Slashdot Mirror
Nebraska Sheriff Wardriving, Sending Letters About Unsecured Wi-Fi
An anonymous reader sends this quote from JournalStar.com:
"The Lancaster County Sheriff’s Office has seen an increase in scammers using unsecured Wi-Fi connections to steal identities and mask their crimes during the past six months, Sheriff Terry Wagner said. ... So deputies spent the past few weeks finding unsecure connections and sending 40 to 50 letters to let people know about the potential dangers of strangers accessing their network connections. 'You're just opening yourself up for a series of potential pitfalls,' Chief Deputy Jeff Bliemeister said. ... Bliemeister said only businesses like coffee shops that offer Internet connections to customers need unsecured Internet connections.
Applause!
Much better than that goofball sheriff in Aridzona.
A feeling of having made the same mistake before: Deja Foobar
In a dense area you might pick up 15 different access points, 2-3 of them open. Unless they have sophisticated RF locating equipment the letters are just going to be out based on a best guess scenario.
The only place I can see this working is suburbs with wide spacing between homes, or rural areas.
Um, firesheep works in that scenario.
You're confusing L2 security with transport security for http traffic, very different things
2 deputies with directional antennas.
If you can find warships that way, you can find wifi hotspots.
You've never been to Nebraska, have you? Google says the population of Lincoln is about 260,000 total. There are apartment complexes in Los Angeles with nearly that many people. Houses have yards, there aren't many multi-story buildings (especially residential). The only "sophisticated RF locating equipment" is the number of bars on the signal idicator in the system tray in Windows, which will vary visible from one house to the next.
Other Law Enforcement please take note. Follow this model for other crime prevention and imporve your community.
Thank You
Taxpayers
For every benefit you receive a tax is levied. - Ralph Waldo Emerson
We tried this where I work. You would think it would be easy. Just set a key and put a notice up with the key on it. Forget it. It was way beyond the ability of most of our visitors to input a simple key, just a simple pass phrase. After a week of people complaining, the boss decided we should go back to fully open guest wireless access.
In some places you are legally responsible for what people do with your internet connection.
set BSSID to: the password is McDonald's
If it is legal and not unreasonably dangerous for a business to use an open wifi connection, then why can't I?
You can. This sheriff isn't arresting people for having hotspots, he's simply mailing them FUD.
Free Martian Whores!
I don't see anything in the article that said it was illegal to have open wifi, or that you couldn't.
It said that open wifi was being used for identity theft, and that notices of potential dangers (I'd imagine such as possible repercussions for the wifi owner if fraud is traced back to their internet connection) were sent out.
For a couple of older folks or just generally non-technical people who potentially just plugged in an unsecured D-link, not a terrible thing to be given information about, and somewhat pro-active of the Sheriff. It seems little different from the notices given to people who leave their cars unlocked in neighbourhoods experiencing an increase of car thefts...
Here you go: http://journalstar.com/news/local/crime-and-courts/sheriff-looks-to-lock-down-open-internet-connections/article_3a98d107-05c6-5a11-8d09-8769e6e7dacd.html
An enigma, wrapped in a riddle, shrouded in bacon and cheese
In a dense area...
We're talking about Nebraska here.
The only 'danger' you expose yourself to by keeping an open wifi is that a moronic lawyer claims it must have been you and decides to sue you for things you didn't do.
Or if a moronic judge issues a search warrant for your home.
Give me Classic Slashdot or give me death!
There are some very dense areas in Nebraska. Some of them are even well populated.
They are not mandating you close your wifi, they are just suggesting you do. Making you aware of something you were unsure of maybe. Very much the same as if they were to wring your door bell to tell you your garage door is open at midnight, etc.
I thought that using a PSK still allowed people to decrypt your packets, as long as they knew the PSK and were able to capture the beginning of your session. So while having a PSK is slightly better than not having one, it doesn't really guarantee a secure connection.
Does anyone make an easy-to-use 802.1x appliance for coffee shop type uses?
Just wait till they type in as the password "the password is McDonald's", allow hilarity to ensue.
A loop, by its nature, continues. If that didn't make sense, start reading this sentence again.
It's not strictly FUD. For people who leave an AP open because they don't know better, this is a good service. For people who leave a WAP open because of some kind of principled and conscentious decsion, there's nothing there they're not already familiar with and willing to risk.
