longer...

unfortunately they don't have anything else and their biggest concern is 'if i'm going to have something to eat tomorrow', but i'm sure there are numbers and percentages that could show that nigeria is better than usa. ussr and cuba prepared such numbers daily

Re:USA! USA! USA!

[mlheur]

Most of the open access points I come across are proxied to some pay per MB or pay per minute credit card log in page. Not so open but still connected to the internet.

This isn't a bad thing.

[vasqzr]

Good! The Internet was founded on free and open access.

For the first year or two I was using a (very limited) free dial-up shell. Otherwise I would have never been able to get online. I live my access point open, I've had hundreds of users over the last few months.

Re:This isn't a bad thing.

[cayenne8]

The tag line for this article complained that you should be able to have open access..AND WPA2 at the same time.

I got one of these netgear ones recently and it works great.

I can set up different access through it...and even click to allow guests, etc.

I have some old computers that just can't get anything stronger than WEP to run on them (an old iBook for instance), so I set up a WEP connection for them, which the router blocks off from direct interaction with any other computer on my system...everything else is WPA2.

There are wireless routers out there that do some neat things, but you gotta be willing to spend more than $20.

Re:This isn't a bad thing.

[onionman]

Great!!

When I travel, I want to be able to go into a coffee shop, get my espresso, and sit down and use my laptop on the internet without having to hand out credit card information or any other sort of credentials. I make a point of only frequenting businesses with open access points because I want to reward their community service. I recommend that others do the same!

Re:This isn't a bad thing.

[fuzzyfuzzyfungus]

I'd like to see support for doing this properly be more common in consumer level hardware. There are a few commercially available stabs at it(fonera, possibly others) and it isn't rocket surgery to whip something together with OpenWRT and the contents of the average geek's junk collection; but it isn't something you'll just get off the shelf at best buy.

By "properly" I mean segregation between the internal LAN, on a secured wireless link, and the open guest wireless; along with QoS prioritization of all internet traffic from the internal LAN above all internet traffic from the open wireless. I have no problem with offering my unused bandwidth in a neighborly spirit; but I don't want my wireless traffic to be unencrypted, I don't want to deal with malicious agents on my LAN, and, when I go to use my bandwidth, I want to have priority over any guest users. This is not a hard problem, technologically; but it isn't something that Joe User could set up without it being largely out-of-box default.

Re:This isn't a bad thing.

[standbypowerguy]

DD-WRT can do this. I use it on an old Linksys WRT-54G. I've configured two separate private subnets, one for secure connections via WPA, the other for open access I share with my neighbors. All of my PCs, including those with wired connections, exist on the secure subnet. Wireless guests get insecure access. I also have a few wired ports on the insecure subnet. Comes in handy when I want to work on an infected PC, or when I want to give a visitor wired access without them seeing my network.

Re:This isn't a bad thing.

[SharpFang]

My friend has a Windows Mobile phone.
The phone can handle WPA2 ok, it can handle Skype VoIP ok, but it can't handle both.
The accesspoint is WEP because that still stops strangers from just connecting, signals "private network, do not enter" and meanwhile allows to use Skype on that phone.

Anyway, you don't have to have flawless protection, just better than weakest of your neighbors.

Re:This isn't a bad thing.

[nschubach]

That's the first thing I thought too, but there are a majority of people that buy a router off the shelf, plug it in and just start using it. (...I'm pointing at you Mom and Dad...) I've secured it in the past, they forgot their password so my Mom went and bought another one. Granted, they live 3 miles from the closest single traffic light town and anyone willing to drive up the driveway to get in range is willing to get a warning shot... but that's not the point.

Wifi is a convenience, and having to secure it, remember yet another password or key, and having to plug it in every time you reformat your Windows machine is a nuisance. Most people don't even use all their broadband and would probably only complain if they started noticing a slowdown anyway.

Also, the story only graphs out the first 10 countries, but they point out the US numbers... searching for hits?

Re:This isn't a bad thing.

[omnichad]

It's real simple to get this included on consumer routers. Just make a command-line tool that will run easily on busybox, then open source it. Give it a real cryptic name. Linksys and the like will include it on their next router, come up with a cute name for it, and call it their own.

Re:This isn't a bad thing.

[pnewhook]

All good points, but I assume the original poster is referring to Hotspots that you would find in public areas and cafes, not home systems.

For public area systems, I don't see the value in having free public access and security. If it's free and open, then it shouldn't be encrypted. I like the convenience of just opening my laptop and getting a connection without having to go through any config nonsense.

Of course my home system is completely secure as I want to protect my data, but a cafe owner wants to make connections as easy as possible, and have minimal costs in term of labour to maintain. This means free, open and unencrypted.

For public assess points, I'd like this to be close to 100%.

Re:This isn't a bad thing.

[Anonymous Coward]

I wish more things would do stuff like this.

I combined 2 routers to do exactly this (one was an older one from a while back)
One secured to hell and back, one with open access.
As long as nobody abuses the connection, i'm fine keeping it open for people.
Almost everything is blocked, besides web browsing, most chat ports (IRC, MSN, Yahoo, etc), and the usual ports required for connections to work.

I'm thinking of taking it further by getting some better hardware for it.
But it isn't on the highest of priorities at the moment.
Main reason i want to update the hardware is so i can have better control of what goes through it, specifically file uploads, filters, etc.

Re:This isn't a bad thing.

[uncledrax]

When I was in Frankfurt last year, i found a nice cafe near our Pension/hotel.. it was basic WEP keyed, but it was the sorta combination some idiot would use on their luggage.

[ unfortunately, I can't see any YouTube iwth the full combination 'skit' in FMV, so here's the audio clip with someones art ]

Anyway.. point being, just because it's "not open" doesn't mean it's "secure". They 'secured' thier Wifi as a point of precaution, but all I had to do was ask for the key and I got it in two different languages, and they were very helpful.. nor did they rotate the key out or anything during the few days I was there. True, I was a paying customer (indiciently, best non-hands-eating burrito I've ever had was in FFM? go figure..), so they wanted to be helped.

If you're legitimately trying to prevent access, putting a weak WEP password on your AP is almost worse then leaving it open because it generates a false sense of security for your network. Now if you had a low-timer rotating WPA-PSK key, MAC filtered, and didn't advert SSID, then that's a reasonable amount of security (but still not full proof, but the amount of effort goes up to breach it).

Re:This isn't a bad thing.

[Anonymous Coward]

you should still work encrypted. It's one thing to say you trust the cafe owner with your secret data flying through their router - but quite another to say you trust every other customer on a laptop in the shop at the same time.

Re:This isn't a bad thing.

[pnewhook]

you should still work encrypted. It's one thing to say you trust the cafe owner with your secret data flying through their router - but quite another to say you trust every other customer on a laptop in the shop at the same time.

First, if you are working on something that requires privacy, you shouldn't be doing it in a public wireless access spot. get on a network you trust.

Second, if you do put your computer on a public network, you should be smart enough to protect your own computer so other people on the network cannot access it.

Re:This isn't a bad thing.

[GIL_Dude]

I'm glad you have neighbors you can trust vasgzr. I don't even have relatives I can always trust. At one point my wife's cousin's daughter (17) stayed with us for a few days. She brought her notebook. I gave her our WPA2 key and a lecture about "don't use my internet connection to do any copyright violation - no music or movies, etc.". Next morning I come downstairs to find her downloading a bunch of songs on Limewire. WPA2 key changed, no more privileges for her. I can't trust my neighbors (or their guests) either - they may download kiddie porn, warez, music, whatever through MY IP address. Having open WiFi would be very nice to do, but the hassle of possibly getting RIAA notes or even possibly police at my door (for the kiddie porn thing a neighbor's guest could do) is not even worth it. Until such time as ISP's are able to uniquely identify WHO did it and not just "well this guy owns the house where the service is terminated", the other folks in the area can get their own internet access.

Re:This isn't a bad thing.

[DarthVain]

If I didn't have a bandwidth cap I would leave mine open.

I blame the greedy telcos.

Re:This isn't a bad thing.

[Anonymous Coward]

I'm confused. Are we cheering for Europe because users understand how to use wireless security protocols or are we cheering the USA because they share their internet access? A wireless hotspot is an intentionally open wireless network for sharing internet access, so upon reading the headline I expected praise for the USA. Then the story makes a u-turn and praises EU users for their security consciousness?

Anyway, IMHO there should be more open wireless networks, so I'll weigh in with what I think is the main reason why Europe doesn't have more: Operating an open wireless LAN is a huge liability because you'll take the blame for everything your users do. There have been downright campaigns against open WiFi which even used the "what if someone downloads kiddie porn over your WLAN?" scare crow.

Re:This isn't a bad thing.

[teevoh]

The Apple airPort extreme does this as well. I've got my personal network behind a WPA2 access and an open network with each computer segregated from the other one. I haven't noticed any connection speed issues and until someone abuses it, I'll leave it open.

Re:This isn't a bad thing.

[poolguy]

Great!! When I travel, I want to be able to go into a coffee shop, get my espresso, and pay for my espresso without subsidizing your desire to sit down and use your laptop on the internet without having to hand out credit card information or any other sort of credentials. I make a point of only frequenting coffee shops for their coffee, which I pay for. The expectation of free internet access is about as arbitrary as expecting a free blowjob during my oilchange at Jiffylube.

Re:This isn't a bad thing.

[shaitand]

True but if you just don't want everyone to take your sister for a ride then WEP is fine.

I could certainly break into your wep secured system but why would I bother? There are plenty of open ones around.

Re:This isn't a bad thing.

[Mr. Slippery]

you should be able to have open access..AND WPA2 at the same time.

But what would be the point? You need encryption at the application layer, since after the router it's all cleartext otherwise, so if WPA2 isn't being used for access control, what would it gain?

Re:This isn't a bad thing.

[Hurricane78]

LOL. The Internet was founded as a secure military network. The free and open access was the puberty. Now we’re kinda in the Married With Children phase. ;)

Re:This isn't a bad thing.

[IndustrialComplex]

If you're legitimately trying to prevent access, putting a weak WEP password on your AP is almost worse then leaving it open because it generates a false sense of security for your network. Now if you had a low-timer rotating WPA-PSK key, MAC filtered, and didn't advert SSID, then that's a reasonable amount of security (but still not full proof, but the amount of effort goes up to breach it).

WEP is a bit like locking the door to your house. This stops the casual person from walking into the house with no restrictions, but it will not stop anyone who WANTS to enter your house.

I used the same premise for my house in the country. I had a 1/2 mile long drive way with 2 switch backs and it was dirt/rocks and pretty washed out. I figured that anyone coming up there had already made their decision and using deadbolts was not going to matter much if I wasn't home.

Re:This isn't a bad thing.

[FrigBot]

Wow this is a really good point. I have to admit this complex setup stuff is way over my head, but someone should mod parent up, because he raises an important point.

Re:This isn't a bad thing.

[rwa2]

At some point, I was thinking of trying to set this up on my Linksys WRT54Gv4 when moving from HyperWRT to Tomato. But it seemed like too much work... maybe if I somehow end up with another WRT54G so I don't have to dink with my production configuration.

Also, Tomato has gotten a good reputation for performance... when I recently upgraded my FiOS to 25/15Mbps, I benchmarked my unit using http://speedtest.net/ and only got about 20/10Mbps using HyperWRT, but upgrading to Tomato allowed it to max out my link... which saved me from having to run out and buy a new router or go back to the awful but beefier ActionTec router that came from Verizon.

I've also wanted to play with OpenWRT, which has an OLSRD module that takes your open access point a step further and makes it part of a mesh. But sounds like that would involve actual work :/ And it seems likely that Tomato might support OLSRD sometime soon anyway.

Anyway, my machines are pretty up-to-date... and the only one I care about is the server which is serving out in the DMZ anyway. So I just leave my station wide open. I make sure I use encryption on anything I care about going out wirelessly (I wouldn't trust even WPA much anyway). And if the neighbors or wardrivers get to be a problem, then I might set up one of my older crap wifi routers up for them instead and monitor and rate-limit the heck out of it.

Re:This isn't a bad thing.

[hardburn]

This. For a local wireless network, what exactly are you worried about? People driving by and using a bit of free access to check email is no big deal. Even if they're making mischief trying to frame random people for child porn, it's unlikely they'll hit you up when they have to be physically near your place to pull it off. It's not like general perimeter security, where you have to be worried about automated scripts even if nobody is directly targeting you.

If somebody is really abusing your bandwidth, then handle that on a case-by-case basis. Otherwise, WEP/WPA just cuts into your local throughput and makes it inconvenient for guests to connect.

Re:This isn't a bad thing.

[Chris Burke]

Just use WPA-PSK. If they can break that and discover the shared key, the SSID and MAC filter "security" is incredibly trivial to break. In fact, since breaking the WPA would probably involve recording an authentication session between a client and the AP, breaking the encryption would mean they've found the SSID and MAC address for literally zero extra effort.

