Queensland Police to Look For Unsecured WiFi Spots

OzPeter writes "As a part of National Consumer Fraud week, the Queensland Police are going war driving in order to identify insecure WiFi setups. From the press release: 'The War Driving Project involves police conducting proactive patrols of residential and commercial areas to identify unprotected connections. Police will follow this up with a letterbox drop in the targeted area with information on how to effectively secure your connection.' While some people may like having an open WiFi AP its interesting to see that the Police also feel that 'Having WEP encryption is like using a closed screen door as your sole means of security at home. The WPA or WPA2 security encryption is certainly what we would recommend as it offers a high degree of protection.'"

Comments

Just incase you want to jump on board.

[zippo01]

http://www.wardriving.com/code.php

Re:Just incase you want to jump on board.

[oztiks]

And the fact that maccas boast free wifi isn't a concern at all?

Re:Just incase you want to jump on board.

[crafty.munchkin]

I'm just so glad that the Queensland Police have solved all the outstanding crime and corruption within their ranks, in their fair state! Hopefully I'll be receiving a call soon about my entire worldly possessions which were stolen in 1995 during the brief 8 months I lived there. Oh yeah, fat chance.

I pity the poor guys who are on tech support for the cops.

Re:Just incase you want to jump on board.

[pbjones]

and like their burgers, it's crap!

How times have changed

[Aaron B Lingwood]

Merely 15 years ago I was doing the exact same thing and have been, on umpteen occasions, questioned, detained, given a 'move on' notice or just generally harassed.

Re:How times have changed

[davester666]

Being able to flash a badge lets you get away with murder...why would wardriving be on the do-not-do list?

Re:How times have changed

[backwardMechanic]

I expect you will receive a certain amount of harassment from the police if you try to arrest and jail somebody too.

Re:How times have changed

[Anonymous Coward]

LOL, you failed hard.

Re:How times have changed

[Aaron B Lingwood]

Yeah. Bloody zippo01 with his +5 Informative.

Re:How times have changed

[Anonymous Coward]

Yea, and 10 years ago I put a siren on my car and started blowing through red lights at 80mph and on umpteen occasions I was questioned, detained and arrested. Yet just the other day I saw a cop doing the same damn thing!

Re:How times have changed

[mcgrew]

I wonder why you got downmodded? It's a true statement. In fact, sometimes you don't even need a badge, just be on the neighborhood watch.

Re:How times have changed

[cpu6502]

Probably the cops will take this opportunity to arrest a few people for various "crimes" like looking at nude images ("This website may say the girl is 18, but she LOOKS like a child to me. That's a crime in Australia") or downloading movies/songs or whatever else they see you doing on your Wifi internet.

Re:How times have changed

[Anonymous Coward]

Actually you're totally supposed to be able to do this and many law enforcement agents have no special arrest authority above what ordinary citizens have. They might not like you doing this because it makes them less special, they're only powerful when they can do things you can't.

Re:How times have changed

[Anonymous Coward]

That's quite the segue from insecure routers to the headlines. This case seems overblown to me -- black on black violence doesn't get a peep, but suddenly there's a nationwide outrage because people thought the guy was white originally?

Look, shooting someone who's unarmed and probably weaker certainly *seems* excessive on the face of it, but nobody knows the details. Nobody knows if the kid was provocatively escalating the situation because he was (reportedly, and justifiably) angry that he was being followed. Maybe he threatened to have a gun and tried to intimidate the neighborhood watch guy. Until we know, it's stupid to be outraged. The fact that he hasn't been arrested after all this time leads me to believe (though not conclusively by any means) that he was probably acting rationally and justifiably in using deadly force. The real lesson here is *probably* "don't be a punk-ass kid who tries to 'front.'" I concede that it *could* be "don't shoot people because you don't like them," but I'll be surprised if that's what happened. It's not outside the realm of possibility by any means, but it would definitely be an elaborate way of going about it.

Re:How times have changed

[Grishnakh]

Bullshit.

Even in the Old West, the law was basically that you couldn't shoot an unarmed man, period. If he was unarmed and you shot him, you were hanged. There was only justification for deadly force if the other party had the capacity to also use deadly force.

According to your moronic logic, all I need to do is go find some guy walking down the street I don't like, walk up to him, shoot him in the head, and then claim that he "attacked" me. As long as there's no witnesses to deny my story, I get to walk away scot-free. How about you post your address, so that I can do this to you?

Re:How times have changed

[Anonymous Coward]

Being able to flash a badge lets you get away with murder...why would wardriving be on the do-not-do list?

That's nothing. I've had two different undercover police officers flash their gun to me when I asked them to identify themselves when they claimed to be police. I did report this to the station and requested that officers be reminded to show badges and not objects of agression.

That said... I think this story is no big deal. If they when around sending letters to people with only screens on their front door and reminded them that this is probably not sufficient to stop an intruder... well I wouldnt complain. Send another story when they actually start charging citizens for only using a screen door.

Re:How times have changed

[Anonymous Coward]

Ah, don't you look like the idiot now? Yes. Yes you do Mr. Grishnakh. How about you post your address so we can all come take a look and see just what a real idiot looks like.

It's Basic Infrastructure

[mdm42]

I have an open Wifi setup. My attitude is that connectivity has become basic infrastructure, and all "lock it down" freaks have just bought into the agenda of ISPs who don't want us to share bandwidth to boost their own profits.

If you're a guest in my home, you're welcome to use the bandwidth, along with the lights and water. Can you imagine visitig a friend only to be told, "Look, here's the PIN code to unlock the lights, and here's the key in case you want to wash your hands." Ridiculous. I accept that there's a risk of someone lurking in their car outside the property boundary to leech off my internet connection, but there's a risk of someone stealing water from my outside, unprotected taps, too. OTOH, if bandwidth were shared freely everywhere there'd be no need to sneak around "stealing" it, would there?

It's the 21st Century, man. Get over it!

Re:It's Basic Infrastructure

[Anonymous Coward]

I'd be more worried about an identity thief stealing data than a passerby leeching bandwidth. Easier to just wall it off. FWIW, we just post the password on the fridge, so our actual guests can use it if they want.

Re:It's Basic Infrastructure

[Anonymous Coward]

I have an open Wifi setup. My attitude is that connectivity has become basic infrastructure, and all "lock it down" freaks have just bought into the agenda of ISPs who don't want us to share bandwidth to boost their own profits.

As I have previously pointed out, this approach has the additional benefit that, should you be accused of any criminal wrongdoing based on where your IP address, you can more easily raise a reasonable doubt that it was you who left the tracks. I'm not saying that leaving your WiFi open is going to get you off the hook, but the more you lock down your modem, the easier you make it for a potential prosecutor to pin the wrap on you

Re:It's Basic Infrastructure

[Anonymous Coward]

Fon router project allows this.
you share 10% of your bandwidth on the open guest SSID, which is on a separate WLAN from yours.
Good if you have couch surfers stay allot too.

I agree that everyone locking down their wifi is just get sucked into the fear mentality. If all routers shared a small amount of their bandwidth you would not need to use GSM, and could make calls from almost anywhere using Viber for example or another SIP like service.
The mobile phone companies would also be forced to provide a better service because there was another alternative available when your mobile.

It maybe also be that the opens source routers like Tomatos USB offer multiple SSID's

Ged

Re:It's Basic Infrastructure

[gl4ss]

I have an open Wifi setup. My attitude is that connectivity has become basic infrastructure, and all "lock it down" freaks have just bought into the agenda of ISPs who don't want us to share bandwidth to boost their own profits.

that's the problem when the wide area wireless isp's and local cabled isp's are the same entity.

Re:It's Basic Infrastructure

[Aaron B Lingwood]

My attitude is that connectivity has become basic infrastructure

I concur. I would like to see connections open everywhere with the option of limited surfing as Guest (should the host feel generous) or having to authenticate to my ISP (or the NBN or some central authority/network) through this random open connection, and have all usage billed to my account.

Re:It's Basic Infrastructure

[Anonymous Coward]

I'd be worried more about the fact everything you send over wireless may not be encrypted...

Re:It's Basic Infrastructure

[Anonymous Coward]

And then you get arrested because you IP was linked to downloading child porn. Have fun!

Re:It's Basic Infrastructure

[Anonymous Coward]

Unfortunately the ISP cartel in Australia charge like wounded bulls and most (all?) plans are capped, so if your neighbour decides they like your connection you can burn your plan with ease.

Guests in my home are also welcome to use my WiFi - let me type the password in for you.....In the same way I give them the spare key and travel pass.

Re:It's Basic Infrastructure

[Errtu76]

Exactly!

Mine is encrypted though with 'acomplicatedpassword' which is very easy to type so I never get the odd looks I get whenever someone asks me for the passphrase.

Re:It's Basic Infrastructure

[hawkinspeter]

What I do is use a WPA2 network that all my devices use and an open network for guests to use that is firewalled from accessing the other network. That gives me the best of both worlds.

My attitude is that if I'm out and about and want to get WIFI, I'd like other people to provide open guest networks, so it makes sense for me to provide one for other people to use.

Re:It's Basic Infrastructure

[Chrisq]

I'd be worried more about the fact everything you send over wireless may not be encrypted...

But all the important stuff is over SSL/TLS anyway

Re:It's Basic Infrastructure

[hawkinspeter]

Use HTTPS Everywhere https://www.eff.org/https-everywhere/> and make sure that any confidential data is over https and then it doesn't matter that the WIFI is un-encrypted.

Re:It's Basic Infrastructure

[Anonymous Coward]

Or someone using your connection for downloading illegal content (pirating DVDs, music etc, or worse things such as child pornography) completely anonymously because when they track you down they find you not the guy in the car outside.

Re:It's Basic Infrastructure

[mvar]

You should be more worried if someone uses your WiFi internet connection to do something illegal. Next moment the cops will be raiding your house, seizing all your hard drives for further examination, while you go through all the hell of the legal process attempting to prove that you are not an elephant. No thanks, if a guest wants to access my wifi he should ask for the password and take the extra 30 seconds needed to type it in.

Re:It's Basic Infrastructure

[im_thatoneguy]

I have an open Wifi setup. My attitude is that connectivity has become basic infrastructure, and all "lock it down" freaks have just bought into the agenda of ISPs who don't want us to share bandwidth to boost their own profits.

Screw the ISP I don't want my cheap-ass neighbors slowing my Netflix down to a crawl while they download 10 seasons of some anime shit.

If we all "had internet" and people stuck to HTTP web traffic I wouldn't care. But I've had roomates before--hell I have myself as a roomate and I know that my internet is not big enough for the both of me from time-to-time let alone neighbors.

If I had a gig-e pipe they could be free to do as they please but I don't pay for my apartment building's electric bill, I pay for mine. And based on the fact that I can't even leave my laundry detergent on my little spot of shelf in my apartment building without it being used up in a couple weeks (and 2 loads of laundry from me) I know if they could secretly plug their water into my tap they would.

If I'm playing TF2 I expect there to be 0 torrenting and streaming on my connection so that my pings stay reasonable. It's bad enough knowing if one of my computers found an 'interesting' RSS feed let alone having two moochie neighbors.

Re:It's Basic Infrastructure

[Anonymous Coward]

I have an open Wifi setup. My attitude is that connectivity has become basic infrastructure, and all "lock it down" freaks have just bought into the agenda of ISPs who don't want us to share bandwidth to boost their own profits.

