4 ms·

This isn't really true. If you know the PSK and can capture the packets of the client associating with the AP, you are able to decrypt any further communication

This isn't really true. If you know the PSK and can capture the packets of the client associating with the AP, you are able to decrypt any further communication. http://security.stackexchange.com/questions/8591/are-wpa2-connections-with-a-shared-key-secure http://security.stackexchange.com/questions/8591/are-wpa2-co...

detaro 10y ago
Some event WLANs I've used had been set up to use WPA2 Enterprise, but accepting any user/password combination, giving everybody a different key. Bit more annoying to set up and connect to though, so probably not for general public APs. (+ explain that to customers. "No, really, just put anything in there. No, it doesn't matter, just do it.")
revelation 10y ago
Well, that's almost as terrible. Combined with the "everyone can deassociate everyone" that's been in WLAN forever and the "enterprise" solutions using MSCHAPv2 where passwords can be almost trivially recovered it's pretty much impossible now to do WLAN securely. Companies should really treat any wireless network as basically insecure. The terrible certificate support in e.g. Android is just icing on the top.
- simoncion 10y ago
  > ...and the "enterprise" solutions using MSCHAPv2 where passwords can be almost trivially recovered... Those enterprise solutions are almost certainly wrapping the MSCHAPv2 exchange in TLS. e.g. PEAP-MSCHAPv2 or TTLS-MSCHAPv2. Additionally, I'm not sure, but I think that plain EAP-MSCHAPv2 can't generate the keys required for a wireless client to establish an encrypted session with an AP and -thus- would never be used by a WiFi client. > The terrible certificate support in e.g. Android is just icing on the top. Eh? In my experience both Android and OS X's UIs for WPA-EAP are substantially superior to the UI that Windows offers.

4 ms·

This isn't really true. If you know the PSK and can capture the packets of the client associating with the AP, you are able to decrypt any further communication

by lucaspiller 10y ago

detaro 10y ago
Some event WLANs I've used had been set up to use WPA2 Enterprise, but accepting any user/password combination, giving everybody a different key. Bit more annoying to set up and connect to though, so probably not for general public APs. (+ explain that to customers. "No, really, just put anything in there. No, it doesn't matter, just do it.")
revelation 10y ago
Well, that's almost as terrible. Combined with the "everyone can deassociate everyone" that's been in WLAN forever and the "enterprise" solutions using MSCHAPv2 where passwords can be almost trivially recovered it's pretty much impossible now to do WLAN securely. Companies should really treat any wireless network as basically insecure. The terrible certificate support in e.g. Android is just icing on the top.
- simoncion 10y ago
  > ...and the "enterprise" solutions using MSCHAPv2 where passwords can be almost trivially recovered... Those enterprise solutions are almost certainly wrapping the MSCHAPv2 exchange in TLS. e.g. PEAP-MSCHAPv2 or TTLS-MSCHAPv2. Additionally, I'm not sure, but I think that plain EAP-MSCHAPv2 can't generate the keys required for a wireless client to establish an encrypted session with an AP and -thus- would never be used by a WiFi client. > The terrible certificate support in e.g. Android is just icing on the top. Eh? In my experience both Android and OS X's UIs for WPA-EAP are substantially superior to the UI that Windows offers.