You want to talk about false senses of security, MAC filters and hidden SSIDs are right up there. I would agree that WEP is worse from that standpoint, because it actually claims to be a form of security when it's pretty terrible at that task. Hopefully people realize MAC filters and SSID hiding are like your chain link fence with an unlocked gate latch -- it keeps people out unless they, you know, try to get in. Layering it on top of WPA is pretty pointless.

Re:This isn't a bad thing.

[shaitand]

"By "properly" I mean segregation between the internal LAN, on a secured wireless link, and the open guest wireless; along with QoS prioritization of all internet traffic from the internal LAN above all internet traffic from the open wireless."

If you are interested in security, why do you have your internal lan on the wireless in the first place?

"This is not a hard problem, technologically; but it isn't something that Joe User could set up without it being largely out-of-box default."

Agreed. Most of the open hotspots aren't from generous souls. They are ignorant souls who plug in the router and use the defaults. There are quite a few networks around named "linksys".

Re:This isn't a bad thing.

[Anonymous Coward]

I think you've been going to the wrong JiffyLube.

Re:This isn't a bad thing.

[uncledrax]

Well actually the main reason I disable SSID is to prevent curious neighbors from even seeing it.. they might be inclined to ask me 'hey I see you have Wireless.. can I use it?'.

I agree that it's very easy to spoof a MAC and to sniff out a non-advertised SSIDs, and that a rotating-key WPA is the best and just a good WPA policy will keep your network secure, but I also want to 'hide' it from nosy, but not technically savvy, neighbors.

Re:This isn't a bad thing.

[Anonymous Coward]

When we moved in here, our next door neighbors were running unsecured. We pointed it out, and they didn't seem to care. So we asked them if we could connect and use their internet, and they said sure, no problem. Since we're low-income, it works out great for us.

Re:This isn't a bad thing.

[houghi]

Good! The Internet was founded on free and open access.

As long as you were a University or the military and payed a LOT of money to get that access.

Re:This isn't a bad thing.

[fuzzyfuzzyfungus]

Mostly because I have wireless devices that need access to the LAN. I have a few desktops and a block of NAS on the wired LAN and then a couple of laptops and netbooks connecting over a secured wireless link that need to be able to mount NAS volumes, ssh in to the desktops, and access various local HTTPS managment pages.

My concern about security isn't high enough to restrict all LAN activity to the wire, that would just be too much of a nuisance; but I don't want traffic on the wireless portion of the LAN to be in the clear(hence WPA2) and I don't want untrusted clients interacting with anything on the LAN, hence a separate VLAN for systems that connect to the open wireless, with access only to the internet.

Re:This isn't a bad thing.

[Anonymous Coward]

"but you gotta be willing to spend more than $20."

That eliminates most people in this society.

Re:This isn't a bad thing.

[mr_lizard13]

Genuine question (don't know if a precedent has been set for this?)
If someone does something illegal while they are connected to your access point, are you liable?

Re:This isn't a bad thing.

[dan828]

You're saying he should expect a free blowjob?

Re:This isn't a bad thing.

[???]

Until such time as ISP's are able to uniquely identify WHO did it and not just "well this guy owns the house where the service is terminated", the other folks in the area can get their own internet access.

Until such time as ISP's are able to uniquely identify WHO did it and not just "well this guy owns the house where the service is terminated", prosecutors and plaintiffs should not be able to meet their burden of proof on such offences.

There. FYP.

Obligatory IANAL

Now, hmmm. Consider 2 situations:

Situation A
- Bad guy cracks your WPA / WEP key and uses your network to download copyrighted material.
- You are sued (civil case), and the burden of proof required is preponderence of the evidence / balance of probabilities.
- You live in a densely populated area where there are a large number of computer-unsophisticated users who regularly use somebody else's network because they left it open
- It is introduced into evidence that you secured your network to try to ensure that only you could use your network
- The only question of fact at trial is the identity of the infringer - your defense is that somebody else may have used your network to commit the act in question

Situation B
- Bad guy uses your open wireless network to download copyrighted material.
- You are sued (civil case), and the burden of proof required is preponderence of the evidence / balance of probabilities.
- You live in a densely populated area where there are a large number of computer-unsophisticated users who regularly use your network because you left it open
- The only question of fact at trial is the identity of the infringer - your defense is that somebody else may have used your network to commit the act in question

Do you feel that it is more likely that your defense (somebody else did it) is correct under Situation A or Situation B?
In a civil case, where allegations do not have to be proven beyond reasonable doubt, how do you feel this impacts a balance of probabilities test?

"Securing" your network could put you in a worse situation. DUCY?

Re:This isn't a bad thing.

[profplump]

That sort of setup would do nothing to influence the statistics quoted -- there would be one open and one not-open AP added to the count.

Re:This isn't a bad thing.

[jimbolauski]

Just a little side note make sure the router is vertical they have overheating problems.

Re:This isn't a bad thing.

[jimbolauski]

No their supposed to bend you over.

Re:This isn't a bad thing.

[Chris Burke]

Well actually the main reason I disable SSID is to prevent curious neighbors from even seeing it.. they might be inclined to ask me 'hey I see you have Wireless.. can I use it?'.

Hey, that's actually a good reason to use a hidden ssid. If you consider your neighbor's nosiness and wheedling pressure to be a kind of social engineering, then you could even call it a security mechanism!

In my case, there are no less than 4 unsecured APs with default SSID names within range of my desktop alone, so I'm not worried about people asking if they can jump on mine. :)

Re:This isn't a bad thing.

[psithurism]

I see what you mean, but I considered that Situation B (bad guy using your unprotected wireless) is far more likely than situation A (bad guy bothers to crack your keys). The problem being that a legal case of any sort would an unbearable hassle (I live in the US, btw) and considering what the bad guy might be doing, the tarnish of the accusations may never come off as far as your job and family life are concerned. Therefore I like to reduce my chance of exposure to any of that by locking down my wireless.

In your Situation A (bad guy cracks key) I would add that wireless routers usually contain access logs which will have logged that the bad stuff occurred while a computer you nor law enforcement can account for was logged onto your router.

Actually, thats not the reason I lock down my wireless; I lock it down because my internet speed was crappy awhile back, which seemed to clear up as soon as I locked out my neighbors.

Re:This isn't a bad thing.

[steve_bryan]

The current Apple Extreme wireless access box does the segregation of internal network from open guest internet access out of the box. In particular it allows access to printers and disks connected via USB to Apple Extreme only to clients on the internal network. I don't see any QoS features and have not been motivated to pursue the matter so I don't know how hard it would be to deploy. It certainly is not available out of the box. It is a rather nice (and somewhat pricey) box especially the 5GZ capability.

Re:This isn't a bad thing.

[psithurism]

Probably not, but I don't know.

Assuming you are not liable, I would point out that after the victim/FBI tracks the activity back to your access point the ensuing legal battle during which you prove it was someone else may be unbearable and the accusations may never come off (e.g. if the bad guy was watching k1ddy pr0n, you'll probably lose your job and most of your friends even though you're later found innocent).

Re:This isn't a bad thing.

[Anonymous Coward]

As far as the judicial system is concerned, Situation B is worse because you will have acted in negligence by not properly securing your network, thus setting the stage for an untraceable crime, and aiding and abetting criminal misuse of technology.

All it takes to ruin your life is the insinuation that you downloaded illegal pornography. Do you think your acquaintances would ever forget that charge, even when it's erroneous?

Re:This isn't a bad thing.

[cayenne8]

"Just a little side note make sure the router is vertical they have overheating problems."

Thank you.

I do happen to have it on its stand in the vertical configuration. I'd not heard about the overheating thing before.

I must say, at this point, I've EXTREMELY happy with the unit. Everything works FAST and reliable so far.....much better than all of the linksys wireless units that I've had just fail on me after a period of time...and required periodic reboots for whatever reason, or would lock up if too much data went through them.

Re:This isn't a bad thing.

[ultranova]

The tag line for this article complained that you should be able to have open access..AND WPA2 at the same time.

[...]

There are wireless routers out there that do some neat things, but you gotta be willing to spend more than $20.

Getting a dual-band guest-zone enabled wireless router: >$20. Setting the SSID to "password: password": priceless ;).

Re:This isn't a bad thing.

[ultranova]

That sort of setup would do nothing to influence the statistics quoted -- there would be one open and one not-open AP added to the count.

Which would move the statistic towards 50% open/50% closed. When x approaches infinity, (o+x)/(o+x+c+x) approaches 0.5 (where 0 is the number of open access points, c is the number of closed access points, x is the number of access points that can be counted as both, and the result is the proportion of access points that appear open to access points).

Re:This isn't a bad thing.

[SEE]

if you just don't want everyone to take your sister for a ride then WEP is fine.

Exactly!

WEP is just a low fence with a No Trespassing sign. It doesn't physically stop people, but it lets them know that I'd like to keep my bandwidth to myself, thanks.

Re:This isn't a bad thing.

[Corporate Troll]

I have some old computers that just can't get anything stronger than WEP to run on them (an old iBook for instance)

Isn't this a software issue? I mean, load up a more recent operating system and you've got WPA. No? Am I missing something?

Re:This isn't a bad thing.

[The End Of Days]

This is Slashdot, we always cheer for Europe. They can do no wrong.

Re:This isn't a bad thing.

[shaitand]

yup, besides its a stretch for your average idiot to manage to manipulate all the buttons required to join an open wifi link.

Nobody outside of the IT world is going to know how to crack WEP or anything else.

Re:This isn't a bad thing.

[generalSocial]

how? darcy@siteware.com

Maths Lesson

[Anonymous Coward]

"approximately 30% of recorded Wi-Fi access points are unlocked, while some 70% are locked" thanks for the maths lesson

Re:Maths Lesson

[elrous0]

There could have been a "sorta locked" third option.

Re:Maths Lesson

[bakawolf]

WEP?

Re:Maths Lesson

[Anonymous Coward]

Perhaps MAC filtering?

Re:Maths Lesson

[hoggoth]

Remember, mostly locked is a little bit unlocked.

How secure is secured?

[IBBoard]

One of the guys I work with used to be a "penetration tester" (paid/hired hacker ;) ) and still has an interest in the area. He showed us a map of his route to work after he drove in with an Eee with wifi and GPS attached. With a bit of representation help, Google maps and a bit of colour coding then there was a surprising amount of people using WEP. Technically that's secured, but realistically it is as good as open for anyone with about 2 minutes and the right app (saw it demoed on the same Eee).

Re:How secure is secured?

[olsmeister]

One of the guys I work with used to be a "penetration tester"

Boy, you set the ball on the tee, now it's time for someone to hit it out of the park!

Re:How secure is secured?

[asdf7890]

there was a surprising amount of people using WEP

Mostly that will be people with older wireless APs, from before WPA was common, that use WEP by default. Many (A)DSL routers with built in wireless provided by ISPs come pre-configured with the ISP's current standard (now usually WPA, but previously WEP was common) with the default key for the unit printed on a sticker attached to the bottom of the unit. Most people never change these security settings (hence there are many APs left with the default of no security at all) so will stick with WEP until such time as they have reason to get a replacement router/AP and the new one comes pre-configured with WPA instead.

Re:How secure is secured?

[Anonymous Coward]

I think you've gotten your sports mixed up...

Re:How secure is secured?

[clone53421]

Never heard of tee-ball, hmm?

Re:How secure is secured?

[snspdaarf]

She could like sports, 'ey? 'ey? Know what I mean? Wink-wink, nudge-nudge!

Re:How secure is secured?

[SharpFang]

Realistically, it depends on traffic. I assure you a WEP network with long key and running a low transmission (for example instant messenger + RSS + WWW surfing, vs video streaming, torrents or online games) can take good many hours to break. Speaking from experience, two lunches, four beers and about 8 episodes of Cowboy BeBop before that nice mexican restaurant became Internet-enabled for me.

Re:How secure is secured?

[marcansoft]

I assure you a WEP network with long key and running a low transmission (for example instant messenger + RSS + WWW surfing, vs video streaming, torrents or online games) can take good many hours to break.

.

Good job living under a rock. ARP replay attacks have been able to break into just about any WEP network with any traffic for quite a while now. All you need is a single ARP packet and you win.

Re:How secure is secured?

[Anonymous Coward]

Quite true! I know in my neighborhood nearly all of the "secured" access points are using WEP. Which as well all know isn't secure at all. I've only seen two people using WPA, and I'm the loner here using WPA2.

Re:How secure is secured?

[sznupi]

Or people wanting to routinely connect Nintendo DS? ;/

Re:How secure is secured?

[nschubach]

A lot of the old off the shelf Linksys routers shipped without even WEP enabled.

