With WPA3, Wi-Fi Security is About To Get a Lot Tougher (zdnet.com)

One of the biggest potential security vulnerabilities -- public Wi-Fi -- may soon get its fix. From a report: The Wi-Fi Alliance, an industry body made up of device makers including Apple, Microsoft, and Qualcomm, announced Monday its next-generation wireless network security standard, WPA3. The standard will replace WPA2, a near-two decades-old security protocol that's built in to protect almost every wireless device today -- including phones, laptops, and the Internet of Things.

One of the key improvements in WPA3 will aim to solve a common security problem: open Wi-Fi networks. Seen in coffee shops and airports, open Wi-Fi networks are convenient but unencrypted, allowing anyone on the same network to intercept data sent from other devices. WPA3 employs individualized data encryption, which scramble the connection between each device on the network and the router, ensuring secrets are kept safe and sites that you visit haven't been manipulated. Further reading: WPA3 WiFi Standard Announced After Researchers KRACKed WPA2 Three Months Ago

Comments

Freudian slip, anyone?

[davecb]

I'd hope security would get better, but maybe it does just get tougher (;-))

--dave
[English, ambiguity is your middle name]

Better, but not best.

[MachineShedFred]

Yes, this will prevent open-air sniffing of your packets.

VPN or HTTPS is still better, because after those packets arrive at the access point, they are unencrypted over whatever wire the AP is plugged into. WPA only covers the wireless link; HTTPS or VPN (or both!) encrypt much farther through the network, if not the whole way.

The first thing I do on an open WiFi network is connect to a VPN.

Re:Better, but not best.

[Hal_Porter]

It doesn't hurt to have multiple redundant levels of security. I.e. HTTPS over VPN over WPA3.

Re:Better, but not best.

[Anubis IV]

While all of that is good, nothing beats a wired Ethernet connection. That's why I always connect via Ethernet to wireless routers I bring with me that I've configured to act as bridges for the public WiFi hotspots I visit. I get the low latency and security of a wired connection while also gaining the benefits of wireless. It's the best of both worlds.

Note that I said "routers", plural. For maximum convenience, I've purchased separate wireless routers for each public hotspot I visit, that way I don't have to waste any time reconfiguring them each time I visit a different hotspot. I just pull out the appropriate one, plug it into my UPS, and away I go with simple but secure Internet surfing. And adding VPN to the mix is as easy as using Ethernet to connect a VPN-serving router to the bridge-mode router, then using a cellular hotspot to connect to the VPN. You still get all the benefits of both a wired connection and VPN while being able to enjoy Internet access anywhere you can find a public hotspot. As a nice bonus, you only ever need one VPN-serving router and one cellular hotspot in total, rather than one device per hotspot as was the case with my bridge-mode routers, so it saves on costs.

Some might try to suggest that even with those savings it still costs more than it's worth, but I don't think you can put a price on the level of convenience, security, and speed that I enjoy thanks to this setup.

Eh?

[ledow]

"One of the key improvements in WPA3 will aim to solve a common security problem: open Wi-Fi networks. Seen in coffee shops and airports, open Wi-Fi networks are convenient but unencrypted, allowing anyone on the same network to intercept data sent from other devices. WPA3 employs individualized data encryption, which scramble the connection between each device on the network and the router, ensuring secrets are kept safe and sites that you visit haven't been manipulated"

Sure. But your computer will still not know that the CoffeeShop SSID that they're connecting to was the one the shop set up, though, will they? There's no exclusivity for SSIDs and if there was, it'd be a denial-of-service opportunity.

Once connected, and a secret shared, yes. But with no password the initial connection is still giving people a chance to shove you on THEIR connection rather than the one you think, and then you can be WPA3-authenticated to them rather than what you thought without having a clue.

Re:Eh?

[VeryFluffyBunny]

But your computer will still not know that the CoffeeShop SSID that they're connecting to was the one the shop set up, though, will they?

Yes, this. Public Wifi needs something like unique domain names with signed certificates from an independent authority so that people know what they're connecting to and can be warned if it's insecure and therefore unsafe.