And let's face it. There is risk. If some random bad actor uses your unsecured WAP for random badness, it will inconvenience you. You will be a "person of interest" until they find a better suspect. Again, this might be a risk worth taking if you decide it is, but for a clueless schlub who just bought the router and plugged it in? Not so much.
Welcome to the Panopticon. Used to be a prison, now it's your home.
If it is legal and not unreasonably dangerous for a business to use an open wifi connection, then why can't I? If I get incorporated, does that make it safe?
No, but there's a general presumption that it's intentional when a business does it and that they understand the risks and decided to accept them. There's a (well justified) presumption that when a random house has an open AP called "Linksys" it's an accidental result of cluelessness. The sheriff isn't shutting peoples' netowrks down or threatening them with any sort of law enforcement action, they're just informing people that it's a security risk.
The only 'danger' you expose yourself to by keeping an open wifi is that a moronic lawyer claims it must have been you and decides to sue you for things you didn't do. The proper response to that is to counter sue the lawyer and to educate the public, judges and jury that an IP address does not prove identity. I have the right to keep an open WIFI connection and if someone else uses it for bad purposes that does NOT expose me to any reasonable danger or risk. People have the right to anonymity and that means government and lawyers do not have the right to intimidate people into making anonymity harder to obtain.
If you want to play lawyer for yourself without being one, consulting with one, or actually studying the law, you're welcome to do so. But the legal system is no place for the blindfold-and-shotgun approach.
1: Lawyers sue people on behalf of clients, not on their own. It's some other party (like a copyright holder, perhaps) that would be suing you. They are the party initiating the action, and it's up to them to decide whether to spend their hard earned money on the expensive process of suing you for something that may or may not be stupid. Their attorney may or may not be a moron or a dick, but it always takes a moronic/dick client to generate a moronic/dick lawsuit.
2: Countersuing the other party's lawyer is a good way to rapidly generate a large judgment for the other lawyer's fees, which you will have to pay if you initiate such a misguided action.
3: You may be contractually liable for other peoples' use of your open network in some circumstances. If the terms of service for your ISP so state, and the cause of action arises in a way that those terms are relevant, you could find yourself in a bad position. And while IP addresses are not proof of identity, they are evidence, and it would put you in a compromised defensive position to have your IP associated with "bad stuff".
4: The implied right of anonymous speech within the 1st Amendment is not relevant to any issues at play here. There's a misinterpretation of something going on if that seems important in this context.
I am a geek attorney, but not your geek attorney unless you've already retained me. This is not legal advice.
The only place I can see this working is suburbs with wide spacing between homes, or rural areas.
Or Nebraska.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
Do you have evidence that the Sheriff's wardriving captured and stored packet information? Because the furor over Google doing it was precisely that: indiscriminate and promiscuous capture and storage of any packets in transit in any AP's footprint that they passed through. And then Google kept that information, even after being ordered to delete it.
Tell me that a law-enforcement agency is sniffing and recording packet traffic and trolling for evidence of lawbreaking without formal suspicion or a wiretap court order, and I'll be appropriately angry at the privacy violation. Until then, there's no meaningful equivalence.
Welcome to the Panopticon. Used to be a prison, now it's your home.
There is 1 city in that county, and it ain't exactly NYC.
Well, there's only 1/5th of one city in New York County. :o)
Thank you, Edward Snowden.
"Arguments from authority are worthless." —Carl Sagan
Wifi encryption is useless if anyone and everyone can join the network. Once you join, it's just like being on any other shared medium network. All your packets are available in the clear. If you're worried about security, use application level encryption.
Give me Classic Slashdot or give me death!
As a Nebraskan... yes.
I'm regularly shocked by perceptions people from the larger cities, or from the coasts have. Yes, by land area, Nebraska is mostly rural, but it does have cities that typically have malls, movie theaters, and at least 10 square miles of urban/suburban space.
Lancaster County, in particular, averages 311 people/sq mi, and has Lincoln in the center, which even has some buildings with more than one story. Evidence: http://en.wikipedia.org/wiki/File:Lincoln_DT.jpg
It's not. People blew that way out of proportion. Transmissions on public spectrum can be recieved by anyone. People need to deal with it.
Give me Classic Slashdot or give me death!