Re:How secure is secured?

[tepples]

Buy a second router, firewall it off from other machines on your LAN, and power it down whenever nobody is playing a Nintendo DS WFC game.

Re:How secure is secured?

[Sir_Lewk]

A videogame is a piss stupid reason to make your entire network unsecured.

Re:How secure is secured?

[Anonymous Coward]

... Is she a goer, knowwhatamean? ....

and the punch line for all slashdotters everywehre ....

what's it like?

Re:How secure is secured?

[Cederic]

Mine did. Right now I have five devices connected to it.

Life is much simpler not having to remember/enter WEP/WPA keys...

Re:How secure is secured?

[witherstaff]

this is /. people we're talking about, so it'd be along the lines of the onion headline of "Special Olympics T-ball Stand Pitches Perfect Game"

Re:How secure is secured?

[Chris Burke]

Good job living under a rock. ARP replay attacks have been able to break into just about any WEP network with any traffic for quite a while now. All you need is a single ARP packet and you win.

Well I guess that's what he gets for watching 8 episodes of Cowboy Bebop instead of googling "WEP vulnerability exploits".

Re:How secure is secured?

[Anonymous Coward]

So watching the 8 episodes of Cowboy BeBop was all in vain? Ay caramba!

Truly Open?

[Anonymous Coward]

I wonder if this accounts for networks locked down to MAC addresses. I've never encountered an "open" wifi that was truly open (in UK), despite a lot of them appearing to be open, I just wonder how thoroughly they checked.

Re:Truly Open?

[Anonymous Coward]

Yeah that's Real Ultimate Security because it's impossible to sniff a network and clone a legitmate MAC.

Re:Truly Open?

[inviolet]

I wonder if this accounts for networks locked down to MAC addresses. I've never encountered an "open" wifi that was truly open (in UK), despite a lot of them appearing to be open, I just wonder how thoroughly they checked.

Interesting question. I wonder how difficult it is to sniff the traffic, discover a permitted MAC address, and then simply spoof that MAC address in order to utilize the network.

Even if the aforementioned was somehow impossible, I still would use WPA2 simply to prevent sniffing.

Re:Truly Open?

[hoggoth]

It's trivial to spoof a MAC address. Those networks are "truly open".

Re:Truly Open?

[gsslay]

It's trivial to spoof a MAC address. Those networks are "truly open".

No, "truly open" means my device can connect without any subterfuge being involved on my part. Your definition suggests that if a door's lock can be picked then it's it's the same as being left open. That involves you both having the skill in picking a lock, and being intent on entering despite it being clear you're not invited.

Re:Truly Open?

[Anonymous Coward]

Because of the large number of wireless devices in my house, this is exactly what I have done.

Re:Truly Open?

[j_sp_r]

I think most are WEP encrypted but are not advertising that fact. (This is called open authentication and is fact more secure then shared key). For more information see http://en.wikipedia.org/wiki/Wired_Equivalent_Privacy

Re:Truly Open?

[mqduck]

Personally, I assign IPs within a certain range to known MAC addresses. Everyone else gets IPs in a different range, and I use packet shaping to give the latter the lowest priority. So people can use my wireless router if they like, but only extra bandwidth that I'm not using.

Re:Truly Open?

[vaporland]

sniffing and spoofing MAC addresses is even easier than cracking WEP

What wired equivalent means

[tepples]

Technically [Wired Equivalent Privacy is] secured, but realistically it is as good as open for anyone with about 2 minutes and the right app (saw it demoed on the same Eee).

It also takes 2 minutes to sneak into the premises and find an open 100BASE-TX port. Sure, you could notice the burglar, but you could also notice the unfamiliar MAC number on your AP. That's why it's called wired-equivalent privacy. The point of weak security measures like WEP is to force an e-burglar to prove his intent to sneak onto your network, at which point you call the police and/or get your lawyer.

Re:What wired equivalent means

[IBBoard]

But those two minutes for physical access a) require physical trespass, b) require you to be in a much riskier situation where you can get physically caught/trapped, c) tend to require more than 2 minutes because you've got things like locks on doors and d) require you to know where the router actually is.

By comparison, breaking WEP and hopping on a wireless network is simple, and how many people actually keep an eye on their router for rogue MAC numbers? Also, you do realise that MACs can be spoofed, so in the right situation you could potentially just usurp a machine or use the MAC of a real but currently disconnected one, right?

Re:What wired equivalent means

[Anonymous Coward]

By comparison, breaking WEP and hopping on a wireless network is simple, and how many people actually keep an eye on their router for rogue MAC numbers?

A lot of us do. Arpwatch makes it easy.

Also, you do realise that MACs can be spoofed, so in the right situation you could potentially just usurp a machine or use the MAC of a real but currently disconnected one, right?

Many of us lock MAC addresses to the switch ports. You could also use 802.1x for even better security.

Re:What wired equivalent means

[nxtw]

It also takes 2 minutes to sneak into the premises and find an open 100BASE-TX port.

Not if there are no open ports due to 802.1x.

Re:What wired equivalent means

[tepples]

But those two minutes for physical access a) require physical trespass

As does Wi-Fi if your building is adequately shielded. Some buildings act almost like a Faraday cage, whether the legit occupants like it or not.

how many people actually keep an eye on their router for rogue MAC numbers?

How many people actually keep an eye on spare network ports hidden behind desks and the like for rogue Ethernet adapters?

Also, you do realise that MACs can be spoofed

Yes. It's as easy as unplugging a Cat-5 cable.

Re:What wired equivalent means

[BobMcD]

You make a good point, but you're ignoring that the criminality is equivalent.

Every encryption could be broken eventually, so the question is about barriers. How hard do you want to make it?

In this case, you're only making it to where a crime must be committed to gain access, and in a lot of scenarios this is 'secure enough'.

Re:What wired equivalent means

[SharpFang]

Wired equivalent if you want to connect up and use their uplink. Not when it's about snooping on the data.

Airodump running on a laptop in your backpack as you drink cola and read a book on a bench by the road outside is much less detectable than a stray wire plugged into your switch by a stranger who sneaked into your flat. The network card doesn't even have to announce its presence.

Re:What wired equivalent means

[jank1887]

Last time I saw a residential property with Faraday cage equivalent shielding... well, I never have. Even aluminum siding doesn't seem to keep me from seeing WiFi from the curb in most cases.

Let's just put it this way: tapping into someone's wifi from the curb doesn't require exposing yourself to an ass full of buckshot.

Re:What wired equivalent means

[pnewhook]

In our company, our network security means that even if you did get into the building and plug directly into the wired network, you still cannot see any of the networked PCs or network drives. You only get internet access. This makes it very convenient for visitors who come into the building for the day and need outside access.

Wireless works the same way. It's secure, but even if someone did break into it (we broadcast outside the building so you can go sit outside and work with a laptop if you wanted) they still can't access any data.

Re:What wired equivalent means

[tepples]

If it's about snooping on the data, protocols tunneled over TLS or SSH are sufficient. As I understand it, data link security is about allowing others to use your connection to distribute child pornography or blatantly infringing copies of entire non-free works.

Re:What wired equivalent means

[tepples]

you're only making it to where a crime must be committed to gain access

Which is incidentally little different from MPAA studios' approach of DMCA-backed DRM.

Re:What wired equivalent means

[Anonymous Coward]

I live in a house that was built before the ubiquity of drywall. The WiFi signal is not detected by most devices outside the walls without something to boost signal strength (like a foil dish).

Re:What wired equivalent means

[Scyber]

Last time I saw a residential property with Faraday cage equivalent shielding... well, I never have. Even aluminum siding doesn't seem to keep me from seeing WiFi from the curb in most cases.

http://online.wsj.com/article/SB126221116097210861.html

Apparently it used to be pretty common to put chicken wire in plaster walls. So some older buildings work effectively as faraday cages.

Re:What wired equivalent means

[Mad Merlin]

Some buildings act almost like a Faraday cage, whether the legit occupants like it or not.

Also, some cars are bulletproof. However it's quite unusual and not the default.

Re:What wired equivalent means

[Mad Merlin]

Technically [Wired Equivalent Privacy is] secured, but realistically it is as good as open for anyone with about 2 minutes and the right app (saw it demoed on the same Eee).

It also takes 2 minutes to sneak into the premises and find an open 100BASE-TX port. Sure, you could notice the burglar, but you could also notice the unfamiliar MAC number on your AP. That's why it's called wired-equivalent privacy. The point of weak security measures like WEP is to force an e-burglar to prove his intent to sneak onto your network, at which point you call the police and/or get your lawyer.

It also takes zero seconds to passively log all wireless communication. There's no physical presence to catch and no unknown MAC address in your AP. Even with WEP, it's trivial to decrypt the data after passively collecting a few days of traffic (substantially less time for busy networks).

Re:What wired equivalent means

[shaitand]

That's great. But I can hack your wep from the cafe across the street. I don't need to defeat your physical security like I do your open port.

And that assumes your switch doesn't have port security enabled, in which case your foreign mac won't get a link anyway.

Re:What wired equivalent means

[thePowerOfGrayskull]

By comparison, breaking WEP and hopping on a wireless network is simple, and how many people actually keep an eye on their router for rogue MAC numbers?

A lot of us do. Arpwatch makes it easy.

But most people don't.

Also, you do realise that MACs can be spoofed, so in the right situation you could potentially just usurp a machine or use the MAC of a real but currently disconnected one, right?

Many of us lock MAC addresses to the switch ports. You could also use 802.1x for even better security.

See prior comment. "A lot" in this case equals a small minority. Education is not what Best Buy sells alongside routers.

Re:What wired equivalent means

[thePowerOfGrayskull]

n this case, you're only making it to where a crime must be committed to gain access, and in a lot of scenarios this is 'secure enough'.

Secure enough for what? This isn't about getting them thrown in jail - it's about ensuring that your data is safe. Whether or not it's a crime is irrelevant once they spend two minutes and gain access to your network.

Re:What wired equivalent means

[BobMcD]

Secure enough for what? This isn't about getting them thrown in jail - it's about ensuring that your data is safe. Whether or not it's a crime is irrelevant once they spend two minutes and gain access to your network.

That is an unreachable goal. The only WAP that is completely secure is the one that is not connected to power.

Depending on the scenario, which I did explicitly state above, it is entirely possible that the data is of such little value that additional effort is wasted. The minimum effort, however, would protect you from any casual contact and would leave you only exposed to a genuine aggressor. Again, depending on the tools and time they employ against you, your measures may or may not be enough. Adjust your effort according to your needs.

Re:What wired equivalent means

[tepples]

And that assumes your switch doesn't have port security enabled, in which case your foreign mac won't get a link anyway.

Home router appliances that support MAC whitelists for wired LAN are likely to support MAC whitelists for wireless LAN as well.

Re:What wired equivalent means

[shaitand]

true, but on a wireless link you can crack the encryption and sniff the traffic to find an appropriate mac. You'd need nothing more than software and the wireless adapter to do it.

On a wired link you would need to have an appropriate link before you can begin to sniff traffic

Re:What wired equivalent means

[thePowerOfGrayskull]

I'm not sure what you're getting at. You seem to think that using WPA2 (which is , at the moment, unbreakable in practical use unless someone is foolish enough to use a dictionary word for the passphrase) requires a significant investment in time and effort over WEP. It doesn't - the effort is exactly the same.

If I can spend 10 minutes setting up my wireless network, and have the choice between WPA2 and WEP... I'm going to be choosing WPA2. Because making it criminal to log onto my network isn't what I'm after -- taking reasonable steps to protect my data is.

Re:What wired equivalent means

[IBBoard]

But is it the data on your network that is important, or the fact that anyone can hook on to your network and potentially start using it for anything they want? Most home networks (talking about the public as a whole, rather than /.) will have lots of music and games that are valuable in their own right (viruses writers are purposefully targeting game logins to steal them), but not the normal concept of "valuable". Not having the police break your door down because of what someone is doing on your network, or not having someone within your network having an easier job of infecting your machines than they would from outside the router/NAT also has its value.

Wigle.net map o' the world

[Anonymous Coward]

http://wigle.net/images/rigled-images/world.png

No wonder

[dunkelfalke]

because, at least in Germany, you are then liable for everything that is transfered over that hotspot. If someone downloads CP or warez you are fucked.

Re:No wonder

[228e2]

That also applies here in the US as well . .. although some people have been able to argue pure ignorance and get away with it.

Re:No wonder

[Anonymous Coward]

Also, Europeans tend (on average, not in every case) to have a higher degree of technical know-how than Americans, so on average more of them know _how_ to secure their access points. That's bound to skew the numbers: many people in the USA don't even know that it's possible to do this, and the WAP's ship by default unsecured.

