Slashdot Mirror
MIT Demos Wi-Fi That's So High-Tech It Doesn't Need a Password (mic.com)
An anonymous reader shares an article on MIC: Researchers at the Massachusetts Institute of Technology want to change how we connect to Wi-Fi. To avoid the cumbersome network login process, a team has come up with a way to grant computers access to a Wi-Fi network based on their proximity to a router. Applied practically, that means you could walk into a cafe and your device would automatically connect to a network -- no annoying password necessary. The same could be true for a home network. When your friends come over, they could immediately be granted access to your Wi-Fi. The paper (PDF), sadly, doesn't offer details on the security aspect. Security researchers advise that one should be careful when connecting to a public Wi-Fi. Say you forget to turn off Wi-Fi on your device, and you walk into a cafe. Your phone will automatically establish a connection with this supposed network. If the network is compromised, plenty of devices will be exposed to attack.
It's like every open access point ever. Range-limited authentication. Great work MIT. Patent that shit.
Because who wants a network to be secure these days? Secure networks sound like encryption, and we all know who uses encryption. Terrorists.
Applied practically, that means you could walk into a cafe and your device would automatically connect to a network -- no annoying password necessary
Why would a cafe need a password? Are those leeching in front of the cafe to get WiFi without buying anything a real problem? And if it is, aren't they smart enough to walk in to get the password and walk out again without buying anything?
Relying on latency is a great idea. It'll always work in crowded spectrum environments, yessiree.
Connecting to a "secure" wi-fi based on proximity is probably not the best idea for most situations. Most Wi-fi that is open to the public doesn't use a password anyways making the "difficulty" of connecting to it moot, and in situations where you do want security it creates a major vulnerability (all someone has to do is get close enough to the router). Sounds like a "solution" looking for a problem that doesn't really exist.
What could possibly go wrong? Okay, this is the Aprils Fools joke article. Right? Right. Even MIT isn't that stupid.
I thought maybe this was a way to establish a WPA-secure connection without user input, based off proximity.
No, this is open access authentication based off location. Yawn. Set you AP to "low power" and centralize it in the building, then remove all authentication.
If they had figured out a way to initiate a key exchange based on proximity, then I'd possibly be impressed. Maybe with the password being exchanged with human inaudible sound and triggered by proximity.
Learning HOW to think is more important than learning WHAT to think.
Date on TFA is 3/31 so I am assuming this is not a joke.
I just don't like the idea of my device connecting to any hotspot that it may come close enough to.
I am already annoyed that my MAC address is being harvested if I happen to forget to turn off the wifi before I leave the house.
If my device automatically connects to a hotspot who knows what kind of MITM mischief could happen if some background app's protocol is vulnerable when it phones home for whatever.
My eyes reflect the stars and a smile lights up my face.
2016 and they're still confusing and conflating authentication/authorisation with encryption? Despite all we know about intelligence agency slurping?
There is -no- reason at all that a hotspot couldn't generate a unique key for every single connected client, that would prevent snooping. If they're pushing for a new protocol at least fix this oversight of WiFi first.
That's brilliant! Thank God I live in a sphere!
What is this, Chewbacca security?
TFA: "It works with 97% accuracy"
So hackers only have to try about 30 places on average to get in.
Table-ized A.I.
https://tools.ietf.org/html/rf...
Best part is that this enhancement will run of peanuts and popcorn. Worst part is a potential denial of service mentioned by Tom Lehrer.
https://en.wikipedia.org/wiki/...
What they are suggesting is everyone making their wifi open, the "FREE" ones already are except they have an annoying login page or "accept the terms" page you must go through first, but your phone has already joined the network because it knows it.
If my friends come over, they can blimmin well login to the free xfinitywifi thats enabled on my home router.
This kind of application desperately needs to include hotspot software that does a VPN over SSL or TLS (https security layer, relying on PKI). An ideal platform for doing this would be for email providers to add VPN for internet access alongside the SSL/TLS links they already operate for IMAP/POP3/SMTP, as it provides for some level of user authentication and traceability. There's also existing standalone VPN hotspots, but incorporating VPN into email would help make VPN ubiquitous.
I call it "open network"
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
I'm guessing this is an April Fool's story, because even if the signal is encrypted, there's no authentication factor to it, all you have to do is get in range. Furthermore, range boosters become a serious weakness; slip a tiny one in a corner or something, and BOOM! Instant security breach. I will say though, this was a pretty good one - not nearly so obvious as previous years.
"Set a man a fire, he'll be warm for the rest of the night. Set a man afire, he'll be warm for the rest of his life."
They basically came up with a way to do location triangulation on a single consumer-grade (MIMO) access point using the multiple antennas.
This is one of the two reasons I have my phone set to disable WiFi as soon as I leave my house. I don't have to worry about my phone trying to connect to every open AP it comes across.
The other reason I auto-disable WiFi is to minimize store tracking which seeks to ID me when I enter their building.
Defending IP by destroying access to it? That makes sense, RIAA/MPAA. Go to the corner until you can play nice!
Just a sec, let me set up a repeater -- you know like how you can just signal boost those fancy cars signals so that their keys respond to the ping from far away and the vehicle unlocks itself? Yeah, same thing, but with routers.
Don't know if this is an April Fools article or not, but with Net Neutrality no mobile carrier is allowed to restrict tethering on any mobile device nor charge a fee for it, so I don't see why anyone actually needs public wifi anymore.
Well written summary, technical information, subtle humour.
How sad is it when the April fools day post is better than 99% of the other posts that appear here.
This does nothing for in-band security. Basically anyone in the same cafe or router range could sniff and hack you as much as with passwords. The main thing it does is Geofence the WiFi router. So you must be in a given physical proximity to get into the router at all - even being in the street outside would be blocked. However emissions still occur so you could still promiscuously intercept any WiFi connected device. You just can't perform a man-in-the-middle or other crack without being inside the GeoFence.