If you're a guest in my home, you're welcome to use the bandwidth, along with the lights and water. Can you imagine visitig a friend only to be told, "Look, here's the PIN code to unlock the lights, and here's the key in case you want to wash your hands." Ridiculous. I accept that there's a risk of someone lurking in their car outside the property boundary to leech off my internet connection, but there's a risk of someone stealing water from my outside, unprotected taps, too. OTOH, if bandwidth were shared freely everywhere there'd be no need to sneak around "stealing" it, would there?

It's the 21st Century, man. Get over it!

Sweet, where do you live? I need to download some child porn, DDOS several government and military sites, setup a proxy relay, upload some Al Quada training manuals, run a password guesser against a few banking sites, and email out some death threats. Your connection sounds like it will do the trick quite nicely.
Secure your network and stow that "Bandwidth is freeee maaaaaan" garbage. It's not free, it takes resources to provide, and fewer people paying means less bandwidth being added to the infrastructure.

I personally don't secure my wireless, because the only way out of my local network is through a secured tunnel which uses much more robust security than anything the wifi standards employ. So the cops are welcome to tell me how insecure my wifi is, and root around my honeypot all they want, but nobody is going to get to actually do anything useful.

Re:It's Basic Infrastructure

[Anonymous Coward]

Meh, you may complain about the "ISP cartel" in Australia but it is miles ahead of the crap they have in the USA. Not all plans are capped but unless you are on wireless broadband, most just throttle once you hit your cap rather then charge massive overage fees. All plans must clearly state the data limits that you have too.

    My current plan through TPG is ADSL2+ over Telstra's network which costs me $60 per month for 100gb/100gb. I get the maximum speed which my modem will connect at. If I were in a TPG owned DSLAM coverage area then I could get it cheaper or more data.

Re:It's Basic Infrastructure

[VortexCortex]

I have an open Wifi setup

I have a SSL Strip and other ARP Poisoning MITM Attacks. What's your home address?
Do you ever buy anything online? Would you like any script-kiddie to see AND MANIPULATE everything you do online?

Here's some advice for you ignorant folk who insist on leaving their WIFI insecure: Turn on WPA. This defeats ARP Poisoning via per client encryption keys. WAIT! Hold your uneducated retorts for just a second: Set the password to "Welcome" and the SSID to "Password is Welcome". You can stencil "Our WIFI password is 'Welcome'." on a sign in the yard if needed, but the SSID broadcast should be more than enough. Get the teenager down the street to configure your network if you don't know how to RTFM and configure the router.

Take the time to share free WIFI the right way, or not at all.

Re:It's Basic Infrastructure

[BurningFeetMan]

You obviously don't have a bus stop outside of your house! Waiting for the bus is great when you've still got one bar of reception from your home wifi. ;)

Re:It's Basic Infrastructure

[Anonymous Coward]

As I have previously pointed out,

Bruce Schneier has pointed out, you mean....

this approach has the additional benefit that, should you be accused of any criminal wrongdoing based on where your IP address, you can more easily raise a reasonable doubt that it was you who left the tracks.

Yes, you can... as part of your legal defense at your trial.
Reasonable Doubt is what a Jury has to overcome to convict you. Reasonable Suspicion is all the cops need to get a warrant... and if your wifi is open that's a good enough reason to kick down your door without asking questions at 3AM and confiscate all your gear.

A guy like Bruce would get a polite request, maybe a phone call or an email, from the cops to send them copies of all his security logs, so that they could catch whoever used his open wifi.

Besides, Bruce also said the rest of your network should already be secured. In which case, the wifi security is weak enough to not be worth wasting time over since your existing multi-layered model takes care of everything already.

Re:It's Basic Infrastructure

[Anonymous Coward]

How do you do this? Would you please be kind enough to explain or point me to a tutorial on how this is done? Thank you for your time and effort.

Cheers!

Re:It's Basic Infrastructure

[Anonymous Coward]

Bruce Schneier has pointed out, you mean...

No I meant me, right here on Slashdot a year or two ago. I doubt I was the first, nor will I be the last.

Reasonable Doubt is what a Jury has to overcome to convict you.

Thanks for that dude, but I kinda picked that up at law school. ;)

Reasonable Suspicion is all the cops need to get a warrant... and if your wifi is open that's a good enough reason to kick down your door without asking questions at 3AM and confiscate all your gear.

In your jurisdiction perhaps, but in mine (not QLD but close) a warrant won't issue merely on the basis of an open WiFi, there needs to be reasonable grounds to suspect an offence has been committed. Or did you mean, already holding the warrant, they will kick your door down because your WiFi is open? That too is unlikely. Having secured the warrant, the state of your WiFi is pretty much immaterial to how they will go about executing it. It goes without saying that if you have incriminating data on your gear, leaving your WiFi open pretty much useless.

A guy like Bruce would get a polite request, maybe a phone call or an email, from the cops to send them copies of all his security logs, so that they could catch whoever used his open wifi.

Which, of course, he would refuse.

Re:It's Basic Infrastructure

[Anonymous Coward]

Me too. And that's why I think what the Queensland police is doing is sort of OK. I don't want to use someone's Wifi if the they don't mean to leave it open. My stance is that an open network is open to everyone, practically, legally and morally, because it uses a public resource, advertises itself as open and in no way gives any indication that it is not meant to be open, even though that is trivially easy to do. People who don't want strangers on their Wifi should turn on encryption, and if that's what the police tells them, then I'm fine with it. I have a hunch that the police will do quite a bit of fearmongering on top of that, and that's not OK. But I don't want to step on people's toes when I use someone else's Wifi, so if you don't want me there, put up the virtual fence.

Re:It's Basic Infrastructure

[Stalks]

A linux box, iptables experience and a couple of WiFi cards/AP would be ideal, however there is an easier way..

Your ADSL/Cable router plugged into your ISP offers unprotected WiFi.

Buy another cable router and plug it into the above router offering protected WiFi behind its own NAT/Firewall.

Internet <--> ROUTER <--> ROUTER <--> LAN

Re:It's Basic Infrastructure

[N!k0N]

A linux box, iptables experience and a couple of WiFi cards/AP would be ideal, however there is an easier way..

Your ADSL/Cable router plugged into your ISP offers unprotected WiFi.

Buy another cable router and plug it into the above router offering protected WiFi behind its own NAT/Firewall.

Internet <--> ROUTER <--> ROUTER <--> LAN

yep, pretty much this. Just takes a little fighting to get things playing nice (i.e. tomato/ddwrt ... but you were gonna do that anyway, right?) Only thing you have to do then is make sure your devices aren't on the public one. Granted, it's also a good idea to limit the public ap, so people can't saturate your connection...

Re:It's Basic Infrastructure

[Anonymous Coward]

That doesn't help at all. A shared secret can only prevent shenanigans if it is kept secret among trusted entities. A public secret isn't a secret and can therefore not be used for authentication. An attacker could set up a relay mimicking your access point and do all the packet mangling they want.

If you wanted to do this right, you'd have to set up public key cryptography based access point authentication. There is no easy and free way of doing this though.

People who use some random stranger's network should always consider the network hostile. The attacker might not be the neighbor's kid who exploits people who use your access point. The attacker might be you, who provides the access point.

Re:It's Basic Infrastructure

[cmdr_tofu]

Not that i've rtfad or anything but i think isps in au and nz have metered charge systems. so if a neighbor uses your bw, you pay. They have every incentive to use your bw instead of their own (raising your bill).

Here in usa, i have no security on my wifi either, but it only grants access to my lan. To use the internet, openvpn is required. I usually relax that for guests as i cannot support every client.

Re:It's Basic Infrastructure

[cmdr_tofu]

"is your password a complicated password?"
"no its simple"
"what is it"
"acomplicatedpassword"
"i thought you it was simple" ...

Re:It's Basic Infrastructure

[Anonymous Coward]

By everyone locking down their wifi you provide credibility to the claim that an IP equals a perpetrator.

If I were to say, brute force your WPA2 using my graphics card, you would have a harder time making your case than if your wifi was open and it could have been anyone.

I care more about protecting the innocent than persecuting criminals I guess.

Re:It's Basic Infrastructure

[complete loony]

... and have all usage billed to my account.

I believe that the 802.11ai working group is working towards that goal.

Re:It's Basic Infrastructure

[Anonymous Coward]

My neighbor did this for about 2 weeks till they discovered that i use a lot more bandwidth then them. It took 3 months before it came up in conversation where he talked about some punk kid maxing out his internet pipe. I just smiled and agreed that those punk kids need to cut it out. :P Sure that can be easily fixed by limiting the guest network bandwidth but not every user or router allows/knows how to do this.

it was nice though to use two separate networks for torrents.

Re:It's Basic Infrastructure

[neo8750]

Some routers come with it out of box. I know netgear makes one i dont know the model sorry

Re:It's Basic Infrastructure

[neo8750]

The mobile phone companies would also be forced to provide a better service because there was another alternative available when your mobile.

I doubt this i see them just making it easier to make calls off wifi and claiming its a cool new feature.

Re:It's Basic Infrastructure

[Anonymous Coward]

That exposes you to ARP spoofing attacks carried out on the public Wifi, because all internet traffic from your private network passes through the open network that is accessible by anyone in range of the public Wifi.

Better get a cheap Wifi router, connect its uplink port to a switch port on your private network and configure its firewall so that it can only connect to the internet, not your local network.

Re:It's Basic Infrastructure

[Anonymous Coward]

They would be trying to spoof the MAC address of the Router, which won't work, as the private user would be the other side of the Router.

Re:It's Basic Infrastructure

[rwhamann]

Almost all the newer Netgear N models have this - my WNDR2000 and WNDR3700 (WNDR37AV) both have it. Even if you don't, how many of us have a B or G stuck in a box in the garage that we could use to add another zone?

Re:It's Basic Infrastructure

[Anonymous Coward]

WOOSH

Re:It's Basic Infrastructure

[eyenot]

I think you're right.

The ISP model is based on net scarcity, isn't it? We're talking about the internet, something which many people today might just take for granted in that it has not always existed.

The relative scarcity of ways to get online was, at one point in time, a profitable market. You could take advantage of that scarcity and charge people to get online.

But it's a corrupted and oppressed market, much like the diamond trade. Consider the whole DSL thing. The phone companies didn't win the war against 14.4 (when they wanted subscribers to start paying more for 'data usage') and things kept going until 56kbps and the next iteration up in baud (I seriously can't remember.) Suddenly any modem that came next was part of their DSL wrapper / profit scheme.

So what we end up seeing are projects to create free wifi for the entire city get tagged by ISPs, phone companies, and cable companies (there's actually a lot of money and political power concentrated in those three) as "the enemy" and the funding or the public interest never shows up.

I think it all generates the wrong attitude about the internet. There's no reason to require that a wireless network is secure. The only people it hurts are those who have to ultimately share the bandwidth.

Cops could argue all day long about, people using it as a gateway to hacking and so on, and frankly, cops and their legislator lapdogs don't know anything about the internet. Just as there is no real security on the internet, and no real identity, the inescapable future for these various net-related laws is that they are all going to be broken increasingly until they are broken constantly, and enforcing them will become increasingly expensive until it becomes an unacceptable expense to the public.

Re:It's Basic Infrastructure

[Anonymous Coward]

All private internet traffic would be sent from the external IP address of the private router to the the internal address of the public router. Anyone on the public Wifi can spoof the ARP responses for the internal IP address of the public router to the external IP address of the private router and put themselves in the path of traffic between the routers, i.e. your private internet traffic.

Re:It's Basic Infrastructure

[jo_ham]

Apple's 4th and 5th gen Airport Extreme routers also have this. Pretty much all of the higher-performance dual band routers include it now.

The saucer-shaped Linksys ones also offer it.