Re:No wonder

[slim]

Europeans tend (on average, not in every case) to have a higher degree of technical know-how than Americans

[Citation needed]

Re:No wonder

[bsane]

ROFL

Re:No wonder

[russotto]

That also applies here in the US as well . .. although some people have been able to argue pure ignorance and get away with it.

What law, precisely, provides for criminal liability to the operator of a wireless access point which is used by someone else (without the consent or knowledge of the operator) for illegal activity?

Re:No wonder

[Anonymous Coward]

Agreed. Laws here are very undemocratic. Can't have open anonymous Internet access. That's not compatible with our government's fear of free speech. Lobbyism of the music industry and sheer incompetence of our judges top it off.

Re:No wonder

[omnichad]

Probably the same one that allows for a burglar to sue a homeowner when they cut their arm on broken window glass.

Re:No wonder

[John Hasler]

> Probably the same one that allows for a burglar to sue a homeowner when they
> cut their arm on broken window glass.

I.e., none.

Re:No wonder

[elrous0]

It's the MPAA/RIAA/FBI "Guilty Until Proven Innocent" law--the same one they've used to imprison, sue, and fine thousands of people in recent years (including some that didn't even own a computer)

Re:No wonder

[Anonymous Coward]

f-in germans........... not ur fault that someone wants to do illegal things on your "private" connection.

Re:No wonder

[Anonymous Coward]

We aren't all inbred hicks like our former president would lead you to believe.

Re:No wonder

[Anonymous Coward]

Europeans tend (on average, not in every case) to have a higher degree of technical know-how than Americans

[Citation needed]

None needed - see TFA. More Europeans know how to secure their WiFi routers than Americans do.

Re:No wonder

[hweimer]

because, at least in Germany, you are then liable for everything that is transfered over that hotspot.

Not if done properly. If you really run a deliberately open WiFi network you are legally a telecommunication provider and thus exempt from liability (as it should be the case in any EU member state). However, if you are caught filesharing and whine afterwards that maybe someone broke into your network, then probably not. So far, the courts have only decided on the latter cases.

Re:No wonder

[psithurism]

Sure, this case is a rarity, but it points out it can be done:
http://overlawyered.com/2006/09/the-burglar-and-the-skylight-another-debunking-that-isnt/

Actually, in the US, you can sue anybody for just about any reason, including giving a malicious hacker or file-sharer internet access. I would not be surprised to hear the RIAA tracked a hub of free music back to a wireless router and accused the owner.

Re:No wonder

[psithurism]

I saw TFA and I do not see where it states that. I see that more Europeans DO secure their wireless hotspots than Americans, but not the know-how-to data you say is there.

Re:No wonder

[anss123]

Speaking from experience I think it's more likely that European ISPs are better at informing their customers. Even so they could do a better job, the most common key I've seen is "1234567890".

Are there really more open hotspots?

[olsmeister]

Or does the USA just have a higher percentage?

Re:Are there really more open hotspots?

[Anonymous Coward]

Just like I've always said that the USA has just as many clever people as the UK.

Re:Are there really more open hotspots?

[Anonymous Coward]

No, it just that percentages are bigger in the US, especially in Texas.

facepalm.jpg

[Anonymous Coward]

N/T

Re:facepalm.jpg

[olsmeister]

Must be referring to this.

Population density is a plausible cause.

[Ferzerp]

More people who may hop on your network and negatively impact your performance would likely cause you to learn to secure things. We have a much lower average population density, so you are more likely to be able to remain ignorant (or just not care) and leave your AP open. If I have 4 people who can see my AP, they are much less likely to wreak havok on my quality of service than if I have 50. I would like to see stats on open AP% vs population density. Of course, the article may have this info. I didn't rtfa.

Re:Population density is a plausible cause.

[OoberMick]

Sweden and Norway come in the top ten of the chart in tfa, yet both have population densities much lower than the USA.

Re:Population density is a plausible cause.

[betterunixthanunix]

"More people who may hop on your network and negatively impact your performance would likely cause you to learn to secure things."

I have yet to meet someone who locks down their wifi network because of concerns about performance. All of the people I know were concerned about what people will use their connection to do, and of the possibility that they will be accused of having committed some crime.

Re:Population density is a plausible cause.

[fuzzyfuzzyfungus]

You'd really need to look at regional or local population densities, rather than national ones, to say whether Ferzerp is correct or not.

Without nice gear, or heroic measures, or unusually friendly terrain, wifi is dodgy at 100 meters and useless at 200(numbers approximate, if anybody has something more precise, feel free to report). What matters, then, is what percentage of WAP owners/operators have other people with wireless hardware within that usable radius. If most do, the country is "dense" in wifi terms, no matter how much open land or population not using wifi it may have elsewhere.

Re:Population density is a plausible cause.

[smellsofbikes]

I'll give my stats: I live in a rural/suburban area. There are two open networks in the area, mine and someone else's, and when I check logs I see one person getting on mine maybe once every two days. My brother lives in an area that has apartments and condos close together. He can see about 14 networks, none open, and every time he opens his up just to see what happens, roughly 5 people are using it at any given time. Based on that, I think it's clearly density-related from my limited data.

Re:Population density is a plausible cause.

[cptdondo]

And then again there is ignorance. The elementary school across the street from me runs an unsecured network. They also use channel-hopping APs, with the result that WiFi is utterly unusable in my neighborhood between 7 AM and 2 PM.

I tried dealing with their IT guys; basically I surmised that this is how Cisco provisioned the APs (in other works, how they came out of the box) and that they have security on their network.

True, to acutally use the network you have to log in, but without WPA or even WEP, anyone can snoop on the network. You use https to log in, but once logged in you are on a totally unsecured network with everything transmitted in the clear.

I've thought about snooping on their network and presenting it to the board, but they'd probably try to bust me rather than fix the problem.

Re:Population density is a plausible cause.

[John Hasler]

Low population density averaged over the entire area of the nation is irrelevant. What is the average distance between the average Swedish home and its five nearest neighbors?

Re:Population density is a plausible cause.

[OoberMick]

The article says that the USA as a whole has a lower use of secured AP. So unless there are huge numbers of unsecured APs in the rural areas of America, the large cities (with their secured APs according to this theory) will swamp the results, yet that doesn't seem to have happened. Therefore I think population density isn't the major factor, and this is bore out by the fact that Sweden and Norway (countries with low density) can come higher than higher density countries.

The densities for the larger European countries are ordered: Netherlands, Belgium, UK, Germany. While those countries were high on the list, it cannot be all there is too it as Spain comes top.

Relevance?

[Gothmolly]

The US also has more McDonalds, too. How is this even interesting?

Re:Relevance?

[nschubach]

I wonder how many of those APs were from "Free Hotspot" businesses like McDs, local coffee shops, book shops, etc.

Re:Relevance?

[Anonymous Coward]

Mine is longer than yours

Re:Relevance?

[psithurism]

Obviously interesting enough for you to come down here and comment on it!

The interest to me is the implications that locking down wifi hotspots has towards a society. I find this interesting. If you don't read the next story.

Hmm...

[fuzzyfuzzyfungus]

Did they account for MAC filtering and(rather more importantly) all the captive portal setups out there?

Obviously, if the SSID is the name of a consumer networking vendor and the hotspot is unencrypted, somebody just isn't bothering. However, particularly in commercial areas, there are large numbers of APs that are "open" in the sense that they aren't using WEP, WPA, or WPA2; but are good for absolutely nothing except dumping you at an HTTP/HTTPS login screen the first time you open a browser. A naive network scan, one that doesn't involve connecting to every open network, and attempting a variety of network activity to the outside world, isn't going to tell you the difference.

It would also be interesting, though hard to figure out, what the motives are behind the remaining open hotspots. What percentage are simple cluelessness, what percentage are somebody having to support a legacy device with broken wireless capabilities, and what percentage are altruistic.

Re:Hmm...

[pnewhook]

It would also be interesting, though hard to figure out, what the motives are behind the remaining open hotspots. What percentage are simple cluelessness, what percentage are somebody having to support a legacy device with broken wireless capabilities, and what percentage are altruistic.

The motive would be to encourage people to come with their laptops, connect to the internet as easily as possible without hassle, and stay long enough so they buy food and coffee.

Also a fully open network means they dont have to train staff in its use, dont have to pay much to maintain it, and dont have to wrestle with customers that can open a browser but dont know much else.

Having an open network at a coffee or restaurant (which is what the article is referring to) is a GOOD thing, not bad.

Intensive and extensive properties

[tepples]

For all intensive purposes [sic], only percentage matters.

Scientists distinguish "intensive" properties of a population, which hold regardless of the size of the population, from "extensive" properties, which are proportional to the size of the population. For example, in physics, density is intensive while mass is extensive. Or in chemistry, concentration is intensive while molar amount is extensive. Intensive properties, such as percentage of open APs, are more important for some surveys than extensive properties, such as raw number of open APs. Otherwise, such as if you try to compare the United States to Ireland, you just get a nearly meaningless result more or less equivalent to "market 1 has a higher population than market 2".

Re:Intensive and extensive properties

[BobMcD]

What about variance within population densities, both between different nations and different portions of the states?

For example, any wifi up at my Dad's ranch in Wyoming isn't likely to be protected in any way. On the other hand, if you ever got your wardriving rig close enough to sniff it, he'd see you and know you were there. His dogs would have alerted him to your vehicle's approach before you located his house in the distance.

Anyway, there would seem to be a lot more rural WiFi in the US than in other places. Perhaps I should go RTFA and see if they address this issue.

Re:Intensive and extensive properties

[pnewhook]

For all intensive purposes [sic], only percentage matters.

I think you meant 'for all intents and purposes'.

Re:Intensive and extensive properties

[imakemusic]

I think he was trying to be punny.

And Many wifi open hotspots are secure.

[Lumpy]

I have 2 customers that have 100% open Wifi access points that are secure. Why? you have to be trespassing even with a dish and bi-quad antenna to connect to them. and if you are trespassing, the dogs are eating your butt. Plus we used RF control devices (copper screen) to eliminate signal from going to the direction that would even possibly allow access from outside the estate. (2100 feet is the closest point and still filled with trees, shrubbery that all suck up wifi like sponges)

My home has an Open accesspoint, you have to be inside the house or on the roof to get access. I have aluminum siding and aluminum screens that are grounded. Even my WiSpy pro cant detect the signals from inside the house when I am 5 feet from the front door.

control your RF and you will be more secure.

Re:And Many wifi open hotspots are secure.

[gerryn]

I would say that 100% open wifi are not secure by definition.

Just curious as to why they do not put a simple passphrase with WPA encryption on?

Re:And Many wifi open hotspots are secure.

[fulldecent]

Hello.

I'm posting this reply from my iSlate, on large stilts next to your fence.

Re:And Many wifi open hotspots are secure.

[elrous0]

Back a few years ago when I built a giant faraday cage around my house--they said I was crazy. The homeowner's association sued me, my wife left me, the mental health people wouldn't let me see the kids, and I lost my job after extolling the virtues of the faraday cage to all the other employees at every opportunity.

But, in the end, I showed them! Now they see I wasn't so crazy. My house has the most secure wifi on the block!

Re:And Many wifi open hotspots are secure.

[gfreeman]

Mr elrous0, we've traced those malicious emails you've been getting. They're coming from INSIDE THE HOUSE!

Very good for Plausible Deniability

[Chrisq]

Someone told me that unless you are sure that you can secure your Wifi you are best off leaving it open. If someone downloads illegal content because you haven't secured it proplerly (used WEP or a compromised key) a court will here "secure wifi" and you will probably be screwed. If you say it was completely open then it will be very hard for a court to show "beyond reasonable doubt" that it was you.

Re:Very good for Plausible Deniability

[Anonymous Coward]

Has this theory been tested in court?

Maybe this would work for child pornography, but you can bet that the police will want to copy your hard drive and look for evidence. Do you really want to take this risk?

Now, you say "beyond a reasonable doubt" - that applies only to criminal cases. Illegal downloading of copyright material is generally a civil issue where the standards are much lower - they go on "a preponderance of evidence".

Good luck!

Re:Very good for Plausible Deniability

[Chrisq]

Has this theory been tested in court?

Maybe this would work for child pornography, but you can bet that the police will want to copy your hard drive and look for evidence. Do you really want to take this risk?

If you read what I said you will see I wrote "if you cannot secure it properly", which I though would be enough for people to see I am talking about people who are not engaging in illegal activity themselves.

Now, you say "beyond a reasonable doubt" - that applies only to criminal cases. Illegal downloading of copyright material is generally a civil issue where the standards are much lower - they go on "a preponderance of evidence".

Good luck!

That's why I said "illegal content" and not "content which you don't have the legal right to download". You are right civil cases have a lower bar (though tne "open access" defense might still work"), but you would still be in less trouble than if you downloaded illegal content.

