Slashdot Mirror
MIT Demos Wi-Fi That's So High-Tech It Doesn't Need a Password (mic.com)
An anonymous reader shares an article on MIC: Researchers at the Massachusetts Institute of Technology want to change how we connect to Wi-Fi. To avoid the cumbersome network login process, a team has come up with a way to grant computers access to a Wi-Fi network based on their proximity to a router. Applied practically, that means you could walk into a cafe and your device would automatically connect to a network -- no annoying password necessary. The same could be true for a home network. When your friends come over, they could immediately be granted access to your Wi-Fi. The paper (PDF), sadly, doesn't offer details on the security aspect. Security researchers advise that one should be careful when connecting to a public Wi-Fi. Say you forget to turn off Wi-Fi on your device, and you walk into a cafe. Your phone will automatically establish a connection with this supposed network. If the network is compromised, plenty of devices will be exposed to attack.
It's like every open access point ever. Range-limited authentication. Great work MIT. Patent that shit.
Applied practically, that means you could walk into a cafe and your device would automatically connect to a network -- no annoying password necessary
Why would a cafe need a password? Are those leeching in front of the cafe to get WiFi without buying anything a real problem? And if it is, aren't they smart enough to walk in to get the password and walk out again without buying anything?
What could possibly go wrong? Okay, this is the Aprils Fools joke article. Right? Right. Even MIT isn't that stupid.
I thought maybe this was a way to establish a WPA-secure connection without user input, based off proximity.
No, this is open access authentication based off location. Yawn. Set you AP to "low power" and centralize it in the building, then remove all authentication.
If they had figured out a way to initiate a key exchange based on proximity, then I'd possibly be impressed. Maybe with the password being exchanged with human inaudible sound and triggered by proximity.
Learning HOW to think is more important than learning WHAT to think.
Date on TFA is 3/31 so I am assuming this is not a joke.
I just don't like the idea of my device connecting to any hotspot that it may come close enough to.
I am already annoyed that my MAC address is being harvested if I happen to forget to turn off the wifi before I leave the house.
If my device automatically connects to a hotspot who knows what kind of MITM mischief could happen if some background app's protocol is vulnerable when it phones home for whatever.
My eyes reflect the stars and a smile lights up my face.
That's brilliant! Thank God I live in a sphere!
Open wifi does not use encryption. It's surprising that no standard has developed for this, but when you connect to an open wifi network, you are subject to possibly having your traffic sniffed.
Yes, you should be using secure protocols whenever possible (HTTPS), but it's an entire layer of security missing.
TFA: "It works with 97% accuracy"
So hackers only have to try about 30 places on average to get in.
Table-ized A.I.
This kind of application desperately needs to include hotspot software that does a VPN over SSL or TLS (https security layer, relying on PKI). An ideal platform for doing this would be for email providers to add VPN for internet access alongside the SSL/TLS links they already operate for IMAP/POP3/SMTP, as it provides for some level of user authentication and traceability. There's also existing standalone VPN hotspots, but incorporating VPN into email would help make VPN ubiquitous.
open wifi could use encryption, it's merely a matter of key exchanges. Typically this is done by connecting to the open, unsecure, AP first and pull down the certificate for the encrypted network, then you either get redirected to that network, or manually connect.
I call it "open network"
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
I'm guessing this is an April Fool's story, because even if the signal is encrypted, there's no authentication factor to it, all you have to do is get in range. Furthermore, range boosters become a serious weakness; slip a tiny one in a corner or something, and BOOM! Instant security breach. I will say though, this was a pretty good one - not nearly so obvious as previous years.
"Set a man a fire, he'll be warm for the rest of the night. Set a man afire, he'll be warm for the rest of his life."
I've heard that the terrorists are using an encryption method called "plain text."
True but you really aren't any better off using public wifi with a publicly posted key as long as someone else still has that same key they can still see your traffic.
So yes I suppose it could keep people that have never been inside your business and are unable to google "business name wifi password" from using your wifi.
Sure windows won't complain that its unsecured. But it's wrong.
Lets say you have a box that takes a password to open.
Then you write the password on the lid of the box.
Wouldn't it have been easier just to not put the lock on it in the first place?
Minimum threshold fixed. Thanks!
Would be nice.
Device isolation and each device given its own encryption key for the router.
Should have been done years ago.
Minimum threshold fixed. Thanks!
If the wifi range is 2 meters, the baseball bat security works quite well.
This is one of the two reasons I have my phone set to disable WiFi as soon as I leave my house. I don't have to worry about my phone trying to connect to every open AP it comes across.
The other reason I auto-disable WiFi is to minimize store tracking which seeks to ID me when I enter their building.
Defending IP by destroying access to it? That makes sense, RIAA/MPAA. Go to the corner until you can play nice!
Each device on a WPA2 network has their own private keys with the AP and use that for passing data.
https://en.wikipedia.org/wiki/...
So you actually have to capture the handshake to have any real chance of capturing the data. Which isn't to say it's not possible, but it is not as simple as having the password.
Don't know if this is an April Fools article or not, but with Net Neutrality no mobile carrier is allowed to restrict tethering on any mobile device nor charge a fee for it, so I don't see why anyone actually needs public wifi anymore.
As I understand it, WPA wouldn't allow clients to decode other clients' packets, even if they know the key for initially connecting. Thus, you could just designate a password (even "password") for open networks to give people encryption yet still be open. In the meantime, you could just name your network PASSWORD_IS_xyz.
I used to tell people that:
"I have Chewy Chewbaccason's Disease. I grow hair out of weird places all over my body and when I talk it comes out roowwrrrooowwrraaaa."
Yes, yes I did drink a lot back then.
"So long and thanks for all the fish."
Your right its not quite that easy but it is still pretty simple.
From 2014 http://www.howtogeek.com/20433...
Wireshark had the capability to do it back then. If you want to prevent it the only option still considered secure against it is wpa2 enterprise which actually does give each device its own key.
Minimum threshold fixed. Thanks!
Open wifi does not use encryption. It's surprising that no standard has developed for this, but when you connect to an open wifi network, you are subject to possibly having your traffic sniffed.
Yes, you should be using secure protocols whenever possible (HTTPS), but it's an entire layer of security missing.
When you use secure WiFi with AES-CCM encryption using keys established with RSA, the AP conveniently decrypts your wireless traffic and passes it onto the internet in plaintext form. 802.11 security is necessary for controlling access, but not sufficient for privacy.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Would be nice.
Device isolation and each device given its own encryption key for the router.
Should have been done years ago.
You mean like the EAP+4 way handshake that was put in the spec years ago providing pairwise keys for every STA-AP pair?
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
No, it's not sufficient for privacy. Did you read my second sentence? I already addressed that.
It doesn't just control access, it encrypts all traffic in a way that's at least slightly more than trivial (i.e. you have to also sniff the handshake) to crack. If you must use HTTP, it's far more likely to be intercepted on a LAN rather than on the WAN, NSA excepted.
Yes your right 802.11x can actually do that.
Not sure if you can set it up without requiring login tho.
Now that just leaves me wondering why I've never seen one setup in the wild.
Might be a good project for this weekend.
Minimum threshold fixed. Thanks!
You can. It's just a royal pain in the arse setting up RADIUS servers and configuring EAP methods and settings certs or whatever other credential is required by the EAP method,
This is morass of complexity in security systems that in order to be secure need to be as simple as possible.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.