Re:It's Basic Infrastructure

[thePowerOfGrayskull]

Indeed. People seem to think that leaving it open will be sufficient defense -- either glossing over or ignoring the fact that their equipment will be seized under warrant well before the authorities start asking questions that might reveal this defense. Ultimately the lack of offending content will be what saves them - not the fact that their APs are open.

Re:It's Basic Infrastructure

[BeardedChimp]

Then just set it up with your own encrypted wireless connection having better QoS, and that the open and free wireless connection has a leaky bucket approach to bandwidth that prevents anyone from abusing it.

Re:It's Basic Infrastructure

[synapse7]

Why do you need two routers? Segment a guest ssid.

Re:It's Basic Infrastructure

[Geeky]

BT's latest offering in the UK has this built in. You basically have two separate wi-fi access points built in to the router, one sort-of public, one private.

If you're a BT customer, and opt-in to share your public wi-fi, you get to use anyone else's when you're out and about - the idea being that if they have a sufficient customer base you'll always be in reach of free wi-fi access.

They don't actually make clear in their documentation whether the public access point contributes to your download limit (if you have one), but I'd assume it wouldn't otherwise who in their right mind would sign up?

Re:It's Basic Infrastructure

[realityimpaired]

Or if your existing router doesn't support a guest wifi network, flash it with Tomato, DDWRT, or any of the other after-market firmwares that do....

A growing number of off-the-shelf wifi routers support guest wifi networks out of the box, though.

Re:It's Basic Infrastructure

[Anonymous Coward]

You obviously have nice neighbors. And their visitors are nice too. See, the "infrastructure" arguments is fine as far as it goes. However, if you come home from work and find some nut using your hose to wash their car (I had this happen once), you just need to tell them to get lost and it costs you a small amount on your water bill. If that same nut did something illegal (pissed off the MPAA / RIAA, downloaded child porn, etc.) over your open wifi the costs to you will be astronomical. It isn't even in the same class as someone using your power or your lights. I'd love to buy into your argument and have open Wifi. But - I think it is more like this: Do you leave your door unlocked with all your money just sitting there inside by the door? No? Don't trust the common man that much? Yeah, I don't either and I don't want the lawyer / court bills defending myself from what said common man might do on my network.

Re:It's Basic Infrastructure

[hawkinspeter]

But there wouldn't be any evidence of wrongdoing on your PC, so they'd have to get some more evidence. IP addresses do not correspond to people - you need more than just a log entry to convict someone.

Re:It's Basic Infrastructure

[morgauxo]

I want to agree but I don't feel like going to prison when somebody parks their car out front and downloads their daily dose of kiddie porn.

Re:It's Basic Infrastructure

[realityimpaired]

Here in usa, i have no security on my wifi either, but it only grants access to my lan. To use the internet, openvpn is required. I usually relax that for guests as i cannot support every client.

No offense, but you're nuts... You'd be safer opening up free access to the Internet, and segregating your LAN onto a separate VLAN that requires a password. Most people who "steal" wifi just want free access to the Internet, but there's a few who would quite happily make use of your LAN instead.

You could also use a captive portal, if you want to keep the wifi unencrypted. They're fairly easy to set up.

Re:It's Basic Infrastructure

[hawkinspeter]

The answer is 2 networks. One open and advertised with no access to other devices, and the other WPA2 (hidden if you like) and secured. You can throttle down the open one if you get any bandwidth problems.

Re:It's Basic Infrastructure

[Errtu76]

Glad you got it ;)

Re:It's Basic Infrastructure

[alphred]

Yes, but in order to discover that there is nothing on your PC, the police will break down your door, search your house and remove all computer-related devices that they can find. After a few months in their possession, and a thorough search of the contents, they will conclude that you must have hidden the illegal content on a thumb drive or some other device that they must have missed. In the meantime, your name and details of the search incident will have been released to the local press and the court of public opinion will have already reached a verdict of guilty that you and your family will have to live under forever. Lack of evidence in this case is not the same as innocence.

Now, this scenario may or may not be likely, but you do have to ask yourself if it's worth it to have an open connection.

Re:It's Basic Infrastructure

[halcyon1234]

I do like this idea, but I worry that it'll breed a whole new vector for phishing. Put up a wifi spot with a fake login page, and collect the accounts of "roaming wifi" users. Then use their airtime elsewhere, or worse-- make it seem like they've connected OK, but keep a MITM to sniff all their traffic.

Re:It's Basic Infrastructure

[Nofsck Ingcloo]

WPA/WEP etc do not provide for encryption of the traffic through the WiFi. They only serve to limit who may use the WiFi connection. If you want encrypted data transfer then HTTPS or equivalent is mandatory.

Re:It's Basic Infrastructure

[betterunixthanunix]

You probably would not go to prison. The prosecutor would basically have no evidence (assuming you do not have child pornography on your hard drive), and you would have all the reasonable doubt in the world due to your open wifi access point. Now, the difficulty with this approach is that you need to have nothing incriminating in your home; when the police show up and see a bong sitting on your table, they'll just add that to the charges against you.

Re:It's Basic Infrastructure

[garyoa1]

Well, problem if you live in an area that has say... 1000 people on line. You end up with them all dropping their service and everyone using your wifi. (Which would obviously make it quicker for you to write a letter and send it via snail mail)

And how does the ISP stay in business with only one paying customer?

Re:It's Basic Infrastructure

[Dcnjoe60]

A guest in your home is fine. Of course, even with WPA2, as a guest you can give them the password. Then again, you take responsibility for a guest in your home. What if your neighbor's kid uses your intentionally free access to do something illegal, like child porn. Are you not then contributing to the activity? In addition, the authorities are going to come after you, because it is your IP address they will have.

Now one may argue that they were not a party to the activity, just like an ISP is not a party to it, however, unless you are registered and operate as an ISP, then you lose that argument.

It seems that your position, while laudable, is also very naive, It puts you and your family at an unnecessary risk.

Re:It's Basic Infrastructure

[Dcnjoe60]

What I do is use a WPA2 network that all my devices use and an open network for guests to use that is firewalled from accessing the other network. That gives me the best of both worlds.

My attitude is that if I'm out and about and want to get WIFI, I'd like other people to provide open guest networks, so it makes sense for me to provide one for other people to use.

Restricting your network to specific MAC addresses would be a good protection, too. As for wanting WIFI when you are out and about, there are data plans for that.

Re:It's Basic Infrastructure

[Dcnjoe60]

By everyone locking down their wifi you provide credibility to the claim that an IP equals a perpetrator.

If I were to say, brute force your WPA2 using my graphics card, you would have a harder time making your case than if your wifi was open and it could have been anyone.

I care more about protecting the innocent than persecuting criminals I guess.

That approach does not hold up in court, at least in the US. For instance, you have an open WIFI connection that someone uses to download child porn. You claim, but I didn't download the porn, somebody else did. That is true, you only distributed it, since it did flow to your device and then out again. Not a very smart strategy, if you ask me.

Re:It's Basic Infrastructure

[hawkinspeter]

On the other hand, if you're on an unlimited broadband deal, you can't bank unused bandwidth, so you might as well let other people use it (with appropriate QOS so that they don't cause a problem with your own access).

I refuse to bow down to the idea that an IP address resolves to a person. If you've got a log somewhere with an IP address and some "illegal" file, you've got to prove that it was me. It's easy to fake logs and typically ISPs don't perform security checks on their workers. If you accept that you have responsibility for anything done with an IP address that was assigned to your router, then you open yourself up to all kinds of spoofing attacks. They need proof, not just an IP address log.

Re:It's Basic Infrastructure

[Anonymous Coward]

No offense, but that's like handing out your car keys to random strangers and saying "Don't do anything illegal with my vehicle."

Re:It's Basic Infrastructure

[ZiakII]

By everyone locking down their wifi you provide credibility to the claim that an IP equals a perpetrator.

If I were to say, brute force your WPA2 using my graphics card, you would have a harder time making your case than if your wifi was open and it could have been anyone.

I care more about protecting the innocent than persecuting criminals I guess.

That approach does not hold up in court, at least in the US. For instance, you have an open WIFI connection that someone uses to download child porn. You claim, but I didn't download the porn, somebody else did. That is true, you only distributed it, since it did flow to your device and then out again. Not a very smart strategy, if you ask me.

Have any sources at all for that or are you just theory-crafting?

Re:It's Basic Infrastructure

[hawkinspeter]

I've got a Virgin Media router (to the cable broadband) that I set up the open WIFI on, and a Buffalo WZR-HP-AG300H that I use for the WPA2 WIFI connecting to my home LAN.

To be honest, my setup is overkill as the Virgin Media router supports running a WPA2 and a guest network and the Buffalo DD-WRT router can also do the same thing. I like the extra range and throughput of the Buffalo router (it's the quickest consumer router I could find) and it also runs on 2 separate frequencies.

Re:It's Basic Infrastructure

[Anonymous Coward]

Um, wrong. WPA2 provides for CCMP (which is an AES derivitive), WPA uses RC4-TKIP and WEP uses RC4. The channel itself is encrypted as part of the authentication system. Now that being said, WEP and WPA are broken technologies and WPA2 should be used if you don't want the network cracked.

Re:It's Basic Infrastructure

[Garth Smith]

No thanks, if a guest wants to access my wifi he should ask for the password and take the extra 30 seconds needed to type it in.

How can you NOT be angry the government is forcing your guests to ask for your keys to use your datapipe by threatening you and your reputation with very serious criminal charges? This is happening all over the world and I am afraid our culture now accepts it without even thinking it's absurd!

I used to run my public WiFi with SSID "UseDontAbuse". I have since removed public access thus making the area around my home a little bit worse than it was before. I will express my anger here in the hopes that other people get angry as well and we collectively as a nation stop taking this crap!

Re:It's Basic Infrastructure

[Anonymous Coward]

Not sure why you got modded up. Having encrypted wifi does not keep your guests from using it. I just give my guests the key. I don't want my neighbor using my bandwidth. I don't want him tapping into my electricity or water, either.

Re:It's Basic Infrastructure

[fast turtle]

and if there's even the hint of CP being involved, you will be convicted by the newspaper and your neighbors with yours and your families lives possibly threatened. Sorry but it's a witch hunt out there and "We wont stop until sombody gets burned" (Petra - Witchhunt) and that's why you need to secure you wifi. If everyone had open wifi throughout the country, we'd all have a plausible defense but they've already won that battle because people are running scared and now that the ISP's will become Copyright cops in June of 2012, it's reached the point that what I'm paying for bandwidth is no longer worth while. In that case, I am already planning on dropping down to the absolute basic service level of 256/128. It's good enough for what I'll be able to do w/o pissing off the ISP and loosing my connection or having it throttled anyhow.

Re:It's Basic Infrastructure

[hawkinspeter]

I refuse to be scared by their implied threats. If they can get a warrant to search my house, then they can try to find whatever the warrant was issued for. Otherwise, they have no rights on my property and I won't bow down to them just to be a "good citizen".

Re:It's Basic Infrastructure

[Anonymous Coward]

The police work directly for the corporations

Re:It's Basic Infrastructure

[hawkinspeter]

I'm quite happy for random strangers to use my wifi - I've never seen any significant bandwidth being used for me to be concerned about it. I'm not convinced that restricting MAC addresses is worthwhile as I'd then have to explicitly allow people/guests/devices to use the open network and it's easy enough for MAC addresses to be spoofed anyway, so it's only pretend security.

If everyone did as I do, then there'd be less need for 3G data plans. Also, not every wifi device supports mobile broadband, so sometimes it's just convenient to be able to use an open wifi.