And your point is?

[kenh]

Mark.JUK said "Nice to see everybody taking security so seriously then." Is there something inherently wrong with an AP that is connected right to a DSL (or other) internet connection to provide free access in, say, a coffee shop, library, city park, airport, or other common areas? McDonalds, Barnes & Noble, and many airports (thanks Google!) are offering "free WiFi" - by definition these can't be "closed"...

There are "wide open" residential gateways, but that number is dwindling (at least in my experience).

I work in a school district and we offer WiFi in all rooms in every building, but we have two "SSID"s - one secured (with access to our internal network, for administrators and district-supplied laptops) and one public (with only filtered access to the public internet, no internal resources available).

Re:And your point is?

[delinear]

If there are wide open residential networks, that probably just shows a larger number of early adopters who got on board with broadband before ISPs started locking them down (that, or it shows European ISPs are more security conscious, rather than European broadband users). In any event, I'm not sure what we're meant to take away from this knowledge, if I really wanted free WiFi it seems a bit drastic to move to the US to obtain it! (Not least because I've been in several large public organisations in the past couple of years who had "secure" WiFi with username/passwords of either guest/guest or guest/).

Personnally

[hellraizer]

i whould find that very dangerous ... i know wep / wpa2 are not bullet proof , but it does keep the average joe from doing funky stuff using my public ip address. i do not want to be blamed for something that others might do ... and wep/wpa2 helps

Re:Personnally

[betterunixthanunix]

Your post raises an interesting point about the society we live in. We are so paranoid about people abusing our generosity that we actively refuse to be neighborly and help each other. I know plenty of people who use open access points just to check their email and go to a few websites, but nothing else. I know more people in that category than people who are trying to conceal some kind of criminal activity.

Frankly, WEP and WPA2 are doing more harm to the innocent people who just want to use your connection to check email than to the people who are doing something illegal. A good lawyer could argue that your open access point weakens evidence based on IP addresses, because it decouples your IP address from your legal identity, but most innocent people would not be able to defeat WEP.

Re:Personnally

[hellraizer]

i agree with you but... i dont know where you live , but here in portugal ... there are very few of those "innocent" people you speak of ... i know almost for sure that if i open up my wap , there will be hundreds of people in the neibourhood using it for peer to peer trafic , porn sites etc etc ... even if they have their own internet connection , i have seen this happen before sad but true ...

Re:Personnally

[Ltap]

If they do and have their own - congratulations, you live amongst idiots. Most neighbourhoods are given a single shared pipe, so they'll be stealing bandwidth from themselves.

Re:Personnally

[clone53421]

Maybe it’s not the bandwidth they’re worried about. Maybe they just don’t want it tracing back to themselves.

Re:Personnally

[betterunixthanunix]

In which case they are still idiots. If they want to hide their activities online, they should use a connection that is really far away from them, which is basically what Tor does automatically. Using a neighbor's Internet connection to mask your activities is the same sort of logic that Eliot Spitzer (the former governor of New York) used when he gave his friend's name to the "escort service" that ultimately led to his resignation as governor.

Unlocked or using alternate methods?

[SharpFang]

Have they actually try to connect to the world using the "open" access points or just discovered unencrypted networks?
Because the latter really are abundant, but many of them require special cookies, login to proxy, VPN, correct MAC address, or just disconnect you as soon as you connect, basing on some premise you would be hard pressed to divine.

Sure I -see- about 25% of open networks when I start up Kismet while riding through the town. But only about 5-10% of networks are genuinely open - just connect and surf. The rest just uses alternate protection methods.

Insecure? Who says?

[Just Some Guy]

Dumb people have open hotspots. Smart people have closed hotspots. Very smart people have open, secure hotspots. Since I'm egotistical and put myself in the final category, let me explain:

My WAP is wide open to anyone who wants to connect to browse the web, check their email, etc. It's an OpenWRT firewall that allows regular, NATted access to the Internet but nothing more than SSH and OpenVPN (with SSL certs) to the LAN. I live on a quiet cul-de-sac, so the only people connecting to it would be my neighbors (whom I like and trust not to download kiddie porn), visitors, or people sitting in my driveway when I'm not home (whom said neighbors would probably take pictures of - yeah, I'm serious).

So what' s the downside here? I'm doing something nice for neighbors and visitors without any security exposure. Now, maybe I'm a unique supergenius and every other WAP operator in the country is stupidly naive, but I don't think that's the case.

Re:Insecure? Who says?

[xorsyst]

At least in the UK you would be violating your ISPs terms and conditions by knowingly allowing your neighbors access. Not sure what the US rules are.

Re:Insecure? Who says?

[Just Some Guy]

There are no "UK" or "US" rules. There are agreements between people and the businesses providing services to them. In my case, I'm complying with my agreement, and still would be if I lived in the UK and had the same contract.

Re:Insecure? Who says?

[nschubach]

I don't know of many ISPs running around with WiFi sniffers looking for their clients to be sharing.

Re:Insecure? Who says?

[xorsyst]

Ok, terminology difference. I'm referring to the terms of the contract as the rules, which seems reasonable to me. I'd be very suprised if you could find a UK contract that would permit what you are doing, it's a standard exclusion.

My comment that "Not sure what the US rules are." just meant, I wasn't sure if such terms are standard for US-based ISPs.

Re:Insecure? Who says?

[Fringe]

That's not necessarily even close to true. I've set up networks both in the U.K. and the U.S. (And Switzerland,etc.) Your "ISP" agreement depends very much on the type of account, and even then is negotiable. My U.S. account at home is a five-static-IP "business" account; I can do anything I want with it but am responsible for the mail servers, etc. And while the ISP formally blocks mail server ports for their "residential" accounts, their "business" accounts to the same locations can do anything. This is not due to, but rather despite, where I live. My "business" is at least five linear miles (and close to 8 driven) from the nearest office building. There's only two "businesses" within 4 miles - a "general store" and a golf course. Don't assume that all ISP agreements are alike.

Re:Insecure? Who says?

[Hatta]

Just wait until someone clicks an FBI honeypot link and see how smart you are.

whom I like and trust not to download kiddie porn

Because pedophiles never lead otherwise normal lives. They all have no friends and are immediately suspected by everyone. Right?

Re:Insecure? Who says?

[Just Some Guy]

You seem to be of the mindset that everyone is out to get you and there are cops eagerly staking out your house, waiting for someone to frame you so that they can send you to PMITA prison. What's the cost of that, though? Can you imagine what society would be like if everyone refused to be neighborly because of the (exceedingly unlikely) possibility it might harm them? I don't want to live like that and I won't. Go ahead and keep DHCP logs - that's easy and prudent - but don't choose to spend your life in fear.

Re:Insecure? Who says?

[Anonymous Coward]

And the ISP's recourse is clearly spelled out in those terms of service: account termination.

Re:Insecure? Who says?

[Hatta]

No, I just do a reasonable risk benefit analysis. There's a very slim risk of getting caught up in a CP dragnet, but the consequences of that are terrible. There's a negligible benefit to me leaving my AP open, so the risks pretty clearly outweigh the benefits.

Keeping DHCP logs might help keep you out of prison, but they can never wipe away the stigma of being an accused child pornography suspect.

Re:Insecure? Who says?

[Just Some Guy]

I disagree with your assessment. The risk is so tiny that the severe penalties don't even register for me. Should the improbably happen, I think I'll be remembered as the guy who cooperated with the police to investigate his neighbor.

Re:Insecure? Who says?

[xorsyst]

You are of course correct, I was assuming the poster was referring to a residential account.

Re:Insecure? Who says?

[Just Some Guy]

I was, actually, but my open AP isn't against my ISP's residential service agreement.

Re:Insecure? Who says?

[Anonymous Coward]

>I'd be very suprised if you could find a UK contract that would permit
> what you are doing

My UK ISP's contract terms say:

"It is not really our concern what you do with your internet connection any more than it is the concern of the power company what you do with the electricity they supply. However, we make it a requirement that you do not use the service for anything illegal."

Re:Insecure? Who says?

[Anonymous Coward]

I disagree with your assessment. The risk is so tiny that the severe penalties don't even register for me. Should the improbably happen, I think I'll be remembered as the guy who cooperated with the police to investigate his neighbor.

No you won't, have you even been paying attention to these cases?

Re:Insecure? Who says?

[Anonymous Coward]

You think it won’t happen to you, eh?

All I can say is, they had better keep those honeypot projects hush-hush. If I could ever get my hands on a live link, you can bet I’d take a drive and be hitting that URL from as many open wireless networks as I could find. They can go right ahead and raid everyone and then try and figure out what the hell happened that caused their brilliant idea to backfire so badly.

(And yes, I know how to change my MAC address, and I won’t do something stupid like reveal my identity by having a descriptive network ID or by checking my facebook at the same time.)

If I happened to hit you... oh well. That would be part of the cost of letting the law enforcement do idiotic things under the blanket assumption that anybody who gets caught in their trap must have deserved whatever they got.

Default Settings

[Hrshgn]

This difference might be caused by different default settings. In France for example, all the WiFi routers provided by the ISP I've seen so far have WPA pre-activated.

Open and closed

[maroberts]

I have two wi-fi networks; an open connection and a private one. I live in a small village and don't mind if some hill walker uses the open one to get his mail. Someday I may arrange things to limit the bandwidth on this but haven't had any abuse of it. It is getting harder to find private open connections; a year or two ago I could wander up any street in major city and find 3-4 open connections in minutes. I believe that most wireless routers nowadays are supplied closed by default and people don't change it....

What is meant by unlocked?

[QuietLagoon]

Some wireless hotspots do not use a WPA2 (or WEP, or whatever) password, but they do require a password to get past the access point's router and onto the Internet. Does this survey classify those access points as secured or not secured?

Re:What is meant by unlocked?

[Curmudgeonlyoldbloke]

Nothing whatsoever. It's just a crap press release from some outfit that no-one has heard of before that got picked up by ispreview.co.uk and then Slashdot. Not news.

Public wireless might as well be open

[bkeahl]

If a network is "public" then it may as well be open. If you're going to make it available for public use, why bother with WEP or anything else? If you're going to give the key to guests who ask for it then it's like locking your front door and standing out at the sidewalk and giving out keys to strangers who walk by. Private wireless is a whole different ball of wax, but I'm very surprised anyone is concerned that a PUBLIC hotspot is unsecured.

The real reason is simple, and of course Financial

[netsavior]

In the US you have unlimited bandwidth, choked to a certain speed, in the UK you pay for a certain amount of data transfer, and from what I understand can be charged for overages or cut off.
So there you go, I have no financial incentive to close my wireless access point. It is firewalled from my real network (I.E. my wired network containing all of my desktops, fileservers, and media boxes), is completely open... the SSID is FREEINTERNET.

of course I live in a small neighborhood in the boonies, it would probably not be so easy to siphon bandwidth from me if I lived in apartments or a city.
At one point in time I have a DNS camped EULA page that required you to agree to not engage in illegal activity on my connection before my DNS would work right (like hotels have) but my wife made me turn it off cause every time her netbook went in sleep mode she would have to re-click it.

Population density

[evilandi]

USA has a lower population density, so for many USAians, physical distance from any perceived threat may be sufficiently greater than the signal.

It's definitely that, and absolutely not that Americans don't read the manual or that Europeans think their neighbours are all crooks. Definitely.

I'm doing my part!

[sootman]

"Across the world, approximately 30% of recorded Wi-Fi access points are unlocked, while some 70% are locked. Nice to see everybody taking security so seriously..."

F U, I've been intentionally open since 2002 or so. (Basically, since I got it.) It's like, if you leave your lights on and windows open, someone can sit outside your house and read a book with the light you're giving off--OH NOES!

First of all, it doesn't cost anything to share a bit of WiFi. If someone happens to be driving by and needs it, they can park and use it. If a neighbor loses their connectivity for a day and wants to use mine, FINE, GO AHEAD--I won't even notice or care. Nor will my ISP.

Secondly: security? What security? I doubt there is a band of leet hackers hiding behind my fence trying to get financial data off my wife's laptop (hint: it's usually closed) or trying to pull my credit card number or bank login name as it whizzes by among gigs of other data. (Hint: you'll also have to crack HTTPS.)

You're worried about credit card fraud? Worry more about the 19-year-old you give your card to at a restaurant who disappears with it for a couple minutes. My family and I have had credit card info stolen and abused several times in the last decade and not once was the Internet involved, let alone hackers sitting outside our house at night doing MITM attacks. I'm more worried about an ACTUAL break-in (which I've also experienced) than a cyber one.

Re:I'm doing my part!

[DarthVain]

Only thing I am worried about is some ahole using up all my download cap, so I can't use it myself...

Re:I'm doing my part!

[Anonymous Coward]

"You're worried about credit card fraud? Worry more about the 19-year-old you give your card to at a restaurant who disappears with it for a couple minutes."

