6 ms·

I think there should be a law that would disallow passwords for public wifi. passwords are soooo annoying (is that a 1, l, or I?) & if everyone had open wifi,

I think there should be a law that would disallow passwords for public wifi. passwords are soooo annoying (is that a 1, l, or I?) & if everyone had open wifi, then it could be utilized much more, lowering everyone's wireless carrier usage. also, you wouldn't need to worry about someone using too much bandwidth -- it would happen, but i doubt more frequently than with the passwords. Well, wifi could be throttled if it were really a problem.

pjc50 10y ago
If it's got a password, it's not really public wifi. Isn't it usually complementary wifi for patrons of a particular business?
- jackvalentine 10y ago
  I think he might be referring to "public" but not public wifi, like coffee shops etc. I've long thought that if your business is using public unlicensed spectrum then you should be required to let the public in. A very large national phone carrier in my country is blanketing the cities with wifi reserved for their customers - using a public resource and clogging up the unlicensed spectrum for private gain. They've already bought a lot of spectrum licenses, but clearly using public spectrum is a cost-effective way to add capacity.
  - codecamper 10y ago
    Ugh.. and it is so hard to actually get on those wifi networks -- at least as a traveller. They'll give it free to mobile customers, who never bother to use it. Yes, I was referring to cafe / resto wifi. If one opens it, then people take advantage, but if everyone opens theirs, then nobody bothers. Only some really cheapskate neighbors who most probably don't consume all that much of it anyways. everybody has a smartphone now, most don't bother asking for the wifi password. If you ask for it, then often the next problem is the router doesn't work because nobody has used it in so long.
    - jjawssd 10y ago
      https://en.wikipedia.org/wiki/Tragedy_of_the_commons https://en.wikipedia.org/wiki/Tragedy_of_the_commons
  - mseebach 10y ago
    Large scale public wifi generally doesn't have passwords, that clearly doesn't scale, they have fancy enterprise auth things or captive portals. Shared password only works for small places like coffee shops. Anecdotes: 1: on London Underground, my phone authenticates using the SIM somehow (it still shows a captive portal screen, just with an ad, yay). 2: in the Turkish lounge in Istanbul airport, the shared password was clearly a marketing channel, InvestInTK2016 or some such. It struck me as pretty clever. > if your business is using public unlicensed spectrum then you should be required to let the public in "Unlicensed" isn't really "unlicensed", as much as specifically licensed for anyone to do with as they please. But to take your idea just one step further, once you've opened up all wifi for the general publics consumption (what a renaissance for wired networking!), would people using it be allowed to use it for private gain? Why is it wrong to use unlicensed spectrum for private gain, but not to use a service provided over the same spectrum for private gain? Also, as a business, under this doctrine, are you allowed to enable wifi access to a closed non-internet LAN, with only locked-down non-public servers on it?
    - jackvalentine 10y ago
      > But to take your idea just one step further, once you've opened up all wifi for the general publics consumption (what a renaissance for wired networking!) I think this requires clarification - I don't mean no business should ever use wifi. I mean businesses like telephone companies shouldn't be using to augment their networks. Obviously offices and the like need secure wireless networking that normal hardware can connect to. > Why is it wrong to use unlicensed spectrum for private gain Maybe with my above correction this isn't needed, but in cities the 2.4ghz channel is loaded to death and in a few years the 5ghz channel will be the same. All I'm objecting to are these closed commercial networks from people who should be paying for the spectrum bunging up the open one the rest of us use. My city is soaked with a wifi network that is closed to everyone except the customers of a telco. If your primary business is providing network connectivity, perhaps you should pay for the finite resource you use.
      - mseebach 10y ago