Re:It's Basic Infrastructure

[hawkinspeter]

I doubt that could ever happen as ISPs would fall foul of that law every time. An IP address does not identify a person - you'd need more evidence to convict than that. Have you got an example of someone being convicted without any evidence being found on their computer?

Re:It's Basic Infrastructure

[Belial6]

Why would someone go way out of their way to find your house just so they could make themselves conspicuous while they get their kiddie porn when they could park outside of a Starbucks or McDonald's and be less conspicuous? Sounds about as likely that they would splice into the phone lines on your house to make their drug deals while they are at it.

Fear that you are going to get arrested because of an open WiFi is pure paranoia.

Re:It's Basic Infrastructure

[Belial6]

That must be why every McDonald's, Starbucks, and all of the other businesses in town have been locked up after huge police raids.

Re:It's Basic Infrastructure

[hawkinspeter]

Just my curiosity, but why did you remove public access?

Re:It's Basic Infrastructure

[hawkinspeter]

Here in the UK AFAIK, they'd have to have a warrant to search for CP, so if they found a bong, they wouldn't be able to use it as evidence.

Re:It's Basic Infrastructure

[hawkinspeter]

Just apply some QOS so you're guaranteed to get as much bandwidth as you want and other people can use whatever's spare. You can't bank the unused bandwidth on unlimited connections, so you might as well let someone else use it if they want.

If people are happy to share the remaining bandwidth then I'm quite happy for them to drop their service. I've already paid for my agreed bandwidth, so I'm not cheating the ISP out of anything. If their business model relies on re-selling the bandwidth that I've already paid for, then that's their problem.

Re:It's Basic Infrastructure

[hawkinspeter]

Could you please provide an actual example where this has happened? I quite happily run an open WIFI and I think people are just fear-mongering when they say things like this.

Re:It's Basic Infrastructure

[Anonymous Coward]

I try to do a proper sentence as the password. Since most people would write it out that way, but when you are like the password is "I live on a dusty road." they type iliveonadustyroad . I don't understand where the disconnect is. Now I have to tell them it is written like a proper sentence before saying it. I guess they feel that having a real sentence isn't secrete agent enough.

Re:It's Basic Infrastructure

[Anonymous Coward]

Why do you need two routers? Segment a guest ssid.

I have 4 routers. One locked at N, one at G and the other is a B on the main network. The secondary part of the network is a router that is taking my wireless access and providing wired in another room. Each of these is secured with at least WPA protection if not WPA2 as well as MAC control.

Re:It's Basic Infrastructure

[toygeek]

This has actually happened multiple times. Neighbor looks at CP using your open wifi, FBI raids YOUR house and ousts YOUR family from your home.

http://arstechnica.com/tech-policy/news/2011/04/fbi-child-porn-raid-a-strong-argument-for-locking-down-wifi-networks.ars

http://www.thebostonchannel.com/news/28039374/detail.html

Re:It's Basic Infrastructure

[gknoy]

Would keeping logs of the MACs that connect to your open wifi help? (" ____ is not my laptop, nor my pc, nor my refrigerator, nor any of our phones.")

Re:It's Basic Infrastructure

[Anonymous Coward]

Don't be a complete jackass. Let me rephrase that so you can hear just how stupid you sound:

"I have a .357 and a Berreta 9mm. What's your home address?
Do you ever leave your house? Would you like me or another gun wielder to shoot at you every time you walk out the door?

Here's some advice for you ignorant folk who insist on leaving their house: Wear body armor..."

The part of all of this that you don't get is "civilized society", there is shit you simply DO NOT DO, even if you know how and can. No one should live in fear and perform the digital equivalen of putting on body armor just because there are jackasses in the world. There are not that many. So shut your mouth and quit acting like just because there's some keyboard jockeys that "can" that everyone's bushes are full of miscreants.

I'm so sick of fear mongering people like you. You're no better than a polician.

Re:It's Basic Infrastructure

[hypergreatthing]

There are things called load balances, QoS, bandwidth limits you can set.
Besides, you talk about comparing laundry detergent which is a measured resource compared to bandwidth. If you use 50% of your bandwidth, where does the other 50% go? To waste.

Re:It's Basic Infrastructure

[LazyBoot]

I would think it has more to do with the fact that for ages now space has not been something you could have in a password.

Re:It's Basic Infrastructure

[StikyPad]

I just wall off the open AP from the rest of my network and probe anyone who connects. My assumption is that if they're connecting to my network, they must want to share any and all of their accessible data with me.

Re:It's Basic Infrastructure

[borkie]

Most consumer wireless APs/routers have WPS (Wi-Fi protected setup) enabled, with no way of turning it off. The WPS mechanism has a weakness that makes wpa2-psk protection utterly useless. Google for "reaver wps", proceed to download, and crack all networks in your area within 24h, even the ones with 30+ char passphrases. The entire "security" of wpa2-psk is bypassed.

One solution is to run an open network, with IPsec combined with an authenticating gateway.

Re:It's Basic Infrastructure

[ae1294]

Restricting your network to specific MAC addresses would be a good protection, too. As for wanting WIFI when you are out and about, there are data plans for that.

MAC address filtering DOES NOTHING! Stop spreading this lie.

Re:It's Basic Infrastructure

[Richy_T]

I am happy for you that you have the legal budget of those companies.

Re:It's Basic Infrastructure

[Em Adespoton]

There's already software available to do this... you can often see such "hotspots" show up in coffee shops, etc.

Re:It's Basic Infrastructure

[webnut77]

"What's the password?"
"idontknow"
"Well then, how do you login?"
"I use the password."
"Alrighty, what's the password?"
"idontknow"
"Arrg, you just said you use the password to login."

Re:It's Basic Infrastructure

[PReDiToR]

First hit on DDG
http://www.techrepublic.com/blog/security/how-to-spoof-a-mac-address/39

Right clicking the network connection and calling up Properties, or even the Device Manager will let you change the MAC on Windows.

Easy as Pi.[sic]

Re:It's Basic Infrastructure

[Anonymous Coward]

Some facts
1. My stuff. I get to choose what to do with it. It does no PHYSICAL or MENTAL harm to anyone and it only effects my property so the cops can get bent.
2. I do not see the cops checking doorknobs or windows to see if those are locked or even secure. Same for car doors, outdoor faucets, picnic baskets and my wallet. Until they check everything the cops can, again, get bent.
3. It is not their business, literally, to see if my property is secure. If my property is not secure AND something is stolen then it is their business and I will alert them. Until then they can, once more, get bent.

Re:It's Basic Infrastructure

[Anonymous Coward]

WTF is a "download limit"?

Re:It's Basic Infrastructure

[Anonymous Coward]

Umm. I hope you've found an encrypted DNS that I don't know about.

Re:It's Basic Infrastructure

[hawkinspeter]

To be honest, I hadn't really considered DNS poisoning. With any luck, the SSL certificate will throw up a problem when the hostname doesn't match the certificate, so an attacker would have to compromise the certificate as well.

Re:It's Basic Infrastructure

[Dcnjoe60]

I doubt that could ever happen as ISPs would fall foul of that law every time. An IP address does not identify a person - you'd need more evidence to convict than that. Have you got an example of someone being convicted without any evidence being found on their computer?

An ISP is a company in the business of providing internet access. An individual opening up their router is not. An IP address does not identify a person, but it will identify your specific router. If illegal content has been detected going through your router's IP (say child porn), it will/can trigger an investigation, it happens all the time, but is dependent on your state's laws. It is never a good idea to rely on a defense that is based on ignorance as in not knowing what people were doing with the service you were providing them. Just ask MegaUpload.

Re:It's Basic Infrastructure

[Dcnjoe60]

As I have stated previously, there is a difference between a business providing this service and an individual doing the same. Just as there is a difference between a a casino running a black jack table and you doing so in your basement.

Re:It's Basic Infrastructure

[Dcnjoe60]

Chicago IL
Memphis TN
Columbia MO
and most major Universities

For one, most ISP contracts prohibited the practice on a consumer contract. Second, the courts in those locations have held that since the individuals are not business, but illegally sharing their connection (since the ISP contract explicitly disallows it), they are held as part of a) a conspiracy to defraud the ISP and b) liable in enabling protected content from being distributed.

In most states, it is also illegal to use somebody's WIFI without permission.

Re:It's Basic Infrastructure

[Anonymous Coward]

No.

Each device has a MAC address stored in its firmware. You can, however, set the MAC address to whatever you like. You can randomize it or even spoof the MAC address of someone else (in fact, this is done as one of the steps to cracking WEP/WPA). Each OS has utilities to do this and this is a standard, basic feature in virtual machine hosts.

Keeping a log of MAC addresses could only ever hurt your case by falsely identifying you. It could NEVER help you by ruling you out as a culprit.

Similarly, MAC address filtering is utterly pointless. It is easily circumvented and only makes your network less flexible.

Re:It's Basic Infrastructure

[Dcnjoe60]

While it is easy to spoof a MAC address, if the router only accepts connections from specific ones means somebody has to sit there with a sniffer to intercept the traffic to determine acceptable addresses. That is a crime in most states and is enough to protect you, assuming you also have WPA2 enabled, to show the authorities that you didn't willfully do something illegal. It doesn't keep somebody else from using it, it just helps cover your own butt.

Re:It's Basic Infrastructure

[Grishnakh]

Not only that, but they have to find an acceptable address that isn't in use at the moment. So if they use a sniffer, they'll find out which MAC addresses are connected right now, but if they clone one of those, it won't work because the system with that MAC address is still connected. They'd have to monitor your AP for some time to find a list of MAC addresses that are acceptable and then figure out which ones aren't always connected.

Re:It's Basic Infrastructure

[Grishnakh]

Then be prepared to put your life on hold for 6-12 months while they do their investigation, and you're not allowed to have a computer while they keep all your equipment. If you're like me and you telecommute, you can kiss your job goodbye.

Re:It's Basic Infrastructure

[Belial6]

No, it isn't. The casino can run a blackjack table because they are licensed to run blackjack tables. There are no retail businesses other than ISPs licensed to run WiFi.

Re:It's Basic Infrastructure

[themusicgod1]

To be fair, some of us probably use 99%+ of our bandwidth. wooo 5000ms ping time!

Re:It's Basic Infrastructure

[themusicgod1]

Thanks for the reminder to restart my tor exit node.

Know what's *also* not free? Monopoly rent & wireless data coverage within cities via centralized, heavily controlled & policed networks. 4G networks cost a shit ton, and local to me we're putting them up because, as a continent, we're more or less a bunch of greedy assholes who can't seem to learn to share our very good coverage of 802.11 networks within most cities properly.

Re:It's Basic Infrastructure

[gnapster]

He discontinued public access because the risk (of losing all his gear while waiting for a trial) finally outweighed the benefit of providing a public service, in his estimation.

We have a right to a speedy trial, but it would still be a mess to deal with and it seems like most people don't take advantage of it. I myself don't understand all the nuances of that right and when it would be to one's advantage to claim it.

Re:It's Basic Infrastructure

[kayditty]

If you're a guest in my home, you're welcome to use the bandwidth, along with the lights and water. Can you imagine visitig a friend only to be told, "Look, here's the PIN code to unlock the lights, and here's the key in case you want to wash your hands."

I can imagine it, yes, but only because I use a lot of drugs, and I've read Philip K. Dick, someone who also did a lot of drugs in his time.

Re:It's Basic Infrastructure

[kayditty]

it will work--it just won't work very well. it becomes a race condition in this case, which can be intelligently gamed.

Re:It's Basic Infrastructure

[Anonymous Coward]

Cops don't need warrants in Australia (they apply for it after the raids) only reasonable suspicion which gets twisted and used where ever they want.