Exactly. I used to use separate cards for online and actual interactions. If I ever used my online card in a real world interaction, I never turned over my card (like swiping the card at a Walmart). On top of that, I don't have much of a life and don't go out much, so the number of charges on the real life card were maybe a handful a month compared to the card I used for online purchases.

The 3 times I've had my credit card number used, 1 I'm not sure where they got the number, the other 2 were for $10 and one for $200+, and both on different years in December, after I used the card around Thanksgiving when out of town friend's came in to visit and we ate at a particular restaurant both times just off a college campus and turned the card over. Either somone's sniffing their network/phone line or there's some crap going on amongst the workers (different waiter both times). Never been back to that place since.

I suspect the credit card company knows this with their datamining (plus I mentioned it the 2nd time when they sent me a new card) but I don't know if they do or can do anything about it when a particular establishment seems to be involved.

Re:I'm doing my part!

[D Ninja]

While all your statements are true, what do you do about someone downloading illegal material off your connection? Sure, you *may* be let off the hook with the "open network" argument, but it's going to be very painful and expensive to get to that point. In the meantime, your name and your family will be dragged through mud.

Re:I'm doing my part!

[houghi]

First of all, it doesn't cost anything to share a bit of WiFi

I have an unlimited account and am one of the few in my country (Belgium). The majority has something like 25GB or less and will need to pay extra.

There are months that I have 500GB of traffic. At 1EUR per GB that will cost you some 475EUR. OK, most moths I have something around 200GB. Still a lot of money you are willing to pay for me.
Now if you would have unlimited as well, I most likely would sometimes will cause a slowdown of your network.

Sure, you can then start limiting how much I could use.

And that neighbor you are willing to help? I had that happen as well. Guy came up to me and asked me if he could get access. No problems there.

Re:I'm doing my part!

[ktappe]

it doesn't cost anything to share a bit of WiFi. If someone happens to be driving by and needs it, they can park and use it. If a neighbor loses their connectivity for a day and wants to use mine, FINE, GO AHEAD--I won't even notice or care. Nor will my ISP.

I used to think that too, until one of my friends received a letter from Comcast informing him they knew he'd downloaded movies, and they provided him a list of which ones. That was the day I stopped sharing my WiFi. If I do something wrong, OK, bust me. But I don't need the MPAA taking me to court for movies my neighbor or a driveby downloaded.

Also, I can only get DSL where I live (4 years waitlisted for FiOS), so I often have my line saturated. I don't need someone else delaying my downloads....

Re:I'm doing my part!

[Gaffod]

Actually, open wifi is still better in this case. If it was a widely known/accepted thing that people use others' wifi, you are no longer liable for what your IP send or receives, period. You wanna sue me for warez my router downloaded? Prove it was me and not my neighbor, because, you know, it could have been. You can't? Then fuck off.

You should be saying holy shit here, because this means the ISP, or anyone monitoring your connection for that matter, completely loses the ability to use it against you. Basically, absolute freedom of expression, guaranteed by private citizens' desire to get free wifi wherever they go.

ISPs get plausible deniability for their customers, why not access point providers?

This is under reported

[kurt555gs]

With http://www.aircrack-ng.org/ you can have many more available WiFi hotspots.

An alternative to completely open.

[Gribflex]

I moved to France last year and was pleasantly surprised at the ISPs attitudes towards sharing wifi.

My provider, Free.fr, by default enables guest access on my router. However, it's not completely open.
In order to access the connect, you must enter your account details (login and password), and then you are given access to a limited connection.
Should you not want to share your connection with other people, you can easily disable this feature; but doing so also disables your account from being able to access roaming wifi.

I really love that the community sharing feature is enabled by default.
As long as I'm willing to share my connection with other subscribers, then I get access to their bandwidth when I'm away from home. And, as one of the larger providers in the area, this means I have access from just about anywhere I go.

Re:An alternative to completely open.

[Hrshgn]

What is nice about there implementation is also that the shared connection is separated from your private connection. This means that someone who is leeching on your community connection will not slow down your own connection.

Re:The real reason is simple, and of course Financ

[slim]

In the US you have unlimited bandwidth, choked to a certain speed, in the UK you pay for a certain amount of data transfer, and from what I understand can be charged for overages or cut off.

This isn't generally true. I'm in the UK and I have unlimited data. Many Americans have a download cap (just read the /. discussions on any OnLive story).

The US has lower population density

[Tweezer]

Many Europeans live in a much more urban setting then we do in the US. I live in a suburb and therefore I don't bother securing my wireless. If someone wants to use my bandwidth they'll have to be on my property to do it, because I don't get much range out of my house. Why should I bother securing it? It's much more conveniant to leave it open, especially when friends stop over or I'm working on someone's PC. All of my banking etc is run over SSL so it's encrypted endpoint to endpoint anyway. If I lived in a urban setting I would probably have to secure it though since many folks could leach if they wanted to.

Open APs always make me paranoid...

[fuzzyfuzzyfungus]

A while back, during my mundane but arguably misspent youth, I set up a "special" open AP.

Bog standard Linksys box, SSID "Linksys", no security(other than a decent password on the http admin panel). The WAN side of the router was connected to the internet; but went through a hub that was shared by a box silently running tcpdump and listening...

I never caught anything all that exciting, and eventually got bored and shut it down; but it wasn't a difficult exercise, nor are thoughtless and ever so vaguely malicious youngsters all that uncommon. Ever since, though, I always experience a twinge of doubt when I see an open AP.

Re:Open APs always make me paranoid...

[the_one(2)]

ssh tunnel ftw

On purpose?

[smoyer]

I take security very seriously but have purposely left my wi-fi accessible to whoever would want to use it. Instead of password protecting the wireless link, I made sure that the access point was secure and isolated from the rest of my network. Want some free wi-fi? Come and use mine for free!

I'm Confused

[Bob9113]

Nice to see everybody taking security so seriously then. It should be perfectly possible to "share" Wi-Fi while using WPA or WPA2 security measures at the same time.

I take security very seriously, so my machines are properly secured for direct access to the Internet, and my important machines are behind their own firewall.

I must be missing something about WPA or WPA2 -- how can you make your network show up without the little lock icon when a stranger passes by, so they know they can log in?

Why would I want to encrypt the channel, anyway? As soon as the comm hits the Internet it hops nodes I don't control. If I want it secure, I had better be using an encrypted channel at a higher layer. Admittedly, I could transfer sensitive files in the clear on my own network, but why? I use SCP for everything, which is easy (easier, IMO, than GUI) and it is a good habit to get into.

Which all is to say: I think the "WPA/WPA2 == security" thing is a bad meme. Good security starts above the network layer, and generally can end there. Meanwhile, securing all our Wi-Fi nodes kinda sucks in terms of making the network universally pervasive.

Free the APs, secure the machines and processes.

Re:I'm Confused

[pavon]

I was confused about that comment too - if I connect to some unknown wireless AP they can see my traffic whether WPA is enabled or not, and they are much more likely to be monitoring my traffic then someone with a wireless snooper. So allowing shared WPA2 connections doesn't make much sense to me.

I suppose another way to interpret that comment is that it would be nice to have WPA2 enabled on my router for my use with my machines, but still allow unencrypted access to the same router. That way you could have another layer of security yourself, while still sharing the connection with others. Bonus points if the unencrypted connections couldn't access my LAN, just the WAN.

Re:I'm Confused

[Rich0]

Free the APs, secure the machines and processes

Why not do both? I think the problem is a pervasive attitude among computer security professionals of all or nothing.

Which is worse - submitting form data over http, or over https with a self-signed certificate? I'd argue the former is worse, although some elements of risk are the same between them. If we just had three modes - unsecure, encrypted, and encrypted+ authenticated then we'd be much better off.

Ditto for WPA. There is NO reason why something like WPA2 needs to have a shared secret. Just use D-H to secure the session. By all means ALLOW for authentication, but there is no reason to prevent encryption when you don't have authentication.

Sure, there are MITM attacks if you have no authentication, but that's OK - it is no worse than if you have no encryption at all, and you greatly reduce the number of possible attack vendors and increase the detectability of an attacker. Which is higher-risk for an attacker - sitting a mile away with a passive parabolic antenna sniffing traffic, or actively performing a MITM (which can be detected and even triangulated with the appropriate gear)?

There is no reason we can't have security at multiple layers of the process. Why should weatherbug or whatever need to implement SSL just because I don't want anybody with a sniffer to know what my future travel plans are based on my queries?

If you absolutely MUST have only two levels of protection (padlock and no padlock in the browser lingo), then define no-padlock as encrypted but unauthenticated, padlock as authenticated, and then either share the no-padlock for unencrypted traffic or just block it altogether. There is almost no reason why IP packets shouldn't be encrypted.

Re:I'm Confused

[interiot]

and they are much more likely to be monitoring my traffic then someone with a wireless snooper

Are you sure? It's usually not difficult for law enforcement to find out who the owner of an AP is, because they're fixed in place. It's much more difficult to track down random passersby after the fact, because they're mobile and they're usually anonymous.

If you had the ability to sniff traffic, would you rather do it near your house (where the traffic is lower, and the chance of police finding later you is higher)? Or at your nearest coffeeshop (where the traffic is higher, and the chance of police finding you later is almost zero)?

Re:I'm Confused

[Bob9113]

I like your solution very much!

I was only thinking of the short run, in which people's AP detectors only tell them one bit of information. I think you are absolutely right that we (the makers of lightning) should advocate for the long term better solution of having two bits of information (publicly available and supports encryption), and should seek to make both bits true where possible.

You expect anything less?

[geekmux]

"...It should be perfectly possible to "share" Wi-Fi while using WPA or WPA2 security measures at the same time."

While it is perfectly "possible" to share WPA-secured Wi-Fi, it's not feasible, or the path requiring "minimal effort", which in many aspects of consumer electronics today, seems to be the mantra.

Also, maybe I'm alone in my thinking here, but generally if I see somewhere advertising a "hotspot", I tend to get a bit pissed when it's not easily (i.e. you connect and it just works) accessible. Isn't that the whole point of offering a "hotspot" to begin with? I don't read these statistics of unsecure "hotspots" as bad as most do I guess. I just see it as many more places offering free Wi-Fi.

Making yourself a *less* desirable target

[tepples]

If a hungry tiger is chasing you and another person, you don't need to outrun the tiger. Likewise, if your neighbors' APs lack encryption, you don't need to go all the way up to WPA2+802.11X because crackers will just crack someone else.

WeFi...

[EricX2]

Am I the only person who questions whether or not WeFi actually has data for all Wireless Access Points? I'm not sure where they get their data from, but if nobody in my area has scanned with their software do they show up in their system? Does their system take in account non broadcasting ap's? What about ad-hoc? Where I work I see laptops all the time set to broadcast as an ad-hoc connection... often named 'Free Public Wifi' or 'Free Internet Access' or 'HPsetup'. In the office I work in there is a coffee shop on the first floor and I literally see 15+ laptops generate alerts for being open AP's.

No it doesn't.

[John Hasler]

> That also applies here in the US as well...

No it doesn't. Criminal culpibility requires intent and liability for copyright infringement requires active participation.

Re:The real reason is simple, and of course Financ

[sznupi]

And Europe is UK...since when?

security?

[spikenerd]

Nice to see everybody taking security so seriously then

Why must you assume it's a "security" thing? Isn't it possible that some of us *want* to share our Internet access? This is the same attitude that people only use P2P for piracy. It's only mostly true.

Stop with the OMG NOT SECURE WIFI crap, please.

[BitZtream]

I must rant ...

I'm rather sick of hearing 'OMG NOT ENCRYPTED' or 'OMG USES WEP INSTEAD OF WPA' when talking about WiFi.

If you're talking about it while using a wifi hotspot, then you're just a fucking moron without even the slightest clue.

No one gives a fuck about your data. They aren't sitting at an airport trying to gather sensitive information. You know why? BECAUSE ANYONE WHO HAS SENSITIVE INFORMATION IS USING ENCRYPTION FOR ALL THEIR CONNECTIONS NOT JUST WIFI. It doesn't freaking matter if the wifi is sent in the clear, their actual session to their file server, mail server or web server is going to be encrypted via SSL or over a VPN.

Any half way competent admin treats wifi as an external network, regardless of encryption used on it, even their own internal wifi networks.

So fucking WHAT if your Starbucks wifi is clear text? You're upset because you're sending it over the air without encryption, but you're fine with the fact that it travels all over the Internet with no encryption? You're afraid someone at the airport may snoop you via wifi, but you don't care if they snoop you via the lan the wifi connects to? You somehow think that because it requires a password, that all the other people that have the password somehow can't see what your sending?