        So you're speaking of a specific problem in a specific place - this is kind of hard to know when it was phrased as a general principle. Also, it's hard to discuss the issue when there are no details about the specific issue available. But two points: First, where I am, 2.4Ghz is perfectly swamped with normal residential access points. It seems unlikely that this telco in your city did much more than move up the point where the spectrum is swamped, rather than causing it directly (also, if their use is affecting everyone else, they themselves are affected, too, rendering their investment pretty pointless, which leads me to wonder just how bad the situation actually is). Second, if you do want to regulate, in a rule-of-law-compatible way, well, it's going to be hard to distinguish a Starbucks access point operated for the benefit of customers of Starbucks from a telco access point operated for the benefit of customers of that telco. (If you want to use spectrum ownership as the metric, consider that many telcos cover both spectrum-owning mobile and commercial and residential broadband (ie wifi-providing) subsidiaries). To further muddy the waters, the telco is very likely to be selling access to their wifi network to non-subscribers.
- mseebach 10y ago
  Public doesn't mean free to everybody, it means available to everybody. A public house (as opposed to a private club), aka a pub, is not a place you can hang out whenever, they have hours (they are not "public" at night) and you're supposed to buy stuff when you're in there. There's nothing about password protected wifi that makes it inherently non-public.
  - Spivak 10y ago
    I think he means when certain Telcoms blanket entire cities with Wi-Fi in the unlicensed spectrum which at scale makes everyone else's connection worse. I have no problem with blanketing cities with internet access but I think commercial wireless should have their own frequency -- which would actually be good for them since they would be mostly alone in the space and could get a frequency which is better suited to large scale coverage.
    - dogma1138 10y ago
      I live in London which has allot of telco wifi everywhere and I haven't seen any adverse impact on my signal. Wifi is saturated regardless of it being metro or not, relatively speaking the strongest signals by far will come from your neighbours not the telcos.
deleted 10y ago
[deleted]
revelation 10y ago
If I remember correctly, the problem with open WiFis is that all data is transmitted as plaintext. If you set a password (even if it's just "password") and therefore enable e.g. WPA2-PSK, data is properly encrypted with a per-client session key.
- lucaspiller 10y ago
  This isn't really true. If you know the PSK and can capture the packets of the client associating with the AP, you are able to decrypt any further communication. http://security.stackexchange.com/questions/8591/are-wpa2-connections-with-a-shared-key-secure http://security.stackexchange.com/questions/8591/are-wpa2-co...
  - detaro 10y ago
    Some event WLANs I've used had been set up to use WPA2 Enterprise, but accepting any user/password combination, giving everybody a different key. Bit more annoying to set up and connect to though, so probably not for general public APs. (+ explain that to customers. "No, really, just put anything in there. No, it doesn't matter, just do it.")
  - revelation 10y ago
    Well, that's almost as terrible. Combined with the "everyone can deassociate everyone" that's been in WLAN forever and the "enterprise" solutions using MSCHAPv2 where passwords can be almost trivially recovered it's pretty much impossible now to do WLAN securely. Companies should really treat any wireless network as basically insecure. The terrible certificate support in e.g. Android is just icing on the top.
    - simoncion 10y ago
      > ...and the "enterprise" solutions using MSCHAPv2 where passwords can be almost trivially recovered... Those enterprise solutions are almost certainly wrapping the MSCHAPv2 exchange in TLS. e.g. PEAP-MSCHAPv2 or TTLS-MSCHAPv2. Additionally, I'm not sure, but I think that plain EAP-MSCHAPv2 can't generate the keys required for a wireless client to establish an encrypted session with an AP and -thus- would never be used by a WiFi client. > The terrible certificate support in e.g. Android is just icing on the top. Eh? In my experience both Android and OS X's UIs for WPA-EAP are substantially superior to the UI that Windows offers.