Re:It's Basic Infrastructure

[Anonymous Coward]

Doing traffic shaping on incoming data is non-trivial to say the least

Re:It's Basic Infrastructure

[uninformedLuddite]

The number of people driving around your neighbourhood capable of doing this are very few. At least in Adelaide.

Re:It's Basic Infrastructure

[uninformedLuddite]

Spoken like someone who has never really experienced the joys of dealing with the police

Re:It's Basic Infrastructure

[uninformedLuddite]

so if they found a bong

That's an African musical instrument isn't it?

Re:It's Basic Infrastructure

[uninformedLuddite]

I tried the WiFi at a McDonalds here in AU a while ago. It took several minutes just to load the google home page fully. I can't see someone getting images or videos that way.

Re:It's Basic Infrastructure

[randyleepublic]

I think all these strategies are easily defeated: Wardriving child porn downloader ignores your low bandwidth open ap, acquires your secure ap signal, cracks your encryption, ids one of your mac addresses, and then, at a random later date, spoofs it for his bad stuff activities.

Re:It's Basic Infrastructure

[randyleepublic]

For values of "saves" that include ruined lives.

Accountability

[rwa2]

Plus, it's easier for them to book you for thought crimes they catch you committing via their IP taps. They'll have none of that "but my wifi is open -- it could have been anyone" defense. That won't work for you, sir, you'll be held accountable for whatever flows through your pipes!

Re:Accountability

[Aaron B Lingwood]

Including Simpsons porn

Re:Accountability

[houghi]

And good for them. They will also warn if you have left your car door unlocked and motor running. At that moment you should not claim that your car was stolen and used in a robbery. Well, you could, but would have a LOT of explaining to do.

OTOH the majority of people will have absolutely no clue that their Wifi is open and will be grateful that they were warned.

Re:Accountability

[Anonymous Coward]

In Queensland, your more likely to get a fine that a warning for leaving your car do unlocked and motor running, as that is a crime.

Re:Accountability

[georgeaperkins]

Gosh is that Simpsons thing a joke? Had to check the calender that its not 1st April yet. How ridiculous

Re:Accountability

[Aaron B Lingwood]

Gosh is that Simpsons thing a joke?

No joke. Photos of small-breasted woman, regardless of age, is also considered child-porn.

Re:Accountability

[dbIII]

That was another Conroy (Australian Communications Minister) brainfart that luckily never made it into law. Business as usual from the man that said there was a Lesbian Cabal plotting to halt the national broadband network. If it had made it into law as proposed a "jailbait" photo could have been of a merely topless woman over 40. Such a thing has no place in a nation where breastfeeding in public is still accepted and not a crime and would even be insane in a place still upset over an exposed nipple at the Superbowl.

Re:Accountability

[Aaron B Lingwood]

That was another Conroy (Australian Communications Minister) brainfart that luckily never made it into law.

/me breathes a sigh of relief

Re:Accountability

[Anonymous Coward]

It's a lot more likely that you're the one in your own car when the crime is committed than the scenario where the ip address points to the true criminal. I wish people would stop using awful analogies.

Re:Accountability

[NoMaster]

No joke. Photos of small-breasted woman, regardless of age, is also considered child-porn.

Bullshit.

As to the actual story, the police already wander around public car parks checking to see if you've secured your car, and leave a flyer under the wiper. If the car is secure they tick the "Congratulations!" box; if not, they tick a box describing why your car is insecure. A quick Google tells me that this is also fairly common in the Good Ol' US of A.

Don't see anybody complaining about that, though. Apparently, the police knowing that somebody within a street or two has an open WiFi AP is worse than them physically touching your property and potentially building a database of who habitually doesn't lock their cars...

Re:Accountability

[Dodgy G33za]

I bloody well would. I often leave my car unlocked. I don't pay my bloody taxes to have them give me a score out of ten for how paranoid I am.

If they did their bloody jobs properly no-one would need to lock their cars.

Re:Accountability

[drinkypoo]

If they did their bloody jobs properly no-one would need to lock their cars.

Uh no, it doesn't work that way. If your government does its job properly then no-one needs to lock their cars, and you hardly need cops. Nothing the cops do which follows policy will create or eliminate more criminals, except shooting them dead, and that sets a bad precedent if it becomes SOP.

Re:Accountability

[Anonymous Coward]

Uh no, it doesn't work that way. If your government does its job properly then no-one needs to lock their cars, and you hardly need cops.

Only if you're deluded.

Crime is part of the human condition, even in a mythical perfect communist state there would still be outliers who steal shit. That is just a foolish line of thought because it is foisting responsibility of protecting your property from casual small scale crime on to society just because you're too god damn lazy to lock your doors. The GP's offered social environment is basically a monoculture and, like crop monocultures, it is highly vulnerable to disease wiping out the lot — if you trust everyone by making no effort to protect your stuff then the first crook who comes along will make an absolute killing robbing everyone blind.

Government and society are nice in that they provide herd safety but it is still the responsibility of each individual within the herd to manage their personal interests themselves, you don't get to externalise (Remember that thing we really hate corporations for doing?) all your personal responsibilities onto everyone else. At least, not unless you're rich enough to afford to pay people to run around cleaning up your mistakes after you.

Re:Accountability

[cbope]

Wow, if this is indeed true that cops walk around checking for locked cars; what a spectacular way to waste police resources.

If you are stupid enough to leave your car unlocked in this day and age, you deserve to have your stuff stolen.

Re:Accountability

[Anonymous Coward]

  aside from how ridiculous that sounds, i leave my car unlocked because i dont want to replace a broken window in addition to whatever was stolen. the thief is still wrong, asshole.

Re:Accountability

[Capt.DrumkenBum]

Locking the doors of your car is a foolish waste of time.
If you lock the doors they break a window, and steal your stuff. If you don't lock the doors you tend to not leave anything in your car for them to steal, and your window doesn't get broken.
My car doesn't even have door locks. I would say 3 or 4 times a year I get back to me car after work and I can tell someone has gone through my car. (I park in a very high vehicle crime area.)
I do put the club on the steering wheel though, and have a hidden kill switch.
The funny thing is I get the same notice on my care about once a year and it never notes that my doors are unlocked. :)

Re:Accountability

[gnapster]

I have heard that in some jurisdictions, traffic tickets due to speed cameras are only binding if the registered owner was the one driving. If a camera catches me running a red light while driving my wife's car, the ticket is mailed to her, not me. She wasn't the one who committed the crime.

Google

[Aaron B Lingwood]

Doesn't google already have this data?

This looks like a money grab from this years' budget

The QPS is always complaining that they do not have enough funding to pay their staff. Now they are wasting precious manhours to mine data that they could easily purchase (or even receive for free) from Google.

wifi security

[Anonymous Coward]

If you don't have a secure WiFi then you may as well turn off the firewall on your network.

Re:wifi security

[Anonymous Coward]

Insecure WiFi != Insecure network.

At home I have two WiFi network over the same AP, one is open an the other use WPA2, they are in independent networks and with a firewall between both, plus the open is capped to use at max 2mbps.

Re:wifi security

[johnjones]

yes thats a very decent way to do things however in australia we have cap's so I would not want to give away my allowance...

living in other places I was unlimited and had no problem doing exactly what you do and giving away a portion of my bandwidth to those in need

maybe someone would help me out one day...

regards

John Jones

Finaly!

[V!NCENT]

Finaly an actual initiative to protect and serve the people! A little faith in government restored.

Ignoring the FUD about Identity theft

[Anonymous Coward]

It's too easy finding a strong (as in signal), open, public WIFI signal these days for there really be any incentive to run around "hacking" WEP or even dealing with weak and unreliable signal issues that one faces using an open connection inside a building.

Shit, if you want to commit fraud, take a clean machine to any McDonalds in the country and you can fraud away to your heart's content.

WEP and WPA are both worthless

[Anonymous Coward]

Use WPA2/AES with an uncommon SSID and a complex password, or GTFO.

Re:WEP and WPA are both worthless

[Anonymous Coward]

WPA hasn't been broken (except for trivial password-guessing attacks that apply to every encryption scheme which uses pre-shared keys). WPA2 requires AES support, so a lot of older devices which have been upgraded from WEP can't use WPA2 because they lack AES support. If you expect to have devices like that on your network, WPA+TKIP is fine.

I wonder what they will say

[Anonymous Coward]

NSW police may be interested in my wifi ssid "Police_Surveillance_Van_71A"

Re:I wonder what they will say

[lexsird]

I name mine "Warning: Virus Detected!"

Re:I wonder what they will say

[Anonymous Coward]

I saw an open AP the other day called "Testing Honeypot"... I thought that was quite clever :)

Haven't WPA/WPA2 been broken yet?

[Anonymous Coward]

I thought "WiFi encryption protocols are easily breakable" was the fifth law of thermodynamics or something.

Broken security

[NoobixCube]

Wifi security, including WPA and WPA2, is already broken. It's the equivalent of locking your house up with a six pin tumbler lock. It keeps the honest and the curious out, but it's nothing to someone who really wants in.

Re:Broken security

[gl4ss]

it's still illegal to break it.

unless, of course, it seems if you're a cop.

Re:Broken security

[SilentChasm]

As far as I know WPA/WPA2 isn't broken, only WPS's PIN mode (enter an easy 8 digit number instead of a complicated alphanumeric passphrase). Granted you can still bruteforce the PSK itself instead of the PIN but then you've just got the same problem of weak passwords that many other things do.

Re:Broken security

[thegarbz]

WPA and WPA2 isn't broken. There's only a configuration problem in WPS (a system designed to bypass having to enter a WPA key, who thought that was a good idea anyway?). Even that isn't broken as such. The effect is that the brute force attack has been simplified to the point where it is achievable to actually perform rather than having to brute force the entire array of usable keys. A simple configuration change that either fixes the problem or better yet limits the number of tries or the rate of tries for connecting using WPS would instantly make it secure again.

The irony? Older access points which support WPA and WPA2 but don't support WPS are quite secure.
The double irony? I have never had WPS actually work on my access point even when the PIN is known, so I'm amazed that this is a suitable attack vector in the first place.

Re:Broken security

[FireFury03]

it's still illegal to break it.

unless, of course, it seems if you're a cop.

The police aren't breaking anything, AFAICT they are just listening to the beacon from the access points and seeing if it is flagged as encrypted.

Re:Broken security

[virb67]

And no matter what kind of lock you place on your house's door a sledgehammer will probably knock it down pretty easily. So what's your point exactly?

Re:Broken security

[jamesh]

WPA and WPA2 isn't broken.

WPA w/TKIP isn't 'broken' in the strictest sense of the word, but is considered insecure enough that there is no good reason to use it if all your hardware supports WPA2.

http://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Security

Re:Broken security

[allo]

google got a lot of trouble for doing so. because its inevitable they capture some actual content of connections on insecure wlans.

Re:Broken security

[Anonymous Coward]

And some people just like to spread FUD. Put up or shut up.

Re:Broken security

[MtViewGuy]

If you use a password that is not breakable easily using a dictionary-based guessing system, it would take a LONG, LONG time to break the password for something like the 16 alphanumeric character long password I used on my Wi-Fi router.

Re:Broken security

[FireFury03]

google got a lot of trouble for doing so. because its inevitable they capture some actual content of connections on insecure wlans.

Google got into trouble for _storing_ that data, not capturing it.

(IMHO they shouldn't have got into trouble for any of it anyway, if you broadcast something into a public space you should have no expectation of it not being captured, stored, analysed, etc.)

