Sophos Researcher Suggests Password 'Free' to Spur Wi-Fi Encryption

An anonymous reader writes "In the wake of concerns about FireSheep sniffing credentials from people using unencrypted public WiFi hotspots, a security researcher has proposed that the problem does not just lie with big websites like Facebook, but also with those who provide free wireless internet access. Chet Wisniewski, a researcher at security firm Sophos, proposes that all free WiFi hotspots should be encrypted — with the password 'free.' ''I propose standard adoption of WPA2 and a default password of "free." Whenever you wish to connect to complimentary WiFi, you select "Courtyard Marriott" or "Starbucks" like you always have, but you are then prompted for a password. Just type "free". It's not hard. In fact, operating system vendors could even program your PC to automatically try the password "free" before prompting you for a password on the assumption that you might be selecting a free service.'"

Comments

Before everyone says that's idiotic...

[Mabbo]

... just keep in mind that with WPA, the initial password is just used for connecting to the network, after which a session password is shared (right? pretty sure I'm right about that). So, technically, it would prevent someone from stealing your interwebs as long as you were already connected. Now, the guy who got to Starbucks before you and started sniffing before you did, he definitely has your personal information now, and this is a stupid idea.

Ridiculous And Totally Not Helpful

[phantomcircuit]

Maybe he hasn't noticed that wireshark can decrypt WPA2 traffic so long as the network is being sniffed when the client originally connects.

Re:Ridiculous And Totally Not Helpful

[adolf]

The endgame is, Firesheep can always win. Or anyone with a packet sniffer. Unless the site goes completely SSL.

Indeed, this is the most obvious end result.

And now, for the most ridiculous question ever: Why isn't this being done? It isn't 1995 anymore: SSL is (at worst) easy and well-understood for these purposes.

Why does this continue to be an uphill battle?

Re:I like this.

[TheLink]

I've suggested this before a few times: http://it.slashdot.org/comments.pl?sid=457132&cid=22455074

Thing is he left out the part where there are two different modes of WPA2.

One (WPA2 PSK) where if everyone has the same password, it's still not secure (know the same key, sniff a session's 4 way handshake, and you can decrypt that session's traffic).

And one (the other WPA2) where it's supposedly more secure, but apparently still has problems: http://wifinetnews.com/archives/2010/07/researchers_hints_8021x_wpa2_flaw.html

Yeah, not so simple for Starbucks to get right...

Basically the WiFi standards bunch screwed up. So I actually blame them for a lot of the problems. So many years and they still haven't got WiFi to the level of TLS/HTTPS.

HTTPS doesn't solve the "stupid user problem", or the "browsers not warning users of changed CAs", but at least the tech/standard isn't that crap, it's more a people problem.

"British" style is indeed logical

[Kupfernigk]

Do I need to point out that the so-called British style is syntactically correct, whereas the traditional style is not? NoSig has obviously never thought about syntax, or it would be obvious that nesting requires the stop to go outside the quoted material.

It's also perhaps worth noting that punctuation style is nothing at all to do with correct English. Punctuation is there to help understand the text, not to be part of it, and anyone who has ever trained as a copy editor knows that there are endless arguments over its proper use. If putting a full stop inside a quote means someone would naturally consider it part of the quoted material, it is clearly wrong.

Set SSID to "password = free" etc.

[billstewart]

If you put the password in the SSID so it's obvious, people won't have to guess if you're following that convention, or the convention that the password is "guest" or whatever.

A simple modification to EAP-TLS

[yuhong]

Christopher Byrd has a simple modification to EAP-TLS that disables client certificate validation to provide more secure open wi-fi:
http://riosec.com/open-secure-wireless
This would require modifying only the Authenticator and the Supplicant, and it would be a simple modification to both.