pjc50 10y ago

If it's got a password, it's not really public wifi. Isn't it usually complementary wifi for patrons of a particular business?

jackvalentine 10y ago
I think he might be referring to "public" but not public wifi, like coffee shops etc. I've long thought that if your business is using public unlicensed spectrum then you should be required to let the public in. A very large national phone carrier in my country is blanketing the cities with wifi reserved for their customers - using a public resource and clogging up the unlicensed spectrum for private gain. They've already bought a lot of spectrum licenses, but clearly using public spectrum is a cost-effective way to add capacity.
- codecamper 10y ago
  Ugh.. and it is so hard to actually get on those wifi networks -- at least as a traveller. They'll give it free to mobile customers, who never bother to use it. Yes, I was referring to cafe / resto wifi. If one opens it, then people take advantage, but if everyone opens theirs, then nobody bothers. Only some really cheapskate neighbors who most probably don't consume all that much of it anyways. everybody has a smartphone now, most don't bother asking for the wifi password. If you ask for it, then often the next problem is the router doesn't work because nobody has used it in so long.
  - jjawssd 10y ago
    https://en.wikipedia.org/wiki/Tragedy_of_the_commons https://en.wikipedia.org/wiki/Tragedy_of_the_commons
- mseebach 10y ago
  Large scale public wifi generally doesn't have passwords, that clearly doesn't scale, they have fancy enterprise auth things or captive portals. Shared password only works for small places like coffee shops. Anecdotes: 1: on London Underground, my phone authenticates using the SIM somehow (it still shows a captive portal screen, just with an ad, yay). 2: in the Turkish lounge in Istanbul airport, the shared password was clearly a marketing channel, InvestInTK2016 or some such. It struck me as pretty clever. > if your business is using public unlicensed spectrum then you should be required to let the public in "Unlicensed" isn't really "unlicensed", as much as specifically licensed for anyone to do with as they please. But to take your idea just one step further, once you've opened up all wifi for the general publics consumption (what a renaissance for wired networking!), would people using it be allowed to use it for private gain? Why is it wrong to use unlicensed spectrum for private gain, but not to use a service provided over the same spectrum for private gain? Also, as a business, under this doctrine, are you allowed to enable wifi access to a closed non-internet LAN, with only locked-down non-public servers on it?
  - jackvalentine 10y ago
    > But to take your idea just one step further, once you've opened up all wifi for the general publics consumption (what a renaissance for wired networking!) I think this requires clarification - I don't mean no business should ever use wifi. I mean businesses like telephone companies shouldn't be using to augment their networks. Obviously offices and the like need secure wireless networking that normal hardware can connect to. > Why is it wrong to use unlicensed spectrum for private gain Maybe with my above correction this isn't needed, but in cities the 2.4ghz channel is loaded to death and in a few years the 5ghz channel will be the same. All I'm objecting to are these closed commercial networks from people who should be paying for the spectrum bunging up the open one the rest of us use. My city is soaked with a wifi network that is closed to everyone except the customers of a telco. If your primary business is providing network connectivity, perhaps you should pay for the finite resource you use.
    - mseebach 10y ago
      So you're speaking of a specific problem in a specific place - this is kind of hard to know when it was phrased as a general principle. Also, it's hard to discuss the issue when there are no details about the specific issue available. But two points: First, where I am, 2.4Ghz is perfectly swamped with normal residential access points. It seems unlikely that this telco in your city did much more than move up the point where the spectrum is swamped, rather than causing it directly (also, if their use is affecting everyone else, they themselves are affected, too, rendering their investment pretty pointless, which leads me to wonder just how bad the situation actually is). Second, if you do want to regulate, in a rule-of-law-compatible way, well, it's going to be hard to distinguish a Starbucks access point operated for the benefit of customers of Starbucks from a telco access point operated for the benefit of customers of that telco. (If you want to use spectrum ownership as the metric, consider that many telcos cover both spectrum-owning mobile and commercial and residential broadband (ie wifi-providing) subsidiaries). To further muddy the waters, the telco is very likely to be selling access to their wifi network to non-subscribers.
mseebach 10y ago
Public doesn't mean free to everybody, it means available to everybody. A public house (as opposed to a private club), aka a pub, is not a place you can hang out whenever, they have hours (they are not "public" at night) and you're supposed to buy stuff when you're in there. There's nothing about password protected wifi that makes it inherently non-public.
- Spivak 10y ago
  I think he means when certain Telcoms blanket entire cities with Wi-Fi in the unlicensed spectrum which at scale makes everyone else's connection worse. I have no problem with blanketing cities with internet access but I think commercial wireless should have their own frequency -- which would actually be good for them since they would be mostly alone in the space and could get a frequency which is better suited to large scale coverage.
  - dogma1138 10y ago
    I live in London which has allot of telco wifi everywhere and I haven't seen any adverse impact on my signal. Wifi is saturated regardless of it being metro or not, relatively speaking the strongest signals by far will come from your neighbours not the telcos.

deleted 10y ago

[deleted]

revelation 10y ago

If I remember correctly, the problem with open WiFis is that all data is transmitted as plaintext. If you set a password (even if it's just "password") and therefore enable e.g. WPA2-PSK, data is properly encrypted with a per-client session key.

lucaspiller 10y ago
This isn't really true. If you know the PSK and can capture the packets of the client associating with the AP, you are able to decrypt any further communication. http://security.stackexchange.com/questions/8591/are-wpa2-connections-with-a-shared-key-secure http://security.stackexchange.com/questions/8591/are-wpa2-co...
- detaro 10y ago
  Some event WLANs I've used had been set up to use WPA2 Enterprise, but accepting any user/password combination, giving everybody a different key. Bit more annoying to set up and connect to though, so probably not for general public APs. (+ explain that to customers. "No, really, just put anything in there. No, it doesn't matter, just do it.")
- revelation 10y ago
  Well, that's almost as terrible. Combined with the "everyone can deassociate everyone" that's been in WLAN forever and the "enterprise" solutions using MSCHAPv2 where passwords can be almost trivially recovered it's pretty much impossible now to do WLAN securely. Companies should really treat any wireless network as basically insecure. The terrible certificate support in e.g. Android is just icing on the top.
  - simoncion 10y ago
    > ...and the "enterprise" solutions using MSCHAPv2 where passwords can be almost trivially recovered... Those enterprise solutions are almost certainly wrapping the MSCHAPv2 exchange in TLS. e.g. PEAP-MSCHAPv2 or TTLS-MSCHAPv2. Additionally, I'm not sure, but I think that plain EAP-MSCHAPv2 can't generate the keys required for a wireless client to establish an encrypted session with an AP and -thus- would never be used by a WiFi client. > The terrible certificate support in e.g. Android is just icing on the top. Eh? In my experience both Android and OS X's UIs for WPA-EAP are substantially superior to the UI that Windows offers.