Incidentally, why did the law enforcement authorities complain about Google storing data (which could have been analysed later, even though Google said they weren't going to do this), whilst shopping centres are starting to get away with capturing cellphone beacons and analysing them to build a picture of shopper movements? I'm much happier about Google capturing some random data that people have _chosen_ to transmit in the clear than someone capturing data that is mandated by international protocol standards to be transmitted in the clear.

Re:Broken security

[thegarbz]

Security is not an arbitrary line, security depends entirely on what threat you are trying to protect from. The attack you are talking about works against packets where the structure is mostly known. The link you posted presents one possible attack vector which causes packet redirection. This basically means that the attack is useless against any meaningful data (logins and passwords etc), and that if a packet redirection attack happens it essentially either causes your connection to drop unless the equipment used is very sophisticated.

Essentially WPA w/TKIP may let the CIA snoop on any password you're stupid enough to transmit in plaintext over IP. However in terms of "security" most normal people are not all that concerned about the CIA. Most normal people are concerned about people using metered WiFi for free, people stealing personally identifiable information, and jumping on your network and downloading all the stuff you put in the public folder without realising that any idiot with a laptop could take it over WiFi.

Yes WPA w/TKIP in my opinion is perfectly secure enough for the needs of most people. WEP for instance isn't because there's a single click attack vector which gets full access to the network, but unless there's some way to get full access to the network with WPA (i.e. WPS brute force bug on poorly implemented devices) it still provides security.

Re:Broken security

[jamesh]

I'm not sure if you are agreeing with me or disagreeing with me... there is still no good reason to use WPA+TKIP if all your devices support WPA2.

Re:Broken security

[allo]

the point is protecting people who do not know any better.

Of course, your worst-case analysis should consider: everything sent will be captured and stored forever and when its possible to decrypt it, then it will be analysed and used against you. When you assume this, no bad surprise will happen.

But another thing is, what the laws should look like. They should not assume the worst-case to be normal anyway, but forbid the bad parts. So the worst case CAN still happen, but it WON'T happen that often, because only people not caring about the legality of their actions will do it.

From the security point of view, you need still to consider the worst-case. But for people who do not know anything about security, their average case will be much better.

Re:Broken security

[thegarbz]

Both. On the one hand I agree WPA+TKIP is not secure, as in I wouldn't use it if I was protecting my network from government spies type secure.
On the other hand it's secure enough for most common uses, as in keeping script kiddies and general drive by thieves out.

Think of it as a bicycle lock. It's security for rest of us; won't do a thing to stop someone with a bolt cutter, but it'll stop the casual person grabbing the bicycle and making a run (ride) for it.

Or to put it in plain English, I wouldn't recommend someone going out and buying a router simply for WPA2 support if they had WPA+TKIP already. I on the other hand would tell someone it's time to upgrade if they are relying on ailing WEP for their encryption.

Re:Broken security

[FireFury03]

the point is protecting people who do not know any better.

The problem here is you basically achieve nothing, and at worst give people a false sense of security. Giving Google a hard time over storing data they realistically couldn't do a lot with* prevents no abuse (because they couldn't really have done much with that data anyway), meanwhile it does nothing to prevent people with bad motivation from logging and analysing the traffic.

So at best, nothing changed. At worst, some people decide they don't need to worry about encrypting their networks because the police will catch anyone naughty.

(*) Google captured wifi traffic from a vehicle moving at speed. As they drove past someone's network, they will have captured a few isolated fragments from the middle of a stream of data (assuming the network was actually being used at the time). It isn't like they were sitting outside someone's house for hours watching all their email traffic go by or something.

Re:Broken security

[allo]

i do not think you got the point.

the worst case stays the same: somebody who wants to do evil things captures as much as possible and does evil things with it. This is possible now and then.
But the average case differs. When its forbidden to capture anything, the people, who are not plain criminals, but just dataminers acting in the legal range, will be stopped.

So of course, the worst case isn't any different, and you should still be afraid and encrypt your wlan as good as possible. But the sum of all datamining will be less, because the legal acting people will behave differently. Which is at least a small advantage to the status quo.

Possible Abuse

[Aaron B Lingwood]

I find it odd that QPS Media has failed to supply the public with any technical information on what tools they are using and the scope of the exercise
Are they simply searching for wireless networks? Or going as far as trying default passwords?
Are they geocaching MAC Addresses and SSIDs that will be used in other investigations?
Are they sniffing traffic? Are they collecting any personally identifiable information?

While this is a nice service, I do think this does not fall under the purview of the state police
If this is simply a SIGINT operation in disguise, it is better left to the DSD or ASIO
If this is simply a community service, the state governement should use grants to coerce the industry to extend their voluntary code of practice so that ISP's are responsible for making their customers aware of the risks as part of the signup process.

Re:Possible Abuse

[AHuxley]

DSD/ASIO would be getting every packet in and out of Australia by default over any telco link.
If your chatting with Africa, Asia or the Middle East- your on a list shared with the UK, NSA ect..
As for sniffing traffic, they would do that as a drift net - all flagged p2p files, forums, chatrooms - going after the person and ip.
MAC Addresses and SSIDs that will be used in other investigations would really be long term with unmarked vans/cars.
It sounds like a simple tool that shows a pad lock or no padlock - just like any consumer device, but it cost Australian taxpayers a lot.
Some telco contractor did good with this deal :)

Re:Possible Abuse

[FireFury03]

While this is a nice service, I do think this does not fall under the purview of the state police

Why not? The police are in the business of crime prevention as well as catching criminals.

Breaking into someone's house and stealing their stuff is a crime. If you do it, the police will (hopefully) come after you and lock you up. The police also have programmes whereby they will tour the neighbourhoods and if they spot some bit of bad security they will knock on the door and tell you about it so you can fix it *before* someone takes advantage of it.

Breaking into someone's network is a crime*. If you do it, the police will (hopefully) come after you and lock you up. In this case, the police are also running a programme whereby they will tour the neighbourhoods and if they spot some bit of bad security they will knock on the door and tell you about it so you can fix it *before* someone takes advantage of it.

What's the difference?

(* cracking someone's security, even if it's lowly WEP, is a crime and should be punished - if someone is running any kind of encryption then it is clear that they don't want to let you into the network. On the other hand, I very much believe that it should _not_ be a crime to use an open network, because there is no reasonable way to know that it wasn't intended to be an open hotspot. I would, however, expect these police to tell you "did you know your network is open, here's how to lock it down" to help people who may have left it open by accident. Getting helpful information from the police does *not* mean you can't ignore it if you actually want to run an open network though).

If this is simply a community service, the state governement should use grants to coerce the industry to extend their voluntary code of practice so that ISP's are responsible for making their customers aware of the risks as part of the signup process.

What kind of "voluntary code of practice" are you talking about? Its true in the past that access points shipped with encryption turned off, but that hasn't been the case for years. So these days the people with open APs are generally either still running old hardware, or are intentionally running them open. I can't see what "code of practice" is going to help with either of these situations.

Re:Possible Abuse

[Aaron B Lingwood]

While this is a nice service, I do think this does not fall under the purview of the state police

Why not?

The Commonwealth Criminal Code completely covers all aspects of unauthorised access. Computer crime has always been a federal crime. The federal police have the experience and resources to deal with this. In the past, I had reported (read: attempted to report but was refused) several minor computer crimes that involved my network or my workplaces. Usually theft of services/data. The state police had ZERO understanding. I realise that QPS have, for almost a decade, really focused on strengthening their tech ability and understanding. I just remain sceptical or perhaps it is just scorn.

What kind of "voluntary code of practice" are you talking about?

I am of the opinion that the majority of ISP subscribers buy their hardware from the ISP and sometimes this is the only option. Many ISP's also charge a setup fee which often also covers support and configuration. Such a code of practice could ensure that this configuration/support covers such things as education and assistance with securing WiFi.

these days the people with open APs are generally either still running old hardware, or are intentionally running them open.

With the role out of the NBN, most Queenslanders will be up for new hardware well before every street in the state has been audited. Implementing this code in time would mean that EVERY NBN subscriber would be at least aware of the security issues and I can see this approach possibly saving ISP's money.

Re:Possible Abuse

[drsmithy]

On the other hand, I very much believe that it should _not_ be a crime to use an open network, because there is no reasonable way to know that it wasn't intended to be an open hotspot.

By your logic, it's reasonable to assume anyone without a fence and locked door is inviting me in for dinner.

Re:Possible Abuse

[FireFury03]

On the other hand, I very much believe that it should _not_ be a crime to use an open network, because there is no reasonable way to know that it wasn't intended to be an open hotspot.

By your logic, it's reasonable to assume anyone without a fence and locked door is inviting me in for dinner.

No. Public areas (parks, etc) are usually clearly marked as such - it is pretty easy to tell the deifference between a park and someone's unfenced garden.

On the other hand, wifi has a flag in the protocol explicitly to tell you if it is public or private and there is no other sensible way to tell this. Unfortunately, access points that are accidentally left open will also be broadcasting an "I am a public hotspot" flag, even though the owner didn't intend to do this.

As an example, if you go for a coffee in "Bob's café" and you find an open access point called "bobs_wifi", are you to assume that this is intended to be used by the customers of the café, or should you assume that Bob lives above the café and this is his personal wifi that has been set up incorrectly? (And yes, it's pretty common for cafés to provide free wifi in the form of an open access point and not even bother to advertise the fact).

Another example: I have accidentally used someone's personal wifi in the past - it was an open access point that was broadcasting a pretty generic SSID (something like "BTOpenSpace"). BT provide internet connections to homes and businesses (with associated wifi kit), but they also provide public hotspots under a variety of names (BTOpenZone, BTFon and a few others). Without a good knowledge of all the hotspot providers and ISPs, it is impossible to know which ones are private and which are public without trusting that the ones that advertise themselves as public really are (as it turns out, the BTOpenSpace one was someone's home ADSL, but I didn't realise this until afterwards).

Also, anything that automatically looks for public wifi hotspots can *only* trust what the access point is advertising itself to be - since no human is reviewing its decisions, there are no judgement calls. My SIP handset will auto-associate with any public network if it can't find my private one - it isn't going to ask me every time it needs to change network, so even if your network has the SSID of "private_keep_out", it'll still happilly use that network if your AP is advertising itself as a public hotspot.

So sorry, since legitimate public hotspots are very common and there is no way to tell them apart from incorrectly configured private access points, I can't see how it can be considered a crime for someone to use a private hotspot that is advertising itself as being public. This isn't like an obvious private garden not having fences, it's more like an unfenced garden with a bloody great sign outside it saying "please come in".

Re:Possible Abuse

[stephanruby]

I find it odd that QPS Media has failed to supply the public with any technical information on what tools they are using and the scope of the exercise

Also, why are they limiting themselves to wifi only? Unsecured trash cans, unsecured cable boxes, and cheap mailboxes can be another way for people to steal your data. And in bad neighborhoods, unsecured backyards, unsecured windows, and easy to break doors, are a boon for criminals. If they're going to have someone driving around inspecting security issues, they might has well give that person multiple things to look for -- to save on gas.

Re:Possible Abuse

[Lumpy]

You have a fine here for having breakable glass windows. This encourages crime.

Re:Possible Abuse

[Anonymous Coward]

The internet is quite different. The internet is made to be used by people all over the world. How are you supposed to know whose wifi is deliberately open and whose isn't? There is just no reasonable way to tell. With a house, you can knock or ask for permission.

Your analogy is awful.

Re:Possible Abuse

[Aaron B Lingwood]

Also, why are they limiting themselves to wifi only? Unsecured trash cans, unsecured cable boxes, and cheap mailboxes can be another way for people to steal your data.

This is one of the reasons I suspect this may be a SIGINT operation by the state police so they don't have to keep giving up jurisdiction or credit to the feds.

