Slashdot Mirror

← Back to Stories (view on slashdot.org)

Sophos Researcher Suggests Password 'Free' to Spur Wi-Fi Encryption

Posted by timothy on from the has-some-drawbacks dept.

An anonymous reader writes "In the wake of concerns about FireSheep sniffing credentials from people using unencrypted public WiFi hotspots, a security researcher has proposed that the problem does not just lie with big websites like Facebook, but also with those who provide free wireless internet access. Chet Wisniewski, a researcher at security firm Sophos, proposes that all free WiFi hotspots should be encrypted — with the password 'free.' ''I propose standard adoption of WPA2 and a default password of "free." Whenever you wish to connect to complimentary WiFi, you select "Courtyard Marriott" or "Starbucks" like you always have, but you are then prompted for a password. Just type "free". It's not hard. In fact, operating system vendors could even program your PC to automatically try the password "free" before prompting you for a password on the assumption that you might be selecting a free service.'"

14 of 332 comments (clear)

  1. Before everyone says that's idiotic... by Mabbo · · Score: 3, Interesting

    ... just keep in mind that with WPA, the initial password is just used for connecting to the network, after which a session password is shared (right? pretty sure I'm right about that). So, technically, it would prevent someone from stealing your interwebs as long as you were already connected. Now, the guy who got to Starbucks before you and started sniffing before you did, he definitely has your personal information now, and this is a stupid idea.

    1. Re:Before everyone says that's idiotic... by CosmeticLobotamy · · Score: 2, Interesting

      Security's not my area, so maybe this question is nonsense, but why does each wireless router not have its own unique public/private key pair installed at the factory (that could later be changed by the owner) so that the session key could be generated by the client, sent to the server encrypted by the public key, and now only the router can decrypt the session key?

    2. Re:Before everyone says that's idiotic... by yakovlev · · Score: 2, Interesting

      In other words, the designers of WPA2 screwed up by not using something like Diffie-Hellman to negotiate a private connection before the initial password even changed hands?

      I realize this would be subject to man-in-the-middle, but that would seem to be detectable as you would get two different responses when you tried to do the initial negotiation, after which the OS should report "something's screwy with this network" and refuse to connect.

  2. Ridiculous And Totally Not Helpful by phantomcircuit · · Score: 5, Interesting

    Maybe he hasn't noticed that wireshark can decrypt WPA2 traffic so long as the network is being sniffed when the client originally connects.

    1. Re:Ridiculous And Totally Not Helpful by adolf · · Score: 3, Interesting

      The endgame is, Firesheep can always win. Or anyone with a packet sniffer. Unless the site goes completely SSL.

      Indeed, this is the most obvious end result.

      And now, for the most ridiculous question ever: Why isn't this being done? It isn't 1995 anymore: SSL is (at worst) easy and well-understood for these purposes.

      Why does this continue to be an uphill battle?

      --
      Kid-proof tablet..
    2. Re:Ridiculous And Totally Not Helpful by Anonymous Coward · · Score: 1, Interesting

      Because you have to pay to get your certificate signed, and sites that aren't transmitting sensitive data aren't going to pay for it.

      Yes, you can self-sign and avoid the costs, but if you do that the browsers tell the users that you're a dirty, evil cheat and liar for doing so, scaring visitors away from your site. It's taught people to think that insecure browsing is safer than SSL with self-signed certificates.

      Until something changes with either the browsers or the signing process, we'll never see 100% SSL use on webpages.

  3. Re:Careful with those quotation marks by ildon · · Score: 2, Interesting

    Except when you're signifying an explicit string that will need to be readable by a computer. I would tend to err on the side of caution lest someone mistake my correct English punctuation for some sort of design intent.

  4. Re:Standard Default Password? by gnapster · · Score: 2, Interesting

    Unencrypted access points already use a standard password: the empty password. How is this any different?

  5. Re:I like this. by TheLink · · Score: 5, Interesting

    I've suggested this before a few times: http://it.slashdot.org/comments.pl?sid=457132&cid=22455074

    Thing is he left out the part where there are two different modes of WPA2.

    One (WPA2 PSK) where if everyone has the same password, it's still not secure (know the same key, sniff a session's 4 way handshake, and you can decrypt that session's traffic).

    And one (the other WPA2) where it's supposedly more secure, but apparently still has problems: http://wifinetnews.com/archives/2010/07/researchers_hints_8021x_wpa2_flaw.html

    Yeah, not so simple for Starbucks to get right...

    Basically the WiFi standards bunch screwed up. So I actually blame them for a lot of the problems. So many years and they still haven't got WiFi to the level of TLS/HTTPS.

    HTTPS doesn't solve the "stupid user problem", or the "browsers not warning users of changed CAs", but at least the tech/standard isn't that crap, it's more a people problem.

    --
  6. "British" style is indeed logical by Kupfernigk · · Score: 4, Interesting
    Do I need to point out that the so-called British style is syntactically correct, whereas the traditional style is not? NoSig has obviously never thought about syntax, or it would be obvious that nesting requires the stop to go outside the quoted material.

    It's also perhaps worth noting that punctuation style is nothing at all to do with correct English. Punctuation is there to help understand the text, not to be part of it, and anyone who has ever trained as a copy editor knows that there are endless arguments over its proper use. If putting a full stop inside a quote means someone would naturally consider it part of the quoted material, it is clearly wrong.

    --
    From scarped cliff or quarried stone she cries "A thousand types are gone, I care for nothing, no not one."
  7. Set SSID to "password = free" etc. by billstewart · · Score: 4, Interesting

    If you put the password in the SSID so it's obvious, people won't have to guess if you're following that convention, or the convention that the password is "guest" or whatever.

    --

    Bill Stewart
    New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
  8. A simple modification to EAP-TLS by yuhong · · Score: 5, Interesting

    Christopher Byrd has a simple modification to EAP-TLS that disables client certificate validation to provide more secure open wi-fi:
    http://riosec.com/open-secure-wireless
    This would require modifying only the Authenticator and the Supplicant, and it would be a simple modification to both.

  9. Re:Standards conflate encryption and authenticatio by hedwards · · Score: 2, Interesting

    That's why after the WEP fiasco they should've handed the problem off to somebody competent. WEP was pretty much always a joke, because you really do need a lot more security when things are going over the air than you do when they're going over the wire. At least when things are going over the wire you need some access to the equipment relaying the messages. With wireless you don't even need that.

  10. Re:I like this. by anUnhandledException · · Score: 2, Interesting

    You can capture the handshake w/ WPA but not WPA2.
    Or more technically sniffing the WPA2 handshake will not allow you to decrypt the traffic.

    Of course TKIP is flawed and was only really included to allow backwards comptibility. WPA2 AES should be the only option.