If its public, you're retarded for encrypting it or worrying about the encryption. Everything you're going to do that needs security has a different, BETTER way of handling security and encryption than ANYTHING wifi has to offer.

You don't need to 'share' wifi and use 'wpa or wpa2' at the same time, just fucking make it clear text and stop acting like its 'super secure' when its not. If anyone can buy in or someone easily get your wifi key than your encryption is 100% pointless. Wifi passwords are only useful as a limited effectiveness way of preventing people from using your bandwidth, thats it, nothing more.

Anyone who thinks they are 'secure' because of wifi encryption is just ignorant. Theres no reason for a hotspot to be encrypted, its there to be shared.

And for fucking reference, a hotspot is a place that allows random people to connect. Your WAP at home isn't a freaking hotspot, its just a wireless router. You don't have a hotspot in your home, Starbucks has one, McDonalds has one, the Airport has one. You have a WAP.

So you know why there are a lot of unencrypted hotspots? BECAUSE ITS RETARDED TO DO IT ANY OTHER WAY, the only reason it gets done other ways is shear ignorance and paranoia because of other twits on the Internet that scream OMG ENCRYPTION ENCRYPTION ENCRYPTION!@$!@%$!@%.

Re:Stop with the OMG NOT SECURE WIFI crap, please.

[Anonymous Coward]

No one gives a fuck about your data. They aren't sitting at an airport trying to gather sensitive information. You know why? BECAUSE ANYONE WHO HAS SENSITIVE INFORMATION IS USING ENCRYPTION FOR ALL THEIR CONNECTIONS NOT JUST WIFI. It doesn't freaking matter if the wifi is sent in the clear, their actual session to their file server, mail server or web server is going to be encrypted via SSL or over a VPN.

I agree with you that hotspot encryption is fairly meaningless, but honestly, get your head back into the real world where "all sensitive info is encrypted" is untrue for more than 99.99%+ of the population and bad habits will readily compromise the rest.

Re:Stop with the OMG NOT SECURE WIFI crap, please.

[Gaffod]

I think the hotspots, as in the sense you mentioned, "secure" it so those darn freeloaders won't steal their bandwidth. This is pretty annoying. Yesterday I needed to check Google Maps, so I walked in a coffee shop and to my "delight" found they had a WEP password, which turned out to be their phone number, which the waiter told me when I asked. What the hell? Security my ass, it's like the argument for locking your front door: It won't start (hackers|thieves), but will give the message to people that what's (on the network|inside) is your property. They are quite clearly trying to stop people from using their internet without buying anything, which strikes me as very rude.

Because ISPs in EU sell secured router/modems

[slashdotmsiriv]

It is very simple really. ISPs in the densely populated EU quickly figured out that if they don't restrict internet
access to the paying customers, many other users from the nearby apartments/townhouses will free-ride.

So, they simply sell the model and the wireless router as one package, with a passcode that is setup by the ISP
and printed on the back of the router.

It is not that European users or ISPs are more aware of security. It is because ISPs want to make sure people
do not free-ride on their services, and that the users do not have to set up themselves the security of their wireless router.

Shit runs downhill

[DarthVain]

Which is stupid if you think about it.

If that model makes sense, then ultimately the ISP is liable for whatever you access, or let other people access. If the ISP isn't the actual communication company, then it would figure that the phone/cable/sat company that gave access to the ISP, who gave access to you, who gave access to anybody, is also liable.

Personally I think it makes a better defense than anything else, as how can they prove it was you, when it could have been anyone that accessed your network?

To use a car analogy (because I can!), if I leave the keys to my car in the ignition and it is sitting on my driveway, and some idiot decides to take it for a joy ride while I am at work, and runs over someone, does that make ME liable/responsible for that death? No it doesn't not in any court in the world, which is why someone should challenge this silliness. That is to say, I didn't give someone permission to take my car, they just did, and it wasn't me running people down, that was, you know, a criminal...

I did not give you permission to use my network, I simply do not have it secure. The only analogy I can think of that makes sense in this was is if you treat the internet like a Gun. If I don't secure my gun, which I am LEGALLY OBLIGATED to (like in there is a LAW that says I actually have to, specifically), and someone gets that gun and kills someone, then yes, likely some liability and responsibility is there. However there is nothing like this for networks. There might be a EULA, that says something, but no one reads those, most wouldn't really hold up in court anyway, and they are not law in any sense of the word.

Anyway this interpretation that you are totally responsible for anything that happens on your private network ticks me off. Not to mention as previously pointed out, anyone with an ounce of knowlege can get around the usual methods to "secure" your network in about 2min if someone really wanted to (which mostly no one does). The whole situation is silly.

Re:Shit runs downhill

[dunkelfalke]

You are not quite right. First, since you open your network to the others, it stops being a private network anymore. Second, since an ISP can (and has to) provide the customer data to the police if a judge issued a warrant, but in your open network you'll never know who is the user so the police has to assume that it is you who breaks the law.

Re:Shit runs downhill

[DarthVain]

OK you got me on the private network. I meant as in Personal Network, as it in belongs to me, and is not publicly owned. The equipment is owned privately, and exists in my private home.

Secondly... SO? if a judge gets a warrant for the ISP, they can for me also. If that is the way of things, perhaps they should actually make a LAW that details the information you need to keep on people that use your network... Simply saying you are liable for anything on it is BS.

The police don't have to assume anything.

As far as I am aware no telecommunications LAW exists that says that I have to do anything, nor one that says that I am responsible for everything. If there is an actual law out there I would be interested to read it. Please post. Particularly if it is Canadian. I may be mistaken and I just am not aware of it...

It is all just EULA's, policy, assumptions, etc... none of which should pertain to that I should get charged with something someone else did on my network.

(EULA may be a legally binding contract depending on the content. However like any contract it doesn't cover illegal activities. Like I can make a contract with you to kill you, sorry that is still murder, contracts are not law, nor to they supersede it. I once had a lawyer tell me that you can put all the disclaimers you like, however it doesn't trump law, though it may help in interpretation, such as intent. So for example I can say, we will keep none of your information private. All that means is that the user has no expectation of privacy, which may help to make the argument to be able to release it, however we may still be obligated to keep the information private due to the legal interpretation.)

Re:Shit runs downhill

[dunkelfalke]

If that is the way of things, perhaps they should actually make a LAW that details the information you need to keep on people that use your network

If you can provide information of the users of your network (like their name and address or at least their phone number) you are treated as an ISP. If you cannot, the blame is on you.

EULA may be a legally binding contract depending on the content.

EULA is not valid in Germany if it is not part of the original contract at the moment of making the deal. And even then the EULA is not valid if it is too one sided or unusual.

Re:Shit runs downhill

[DarthVain]

I don't know I still disagree with the first part. That may be how it works in principle, but I am saying it should not, and it isn't right (not right as in factual, but right as in fair).

As to the last part, I believe contract law works the same way here. If it is an unreasonable contract it will not hold up in law, and most EULA's I have read are complete garbage. Like buy opening this package and reading this EULA I agree to give my first born son to the Sony Corporation for servitude for no less than 21 years, etc...

Re:The real reason is simple, and of course Financ

[imakemusic]

I'm in the UK and have "unlimited data". Which means I can download as much as I want as long as I don't try and get it too quickly in which case my connection speed and response times drop dramatically.

Yes, it is a bad thing. On several levels.

[fyngyrz]

Good! The Internet was founded on free and open access.

The problem with "free and open access", at least here in the USA, is you can be accused of being responsible if someone downloads something unsavory (in the legal sense) over your connection. Even if you win in court, the costs (time, money, reputation, loss of computing equipment, loss of ability to use the Internet, etc) of defending such an accusation are enormous; that's why I no longer leave a connection open for the public. "Free and open" is no longer something I associate with US law. We're far down the road of repression and censorship, sad to say.

Worse, the situation is continually degrading, and the consequences of something that is minor now could become considerably worse in the future. Congress and the states have shown absolutely no reluctance to enact and enforce ex post facto laws, which are (among other things) laws that make consequences worse after the fact.

Re:Yes, it is a bad thing. On several levels.

[hardburn]

Your chances of actually getting caught are not that great. You're a needle in a haystack. It get's better if everyone is doing it--then you're a needle in a stack of needles. Why should they seek you out when there are so many other choices?

Encryption is not worth the inconvenience, incompatibility with certain hardware, and loss of throughput just to defend against random miscreants.

Re:Yes, it is a bad thing. On several levels.

[fyngyrz]

All those arguments will go up in smoke when you are the one caught.

Re:Yes, it is a bad thing. On several levels.

[hardburn]

Or die in a car accident. Which is probably more likely.

Re:Yes, it is a bad thing. On several levels.

[fyngyrz]

Or die in a car accident. Which is probably more likely.

The reason you're not likely to die in a car accident is because you're trained to avoid risky behaviors of your own, and watch out for dangers from others, animals, and the environment.

What you're suggesting here is to drive your car with your eyes closed, and still expect to not have an accident.

You're every lawyer's dream: To the prosecutor, a naive computer user they can take right to the cleaners and carve another notch in their law degree. To the defense lawyer, you represent a new paint job for the Porsche, or that 150" TV they've had their eye on.

Eventually, you'll figure out that the last thing you want in life is to get yourself caught in the gears of the criminal legal process. There's no winning.

Re:Yes, it is a bad thing. On several levels.

[hardburn]

You're every security salesman's dream: someone they can scare with random stuff that never really happens to get you to buy shoddy products.

Re:Yes, it is a bad thing. On several levels.

[fyngyrz]

...someone they can scare with random stuff that never really happens...

• Yes, I suppose that
• you must be entirely
• right, despite the
• easily Googled evidence
• to the contrary.
• Of course, Googling is a rare skill, and one can't
• expect everyone to grasp it.

That, by the way, was a hit directly on your head with the clue-bat. :)

Re:Yes, it is a bad thing. On several levels.

[hardburn]

It ain't my job to Google you up your own argument.

What you have there are a few links about people being prosecuted for stealing Wi-Fi (not for providing WiFi where someone did something illegal), an opinion piece, a paper in a law journal speculating about liability for wireless networks in general, and a two year old bill in the House that never went to the Senate (and which is so broad that the Supreme Court would probably kill it with fire).

In fact, the peer-reviewed article doesn't help your point at all:

As demonstrated in the A&M Records, Inc. v. Napster, Inc decision, which involved vicarious copyright infringement liability of a peer-to- peer network provider, courts limit such liability to cases where the peer-to-peer network has "the right and ability to supervise the infringing activity and also has a direct financial interest in such activities." Regarding the right and ability to supervise, home-based WAPs typically do not come packaged with monitoring mechanisms that would facilitate the tracking of potentially infringing activity (assuming operators have a right to supervise such activity). In addition, although WAPs typically feature technology that allows the operator to block certain users, these types of functions usually require the operator to implement security options that the average user would probably avoid due to complexity and lack of automation. Regarding direct financial interest, given that those who deploy Wi-Fi residentially do so primarily to make the Internet more accessible within their own homes, it seems unlikely that home- based WAP operators would have any financial interest in infringing activities. Commercial HotSpot operators may have some indirect financial interest to the extent that infringing users may run up more access fees in their attempts to download infringing media files. Still, prevailing reluctance to impose responsibility on ISPs for harmful conduct committed by end users would probably protect these parties from contributory liability in this context.

It also mentions that you might violate your ISP's ToS by opening your WiFi, and that this may have legal penalties in some states (not mine, AFAIK, and I go out of my way to avoid that sort of ToS, anyway). But I guess making sure your links actually support your point was too much.

None of what you gave argues against my main point: that it's very unlikely that you'll actually be prosecuted for someone else doing something over your open WiFi connection, and this tiny risk is not worth the costs. Bruce Schneier agrees with this risk assessment.

The risk assessment works out something like this:

• There are a whole lot of open (or easily broken) WiFi connections, and some handful of people who want to use them without permission.
• Of the people who do, most will just want to check their email/facebook/whatever.
• Of the portion who will actually do something illegal, most will be downloading movies or music.
  • The RIAA/MPAA doesn't have enough lawyers to prosecute even 1% of these people, so it's unlikely you'll be caught in the crossfire
• A tiny percentage will then do something dangerously illegal, like child porn.

The last one get's all the headlines, but that's precisely because it's so rare. The consequences may be large, but the chances of that actually happening are minuscule.

If you can provide an actual argument against that, then I'm happy to read it. Preferably in the form of an actual decision against an open WiFi operator for something an uninvited user did. If you can't find such a case, that in itself is evidence that the risk assessment above is correct.

Well yeah

[argStyopa]

...the MOST unlocked hotspots? SWEET.

The fact that most of them connected to the web at something around 48kbps, not so sweet.

We have the largest tin-can-and-string network IN THE WORLD, BITCHES.