Re:Possible Abuse

[drsmithy]

Public areas (parks, etc) are usually clearly marked as such - it is pretty easy to tell the deifference between a park and someone's unfenced garden.

It's pretty east to tell which wifi hotspots are setup for "public use" as well - assuming you're being honest with yourself.

As an example, if you go for a coffee in "Bob's café" and you find an open access point called "bobs_wifi", are you to assume that this is intended to be used by the customers of the café, or should you assume that Bob lives above the café and this is his personal wifi that has been set up incorrectly? (And yes, it's pretty common for cafés to provide free wifi in the form of an open access point and not even bother to advertise the fact).

It would be _reasonable_ to assume it's only meant for customers. Just like it's _reasonable_ to assume those newspapers and magazines lying around are for customers and not random passers-by.

Another example: I have accidentally used someone's personal wifi in the past - it was an open access point that was broadcasting a pretty generic SSID (something like "BTOpenSpace"). BT provide internet connections to homes and businesses (with associated wifi kit), but they also provide public hotspots under a variety of names (BTOpenZone, BTFon and a few others). Without a good knowledge of all the hotspot providers and ISPs, it is impossible to know which ones are private and which are public without trusting that the ones that advertise themselves as public really are (as it turns out, the BTOpenSpace one was someone's home ADSL, but I didn't realise this until afterwards).

I've never seen an ISP-provided wifi kit that didn't uniquely identify itself somehow. Usually with a MAC address, or something other random-but-unique number in the SSID.

*Real* public hotspots, on the other hand nearly always have a completely generic name, often with "free" or "open" in it.

Like I said, it's rarely hard to tell the difference if you're being honest with yourself.

So sorry, since legitimate public hotspots are very common and there is no way to tell them apart from incorrectly configured private access points, I can't see how it can be considered a crime for someone to use a private hotspot that is advertising itself as being public.

Whoa there, champ. I didn't say it should be a crime, I applied your logic to the physical world.

This isn't like an obvious private garden not having fences, it's more like an unfenced garden with a bloody great sign outside it saying "please come in".

No, it's not. The lack of a "please stay out" sign is not the same as a "please come in" sign. Refer back to my original post.

Re:Possible Abuse

[drsmithy]

The internet is quite different. The internet is made to be used by people all over the world.

The internet ? I thought we were talking about wifi access points ?

How are you supposed to know whose wifi is deliberately open and whose isn't?

You make a reasonable assumption. If you're being honest with yourself, it's rarely difficult to tell whether or not someone has setup their wifi point for open access.

Re:Possible Abuse

[FireFury03]

As an example, if you go for a coffee in "Bob's café" and you find an open access point called "bobs_wifi", are you to assume that this is intended to be used by the customers of the café, or should you assume that Bob lives above the café and this is his personal wifi that has been set up incorrectly? (And yes, it's pretty common for cafés to provide free wifi in the form of an open access point and not even bother to advertise the fact).

It would be _reasonable_ to assume it's only meant for customers. Just like it's _reasonable_ to assume those newspapers and magazines lying around are for customers and not random passers-by.

Did you read what I wrote or did you just read the first few words and make the rest up? I never said anything about non-customers, the choices I offered were:
1. it is intended to be used by customers of Bob's Caf'e
2. it is Bob's personal wifi network that has been accidentally left open and no one except Bob himself should be using it

I've never seen an ISP-provided wifi kit that didn't uniquely identify itself somehow. Usually with a MAC address, or something other random-but-unique number in the SSID.

And yet I have. It is less common now, but it certainly used to happen a lot. Also, access points with the manufacturer's name and no uniqueness are still pretty common (Linksys, Netgear, etc.) It may be obvious to someone familiar with all the different manufacturers of kit that these are the default names, but the law should not require people to be that knowledgable about the market. Wifi broadcasts a flag *specifically* to tell you if it is public or private, if people set that flag to public when they mean private I don't think the general public should be expected to have a vast amount of knowledge of a changing market place in order to judge whether the owner set it up wrong or not.

Also, if you are one of the people who leaves their home router's SSID set to "Linksys", your computer _will_ automatically associate with any other open network called "Linksys" and there's no sensible technological way to stop this from happening.

Remember: we're not necessarilly talking about techies with a good indepth knowledge of the technologies and marketplace. If a laptop has a "public wifi" icon next to a wifi network with a fairly generic name then it is reasonable for the _general public_ to believe this to be a public wifi hotspot. A law to protect unknowledgable people who can't configure their routers correctly automatically criminalises unknowledgable people who can't make a judgement based on fairly extensive knowledge of an ever-changing market.

Re:Possible Abuse

[Anonymous Coward]

What's the difference?

I don't agree that the police should waste their time knocking on people's doors and telling them their security isn't good enough, either. Stop assuming that I do.

I hate these "But if you disagree with X, then why does Y do Z, which is similar to X?" arguments that people come up with. Stop assuming that I agree with Z just because it happens.

Re:Possible Abuse

[gnapster]

Wifi broadcasts a flag *specifically* to tell you if it is public or private, if people set that flag to public when they mean private I don't think the general public should be expected to have a vast amount of knowledge of a changing market place in order to judge whether the owner set it up wrong or not.

What is this flag, and how is it configured? I have often wondered if such a thing exists, but I can't see how to change it on my current router (DD-WRT, as it happens) and I wouldn't know how to tell my WiFi client to respect such a flag (or not).

Re:Possible Abuse

[FireFury03]

Wifi broadcasts a flag *specifically* to tell you if it is public or private, if people set that flag to public when they mean private I don't think the general public should be expected to have a vast amount of knowledge of a changing market place in order to judge whether the owner set it up wrong or not.

What is this flag, and how is it configured? I have often wondered if such a thing exists, but I can't see how to change it on my current router (DD-WRT, as it happens) and I wouldn't know how to tell my WiFi client to respect such a flag (or not).

The wifi AP broadcasts a flag to say whether the network is encrypted (and hence private) or open (therefore public).

what's next

[Anonymous Coward]

police going around to everyone's door trying to open it?

Re:what's next

[Aaron B Lingwood]

police going around to everyone's door trying to open it?

Some police beats in shopping centres check parked cars and leave a nice little letter with a nice big fine if they find one unlocked.

Re:what's next

[Anonymous Coward]

and why is it illegal to leave your car unlocked ? Maybe I want to dispose of it, a wrecker wont accept it, cant afford to dump it, and no, its not insured so I wont try to claim insurance.

Re:what's next

[Aryden]

Then you're littering.

Re:what's next

[Anonymous Coward]

hahaha They NEVER leave a Fine on a car for being unlocked. Stop stirring shit dude. They just leave a notice saying its unsecure etc etc.

Re:what's next

[Aaron B Lingwood]

and why is it illegal to leave your car unlocked ?

It is illegal as it encourages opportunistic crime resulting in more paperwork for the old bill.
It is quite difficult to type up reports when your fingers are all sticky from doughnut icing.

Re:what's next

[Aaron B Lingwood]

They NEVER leave a Fine on a car for being unlocked.

Never Say Never

Re:what's next

[blackest_k]

That law is ridiculous, i've had several locked cars broken into and the damage due to breaking in has always cost more than anything stolen. Generally the only thing of value is a couple of euro and the radio which although it has bluetooth, mp3 cd cost 56 euro a new door or window costs a lot more to fix than replacing the radio.

The engine immobiliser still works you need a proper coded key for the ignition to work, you might still steal the car but the door locks are not going to be much of a barrier honestly.

Sure sometimes i might be carrying something of value when it makes the cost of repairing the car less than the cost of the stolen goods but then i would lock it.

however in practical terms the cost of a break in is my insurance excess (500 euro) + the loss of noclaims discount which is around 75% a loss of (750 euro).

A friend of mine had his lorry fuel tank syphoned in a locked patrolled yard no less, the police said he should have a locking cap on the tank. well that is all well and good until you realise the tank would still have been broke into and the tank damaged in the process and his lorry would have been off the road making him unable to meet his contracts. While annoying and expensive to lose fuel that way the alternative could cost him a lot more maybe even his business.

  Security is a trade off and it makes no sense to ensure the cost of flimsy security measures costs more than the things stolen in the first place.

Re:what's next

[Anonymous Coward]

Any crime is the fault of the criminal. Your actions may have made the crime easier, but you did not participate in the crime. Your car is your property. Leave it unlocked if you want to. Disregard anyone who tells you otherwise.

Re:what's next

[Aaron B Lingwood]

I once purchased a new Jeep Wrangler softtop.

Being a new car, I was being very careful ensuring that the car was always locked and parked under a streetlight at night.
Didn't help. Had the window panels slashed on 2 occasions in the first month of ownership. Once for some pocket change, and another for a work uniform.
Replacement panels are $1,200 a pop. I resorted to ALWAYS leaving the car unlocked to prevent this kind of vandalism. Never had a problem again.
Over the next 2 years, I only received a single $40 fine for leaving the vehicle unlocked. Argued the ticket and it was retracted.

Re:what's next

[Ash-Fox]

I think you shouldn't spread that information while logged in. I was able to acquire your home address with relative ease.

Re:what's next

[Anonymous Coward]

It's a trap.

Re:what's next

[Anonymous Coward]

Locking car doors is like vaccination. You need everyone doing it to develop a sort of herd immunity that stops thieves from just opening every car door they see. Otherwise you have no protection when you are carrying something expensive in your car.

Re:what's next

[Anonymous Coward]

Availability is absolutely part of secuirty. That may seem odd, but think of a denial of service attack and most people will agree its one aspect. Examples like the parent's which mentions not using a locking gas cap because loosing the gas it bad, but having a damaged truck unable to make deliveries is worse are spot on that security should always be a bsuiness decision about the risk and alternatives.

I'm actually in a CISSP prep class and one of the things we discussed the first week was security is really a triad of Confidentiality, Integrity, and Availability.

Re:what's next

[Anonymous Coward]

Over the next 2 years, I only received a single $40 fine for leaving the vehicle unlocked. Argued the ticket and it was retracted.

Would you have received the same ticket had you not had the doors and/or top attached? As long as people drive convertibles, there is no justification for fining unlocked doors.

australian Accountability

[johnjones]

thats exactly it !

realistically hacking a wpa setup by a person with no experience is pretty unsecured
(do you really want to know how many people have password1 or changeme...)

have a look at this:

http://open.youyuxi.com/

australia is censored beyond what I certainly expected...

regards

John Jones

Safe wi-fi spot

[hcs_$reboot]

If anyone has a secure wi-fi spot, will the "I did not download that file, someone did by accessing my wi-fi" excuse remain valid?

Re:Safe wi-fi spot

[gnasher719]

If anyone has a secure wi-fi spot, will the "I did not download that file, someone did by accessing my wi-fi" excuse remain valid?

If your WiFi is secured, then you don't need the defense because nobody will use your WiFi to download files.

Re:Safe wi-fi spot

[Aryden]

If your WiFi is secured, then you don't need the defense because only those who really want to will use your WiFi to download files.

FTFY

Re:Safe wi-fi spot

[Aaron B Lingwood]

If anyone has a secure wi-fi spot, will the "I did not download that file, someone did by accessing my wi-fi" excuse remain valid?

If your WiFi is secured, then you don't need the defense because nobody will use your WiFi to download files.

If your WiFi is secured and someone, through luck or through skill, manages to identify with your AP and use your connection for nefarious deeds, you no longer have that defence. I always keep an open but isolated, bandwidth-limited channel. I use a secure channel for myself and my guests.