On the key is known, then anyone can use it and it might as well be open. Even the individual key is not going to stop snooping.
You obviously don't understand anything about wireless security. If a connection is open (no encryption), anyone (even those not connected to the router) can stniff EVERYTHING sent over the connection (barring https and the like). With a password, even if every person in the world knows the password, nobody can sniff anyone else's packets. The passwords intiates a transaction where the router and your computer set up their own sessions keys which are used to encrypt everything else. so even though everyone used the same password, everyone is using different encryption keys, so everyone is protected (at the wireless level at least).
It's so easy to bust down your door, run into your house, and grab your big-screen TV, so why don't you just leave your door unlocked so I can walk right in?
Also, since it's so easy to smash your car's windows, hotwire it, and drive away, why don't you just leave your car unlocked and set your keys in the cupholder?
In my area DSL isn't available and FIOS or broadband is upward of $70. This affects me and many others who have difficulty with such prices. The act of intimidating people with open APs is ludicrous and shit-brained. A secured router with a unique user-ID, strong password, along with various options such as filters, availability-configurations, etc., is more secure than WEP with default settings. This sheriff should have a router fastened to his head until the microwaves loosen the rocks. I think the EFF elaborated on this topic quite well, also mentioning Schneier and his views on the subject.
Sharing, especially of educational/informational resources is a good thing. Intimidating people into doing otherwise against their will is encouraging greed, inefficiency and paranoia.
Forward! -- Emperor Norton, 2012
A federal grand jury wouldn't return an indictment.
WPA2 isn't at all easy to crack, but it's definitely easy to spoof MAC addresses.
You're a temporary arrangement of matter sliding towards oblivion in a cold, uncaring universe
For someone up to no good, I'm not sure that securing WiFi is smart move.
If someone has an open wifi, and something illegal (copyrighted content, kiddie porn, etc.) is downloaded via his IP, the person has plausible deniability that he himself did the downloading.
If that persons has secured his WiFi with a password, then I would think he's more likely to get convicted.
If the SSID is broadcasting, "Smith" and the name on the mailbox is "Smith", you can probably take a guess about it.
I think if you're a residential broadband customer, and your access point is wide open, the SSID is gonna be "Linksys" or other default name.
I am not a crackpot.
I just left AZ a bit over a year ago and lived in Maricopa County. Joe Arpaio started his b.s. first, but even before that he and his office were a menace to the Latino populace of the county. Don't get me wrong, there ARE illegals there, no one will ever dispute that claim, however he's been less than truthful when he repeatedly states that they're responsible for all the crime there. Take a look at the mugshots his office posts daily, plenty of black and white faces to go along with the brown ones he singles out.
Fifty watts per channel, baby cakes.
I had the same thing happen in my home county. Our jail was under federal oversight for over 13 years due to constant escapes, inmate injury, and general code violations. We had a sheriff who hired a known thug deputy to be an assistant warden. The man hired numerous thugs for guards, and gave a good old boy system "wink, wink" to the guards who "beat the inmates who needed it."
This entire reign of terror ended after an inmate was beaten to death while in the restraint chair. The video showed the man get slammed into the chair, strapped in, pepper sprayed, and hooded with the spit hood. Then each inmate proceeded to either punch/kick, strike with a baton, or use a tazer on the poor victim. The coroner determined what happened and the federal justice department filed criminal charges against a bunch of "officers." I believe 18 of them either resigned, plead guilty, or plea bargained to lesser charges. Only one or two were convicted of the worst charges, and they happened to be the ringleaders. The only lack of justice is that the assistant warden was never charged, he did end up resigning and no longer works in law enforcement. This entire debacle cost the sitting sheriff his seat in the next election.
The man who took his place almost immediately increased the pay for guards, increased hiring standards, and began the process of fixing all of the code violations that had been ignored for years. The county commission thought he was "spending too much money" and fought him non stop. Apparently they don't think anything of having the justice department look over your shoulder for years. I only hope that the sheriff gets re-elected and can continue to fix the problems in the county. I do not want the county to look like "Sheriff Joe" and his "tent city."
Should anyone want to read what happened, the events in question were from Harrison County Mississippi, during February 2006. The sheriffs name was George Payne. I do know it is against the rules to read the article/story/research/etc. but it is an interesting read.