Re:The real reason is simple, and of course Financ

[Anonymous Coward]

in the UK you pay for a certain amount of data transfer, and from what I understand can be charged for overages or cut off.

In the UK it depends entirely on your ISP and contract. For example, my ISP is Virgin Media, which essentially owns the entire UK cable network. They have no limit on data transfers or extra charges or being cut off. What they do have is 75% speed throttling at certain times of day after a given amount of data is transferred.
http://allyours.virginmedia.com/html/internet/traffic.html

BT (British Telecom) has various options, some of which have extra charges per GB over a set limit and some don't. No cut off though.
http://bt.custhelp.com/cgi-bin/bt.cfg/php/enduser/cci/bt_adp.php?p_faqid=10495&cat_lvl1=346&p_cv=1.346&p_cats=346&s_cid=con_FURL_broadbandusagepolicy

Law of reverse service

[Penguin]

User from Denmark ( EU) here.

I admire the amout of (deliberately) open wifi hotspots in USA. A couple of friends traveled around the States last year and found free wifi services everywhere - except Las Vegas.

This seem to be an interesting phenomenon. At first it might seem reasonable: wherever you are expected to pay for services you are also expected to pay for Internet access.

However, this leads to some curious cases. I have experienced hotels in Denmark, England and Spain that charge for internet access. But on the other hand it is not uncommon for hostels (that are cheaper and where one would expect a lesser degree of service) to have free wifi.

The economic background is interesting. The cost of putting up a hotspot is pretty low, especially at simple hostels that probably already have internet access and wifi for the employees. But the expenses of putting up a payment solution and handling support is high.

This leads to an interesting paradox: It is the payment solution that might not be feasible at "cheap" places such as hostels; not the Internet connection by itself. The result is that since it is not worthwhile putting up a payment solution the Internet access is simply free!

In some places this leads to even more interesting results:

The suburban railway service in Copenhagen has free wifi on the the trains. These trips are usually short, hence the payment process might itself take too long to be convenient.

However the inter-city trains where travel times are usually about 1½-4 hours there is a wifi payment solution. At first it might make sense but as it is charged per minute any delays underway would lead to a larger travel time and therefore a higher total cost.

Free Internet access could partially make up for a bad travel experience with delays (one would be able to still work online, pass time by casual surf, chat and so on or update successive travel arrangements). Instead passengers are simply punished further economically when the travel is delayed underway.

Re:Law of reverse service

[Anonymous Coward]

Regarding hotels, you generally find decent hotels throughout the US will some degree of wired Internet access. This is definitely not the case in France or Germany for rooms at similar rates. I've usually had to pay Orange in Paris or Lyon and others in Hamburg because the hotels will have nothing.

Re:Law of reverse service

[smellsofbikes]

You leave a couple things out of your analysis that might be important.

1. You can only charge what the market will bear. People who go to expensive hotels will pay for internet. People who go to hostels are much less likely to be willing to pay, so if you offer it for pay, you're unlikely to get any takers when everyone can go down the road to a cafe, buy tea, and get free internet.

2. For a hostel, "free wi-fi" is a strong advertisement, that attracts customers to pay for lodging. For an expensive hotel, it is much weaker.

I agree that the cost to the establishment of setting up an infrastructure for payment is expensive and factors into the overall picture, but I think the willingness of customers to pay is driving this more than anything else.

Re:Law of reverse service

[noidentity]

I have experienced hotels in Denmark, England and Spain that charge for internet access. But on the other hand it is not uncommon for hostels (that are cheaper and where one would expect a lesser degree of service) to have free wifi.

Market segmentation perhaps? People with more money stay in hotels, thus hotels know they can afford extra for WiFi. People in hostels probably don't have money to spare for WiFi, yet could benefit from it, and it's cheap to provide for free anyway.

Re:Law of reverse service

[cerberusss]

The economic background is interesting. [...] But the expenses of putting up a payment solution and handling support is high.

Actually this is not really uncommon. In industries like telecom, the transaction costs have been higher than the product costs for a very long time.

It's more the culture, I think

[Xtravar]

It was difficult finding public restrooms in Spain, much less free ketchup packets at fast-food restaurants. So it makes sense that free WiFi is more available here as well.

Sanctimonious?

[Fringe]

I disagree with the apparent editorial tone of the post, where he says:

It should be perfectly possible to "share" Wi-Fi while using WPA or WPA2 security measures at the same time."

I and many of my friends have two access points - a secured one with MAC filtering that provides access to the LAN and data, and an open one for the internet. At least where most of us are at, houses are far enough apart and far enough away from the street that this does not pose any real risk, and adds a lot of convenience. Everything has a cost. More security is not always a good thing.

It's not technical issue but legal

[xonen]

As far as i'm concerned, it's not a technical issue or even a matter of security. It's a legal issue.

If someone uses my internet connection and uses it to [insert random illegal action here], i'l be the one that is responsible for that. At least, that's how the current situation here in holland looks like, and i bet it accounts for some other countries as well. Untill that legal issue is solved, by some trial court or whatever, it's seems highly unadvisable to share your internet connection with strangers, unless of course you want to keep your router's log files for years, in case you have to prove your innocence.

I'd love to share the connection for bypassers or neighbours, but i won't. Cause it's a stupid thing to do, right now, unless you dont mind all kind of charges against you. Has nothing to do with technical limitations, just a bunch of lawmakers who claim whatever public IP address transmits is tracked down to my personal address and my person...

WEP is a "Private Property" sign

[Anonymous Coward]

WEP is a "Private Property" sign. WPA doesn't stop crackers getting in, so why bother with anything more than "Private: Keep out" like other unused personal properties (like scrap land owned by someone).

Linksys

[jameskojiro]

I just plug a linksysy router into the power but no network to act as honeypot to keep people away from my network.

Re:Linksys

[clone53421]

Like they aren’t going to proceed to try the next unsecured network as soon as they discover that they can’t get internet access on your linksys WAP?

Seriously?

Ask 1000 regular computer users about MAC spoofing

[Zero__Kelvin]

"Interesting question. I wonder how difficult it is to sniff the traffic, discover a permitted MAC address, and then simply spoof that MAC address in order to utilize the network. "

For 99.9% of the population it is not only non-trivial, it is in fact impossible because they lack not only the tools to do it, but also the knowledge that it can be done.

Obviously we can do this, but if you really understand security you know about security landscapes. You know that keeping 99.9% of potential users/abusers is better than nothing, by about 99.9%. So no, it is not reasonable to say that MAC filtering is roughly the equivalent of no security at all.

Re:The real reason is simple, and of course Financ

[mewshi_nya]

Can you please explain to me how you do that? I've been considering it, but I am too lazy to google, and, since you're here...

Re: Don't think Tomato can

[colinnwn]

I have been told Tomato doesn't support multiple SSIDs, which is required to do this. I am doing it with DD-WRT on my WRT54GL router. One SSID is WPA2 AES and the other for visitors and neighbors to share is open.

Interesting that Tomato routes much faster than HyperWRT. I have 15/2 service which is supposed to boost to 30/2 temporarily. I've never seen above 10. I've wondered if my router is slowing the show down. But I am also running a lot of services like QoS.

Re: I don't think so

[colinnwn]

MAC spoofing is more like leaving the key underneath your doormat. The problem isn't the 99% who don't know how to do it. The problem is if you are unlucky enough to have the one-hundredth of 1% of people who are both knowledgeable and malicious, or haven't been socialized and don't understand how wrong it is like the geeky son of your neighbor.

If he can sneak onto your network, he can steal data you may be inadvertently sharing on your computers, or install viruses for fun or profit, or use it to order illegal items like satellite decoding equipment with stolen credit cards. You need to make it as hard as practical for these people to get in. The only way to do that is with WPA2 and AES (or at least the highest encryption your hardware supports). Anything else is false security.

This article brought to you by linksys...

[Anonymous Coward]

...America's #1 free nationwide wireless ISP!

Tell Nintendo

[Anonymous Coward]

... I hate having to choose between wifi DS and wpa2.

Re: Didn't work that time either

[colinnwn]

I do not advise the following as a good defense method. But if you are truly innocent, they can subpoena your computers. If there is no evidence of infringing files, and no evidence you tried to delete or remove evidence of infringing files, they will have to settle for nothing, just like they did in the case you cited.

IANAL, but I bet there was a decent case to get compensatory damages in that case if the defendant had wanted to pursue it.

Re: Yes, you can

[colinnwn]

I have exactly what you speak of using a WRT-54G and DD-WRT. Additionally more newly released routers are doing this as well in their stock firmware.

More Wi-Fi Spots != More Percentage of Wi-Fi Spots

[flabordec]

The article title is wrong, the USA does not have (necessarily) more Wi-Fi hotspots, it just has a better percentage. If I founded my own country in my house and opened my wi-fi router so anyone could connet I would get a 100% open Wi-Fi hotspot percentage, but I would still have fare less hotspots than the USA.

Couldn't find any numbers in TFA as to the real number of Wi-Fi hotspots either in Europe or the USA

Re: Didn't work that time either

[elrous0]

Yeah, and all you'll be out is the hassle of losing every computer you own for a year or so, tens of thousands of $ in lawyer's fees and lost time at work from having to defend yourself in court, many sleepless nights, etc. What a victory!

Re:I'm doing my part for freedom

[Anonymous Coward]

Yup, and I did come home one day to see a friend sitting on the front porch, using the wifi, and a neighbor used ours. Freedom of speech needs outlets and inlets.

Cultural?

[Anonymous Coward]

Aside from Americans being morons who can't secure WAPs, there could be a cultural difference.

The typical American residential entrance door is a thin steel door in a flimsy wood frame, a pretty weedy deadbolt--and any glass panes are easily breakable. From what I've seen, Americans have a thing for never locking their doors.

OTOH, I've seen European residential entrance doors with multi-point locks and high-security glass.

Hmmm...

indeed

[Bender Unit 22]

As I once before has mentioned, I was surprised to see open/free WiFi in every resturant,cafe etc. when I visited Chicago. I was able to phone home using Skype on my iPhone and save a lot of money(3$ pr minute).
Locally I can never find a open/free hotspot.
Also I found it amusing that the country that has such a terror scare, has so many businesses offering free WiFi without any registration. We have some stupid anti-terror laws that requires eveyone that offers WiFi to register every user and log what they are doing.

Re: Didn't work that time either

[colinnwn]

If there is no possible way you (or anyone with access to your computers) loaded an infringing file on your computer, then I suggest not mounting a defense, writing off those computers, and buying new. The RIAA would have to find something before they could take it in front of a judge and you'd be out any real money or time defending yourself.

In file sharing circumstances, people need lawyers immediately when they are either guilty, don't know what evidence might be on their computers, or feel there is a real threat of being framed. I believe the RIAA/MPAA is unethical, but I don't think they are devious to the point of trying to plant evidence. And if the chain of evidence isn't secure enough, when it goes before a judge, your lawyer (which you need by then) will tear it apart.

This is definitely a downer, but it is not such a risk that I'm willing to not act as a good citizen and allow my neighbors to occasionally borrow my internet. If I did, it'd be like I was allowing the RIAA/MPAA to be a "domestic terrorist." Personally though I have 3 computers in my house, together they are worth less than $1,000 and I keep a copy of all my files offsite. So that is all I'd be out. Given someone eles's circumstances this may be a good or bad deal for them.

Confirms what I've found

[ktappe]

When I traveled to France and Spain recently, I found lots of WiFi and nearly all of it was secured. I had a devil of a time finding an open spot where I could simply download my e-mail. I did eventually find spots, but it is not an exaggeration to say that perhaps 1 in 50 spots I found were open. I'm rather surprised this study thinks 30% were open; no way it was that easy to find one where I visited.

(France: Champagne region & the Montparnasse arrondissement of Paris. Spain: Mallorca and Barcelona. Of all these, Barcelona was the easiest to find open spots, but they were still a small % of the hotspots my scanner saw.)

Re:The real reason is simple, and of course Financ

[horza]

A lot of providers have a cheap option, which is limited to something like 8Mbps and 40GB/month, for about $10/month and a more expensive unlimited 24Mbps for around $20/month. The former is more for the 'silver surfer' that will just occasionally check email from the grandkids.

Phillip.

Where's Australia in here?

[YankDownUnder]

NO WHERE. Why? Beause the telco's in Australia want to keep us paying the most (more than nearly everyone else in the free world) and they want to keep control of the hardware.

Re:The real reason is simple, and of course Financ

[netsavior]

I am american you insensitive clod. The world is: Los Angeles, New York, England, China, and "other"

Re:The real reason is simple, and of course Financ

[netsavior]

I used ChilliSpot on the OpenWRT distro running on a LinkSys WRT54g , but I wrote my own CGI and web page for it, so it basically always authenticated if you hit "ok". Here is a decent howto although it is outdated, The downloads were moved to here