Re:Safe wi-fi spot

[Anonymous Coward]

and will hold up in a court of law ? I guess if it is bandwidth limited, and actually routes to the net, then I guess so. I its just a powered on wifi with no LAN connection then I guess maybe not. interesting idea though. What if its call 'McDonald Open WiFi'. Will that work assuming there if a McDonald's around the corner ? Or is is MAC based ? Which then I ask, Is there a 'machanger' equivalent for modems ? and what about the TOR network ?

Re:Safe wi-fi spot

[hawkinspeter]

Not if they find evidence on your computer that you downloaded it.

Money must grow on trees in Queensland

[anarkhos]

to pay for this crap

Re:Money must grow on trees in Queensland

[Anonymous Coward]

No, but it is just underground, waiting to be dug up.

Re:Money must grow on trees in Queensland

[Anonymous Coward]

Or maybe there's just no crime and the cops are bored? Unsecured wifi doesn't seem to me like a police matter. If the local council were doing this, then maybe it could make some sense, but even then I wonder if it would really be worth it.

This seems like a very strange thing to do, which presumably is in response to some rather stranger request for something else entirely. What caused the police to think this was worth their time is what would worry me a lot more than actually having it done.

Re:Money must grow on trees in Queensland

[Anonymous Coward]

It's the stupid mining boom.

Re:Money must grow on trees in Queensland

[Anonymous Coward]

Money in Queensland grows on million-year-old dead trees. We dig up and sell a hell of a lot of coal for export.

Re:Money must grow on trees in Queensland

[Anonymous Coward]

No we just give the crooked cops whatever they ask for, because we are all so worried about the children.

A crackdown on plausible deniability!

[Anonymous Coward]

This is NOT to protect citizens!

This is to make it easier to link people to activities on the Internet.

I think it is now illegal to have open Wifi in some places! Hello, police state!

Why bother?

[Datamonstar]

I mean, it's a fine and commendable effort & all, but it's just bound to go WOOOOSH!!! to most citizens anyway. In fact, that goes for many of the cops too, I'd bet. Just leaving a letter talking about a screen door isn't really going to cut it for people who just expect to plug in a device and have it work perfectly automagically.

I understand WEP is bad but ...

[Anonymous Coward]

I understand WEP is trivial to crack but I have too many devices that only have WEP connectivity.
Have no money to upgrade and in many case no new devices exist that would replace the old ones.
To me, my WEP setup means to anyone else "locked door" and nothing else, the fact that the door is flimsy does not detract from the fact it is a locked door.
my SSID is NOENTRY

Re:I understand WEP is bad but ...

[jamesh]

I had a WEP SSID for my daughters Nintendo DS, but had it locked down to the point that a hacker without a DS wouldn't be able to do much with it.

Re:I understand WEP is bad but ...

[Anonymous Coward]

To a bored script-kiddie, NOENTRY sounds like an access point potentially worth breaking into. At the very least, I posit that a script-kiddie would think that it sounds like a challenge. The more boring-sounding your SSID is, [I assume] the less likely you are to be targeted.

Re:I understand WEP is bad but ...

[Richy_T]

Yep. I'm upset with Nintendo about this. Even though the 3DS can do WPA, some of the games still only do WEP so we have an old access point that only gets plugged in when required. Really need to lock it all down sometime.

WOTAM

[Anonymous Coward]

Wait of time and money.

I broadcast about 120 open AP's

[Lumpy]

All of them named Linksys, Dlink, Wireless, etc... and all to a single router that is connected to nothing at all.

It significantly reduces the volume of idiot neighbors that do not configure their new wireless as many times they will connect to me instead.

Works great, when I shut it off, I see no more default router names.

It also screws with the wardrivers, I look at some of the maps every few months and see my location with a giant pile of AP names around my building.

Re:I broadcast about 120 open AP's

[Anonymous Coward]

While you're at it, why don't you broadcast at max power on every single channel except 3. Then simply use channel three for your own router. Sure it's an asshole thing to do.. but while you're being an asshole, you might as well go all the way.

Re:I broadcast about 120 open AP's

[Richy_T]

That's a terrible idea. The channels overlap somewhat.

Re: broken is apparently a matter of opinion?

[Anonymous Coward]

Your link says (of WPA-TKIP):

The flaw does not lead to key recovery, but only a keystream that encrypted a particular packet, and which can be reused as many as seven times to inject arbitrary data of the same packet length to a wireless client. For example, this allows someone to inject faked ARP packets which make the victim send packets to the open Internet. This attack was further optimized by two Japanese computer scientists Toshihiro Ohigashi and Masakatu Morii.[16] Their attack doesn't require Quality of Service to be enabled. In October 2009, Halvorsen with others made further progress, enabling attackers to inject larger malicious packets (596 bytes, to be more specific) within approximately 18 minutes and 25 seconds.[17].

Emphasis mine. If you use WPA-TKIP, an attacker can make you start sending him all your packets in less than 20 minutes. And if you use QoS, you're even more fucked, because (again, according to your link):

In February 2010, a new attack was found by Martin Beck that allows an attacker to decrypt all traffic towards the client. The authors say that the attack can be defeated by deactivating QoS, or by switching from TKIP to AES-based CCMP.[18]

So in conclusion: attacker gets all your outbound traffic in 20 minutes (and gets all your inbound traffic too if you use QoS). But somehow that's not "broken?"
Either you've just got your head in the sand, or you're a black hat trying to convince potential marks to keep using WPA-TPIK.

Ugh

[Anonymous Coward]

So are they going to force me to lock my door too?

Re: broken is apparently a matter of opinion?

[jamesh]

So in conclusion: attacker gets all your outbound traffic in 20 minutes (and gets all your inbound traffic too if you use QoS). But somehow that's not "broken?"
Either you've just got your head in the sand, or you're a black hat trying to convince potential marks to keep using WPA-TPIK.

I did say use WPA2 if you have it available, but the threat isn't as significant as you make out. Anything serious (eg passwords) would be secured by SSL or TLS, so what are you going to sniff? You certainly can't get hold of anything that you couldn't just as easily get hold of via intercepting the cable/dsl/fibre. A guy with a high visibility vest and a clipboard fiddling around in your comms pit is much less noticeable than someone parked in your street with a laptop for 20 minutes.

And the threat TFA is talking about closing requires that your wireless security would be broken enough to allow an outsider to use it. No currently known WPA exploits allow this.

So it's broken, but not completely broken, and certainly not broken in the context of TFA.

Unfortunately

[Anonymous Coward]

Unfortunately, hot spots are the only means by which people can get on the Internet anonymously. To many readers, I'm sure you look at it as stealing bandwidth, and your right, it is. However, the population has come under attack from more and more tyranical governments, and it's the only way to combat them. You have to break a few eggs in order to make an omlett.

Do what I did

[fast turtle]

and buy a router with the a guest network capability. One device that offers dual AP - protected full speed for the home - un/protected guest ap that's restricted to 1/10 network bandwidth and isolated from the lan. Cost was $45 at Walmart

Fucking Police

[Anonymous Coward]

You motherfuckers need to be Wardriving for the BANKSTERS YOU PIECES OF SHIT.

More dangerous than you think!

[Sentrion]

You Slashdotters just don't get it. If these wifi connections are left unprotected it will be the end of the world as we know it. Communists will start abusing these connections to access the internet WITHOUT PAYING FOR IT! Consider the long term ramifications! The dismantling of the international banking system! Dogs and cats, living together! Mass hysteria!

Aaron B Lingwood, explain yourself, PLEASE.

[Anonymous Coward]

Merely 15 years ago I was doing the exact same thing and have been, on umpteen occasions, questioned, detained, given a 'move on' notice or just generally harassed.

Wi-Fi did not exist in 1997. It existed about ten years ago. Wardriving didn't become particularly popular until around 2002-2003. I went out all the time and was never questioned.
 
Maybe that guilty look on your face got you second looks? Cops WILL hassle you if you appear to be doing something wrong and are looking around all the time.
 
--Martin Espinoza

Re:Aaron B Lingwood, explain yourself, PLEASE.

[Aaron B Lingwood]

Wi-Fi did not exist in 1997. It existed about ten years ago.

I probably shouldn't have rounded up. It was actually in 1999 the first time I went 'wardriving'.
WiFi was also not called WiFi yet and WiFi was not available for laptops (but were being advertised).
I was a radio enthusiast and had often searched for other wireless networks.
I did work experience for a tech mag who had just reviewed a lot of 802.11 devices, I was allowed to keep them
My wardriving consisted of a few old nix desktop PC's on an inverter in the back of my mates van
No home users had wireless networks yet. But many businesses did - especially those in the Auto industry

Wardriving didn't become particularly popular until around 2002-2003.

I agree. By the time I first read about wardriving, I had gotten bored and stopped.
In 2004, another mate of mine caught the bug. We went out, this time with a laptop on an inverter with NetStumbler on Windows
WEP had become fairly standard and I had decided against alerting people of their unsecured networks because of the type of negative attention it brought me in the past

I went out all the time and was never questioned. Maybe that guilty look on your face got you second looks? Cops WILL hassle you if you appear to be doing something wrong and are looking around all the time.

I think part of the reason why I got a lot of attention is because I was usually parked (with van running) in front of Auto dealers, Marine dealers and Computer shops in the wee hours of the morning, and back before WiFi and Wardriving were words. I didn't mind the police asking questions, I just wished they had listened to the answers.

The *proper* solution...

[IGnatius T Foobar]

The *proper* solution is to *accept* that some folks have open wifi, are ok with sharing their bandwidth, and therefore a consumer IP address is *not* to be admitted as evidence of a "crime" that has been committed using the public Internet.

Pure Paranoia

[Belial6]

Clearly that is not how it works. If it was, every McDonald's, Starbucks, and half the other retail stores out there would not be offering free unencrypted WiFi. Fear that some criminal is going to drive around town looking for your open WiFi so that they can commit a crime is complete paranoia. There are open WiFi hotspots everywhere that wouldn't draw attention if a stranger was sitting in their car using it. They are even put on maps, and advertised by the businesses offering the open WiFi.

Re:Pure Paranoia

[Dcnjoe60]

Clearly that is not how it works. If it was, every McDonald's, Starbucks, and half the other retail stores out there would not be offering free unencrypted WiFi. Fear that some criminal is going to drive around town looking for your open WiFi so that they can commit a crime is complete paranoia. There are open WiFi hotspots everywhere that wouldn't draw attention if a stranger was sitting in their car using it. They are even put on maps, and advertised by the businesses offering the open WiFi.

There is a difference between a business or municipality doing this and an individual. Since there have been individuals who have tried that defense and have lost (at least in the US), it does indeed work that way. Of course, each state has different laws. In some, merely being in possession of child porn can get you arrested in others you have to distribute it. Do you really want to chance it in your location? If so, go for it.

Re:Pure Paranoia

[Belial6]

If you are unwilling to chance it, you better build that dome completely encapsulating your home, because someone might throw an envelope stuffed with kiddie porn over your fence. You haven't done that? Do you really want to chance it in your location? If so, go for it.

This is all to protect the children!

[Anonymous Coward]

Seriously! Think of the children... actually DON'T think of the children, you perv.

As long as you have unlimited ability to tax.

[Anonymous Coward]

You can foot the bill for any silly thing cant you.

think of the upside

[ozduo]

More police driving around looking for naughty free Wi-Fi means less police driving around looking for drunk drivers. Tip buy shares in auto repairers and funeral homes.

Protection from whom?

[minstrelmike]

Protection from whom? What is the risk to my personal data or my personal laptop if my WiFi _connection_ is open (assuming I've changed the default admin pwd on the router itself). Seems to me the cops have identified a solution before they actually defined a problem. same old same old