6 ms·

The author claims to be a computer security engineer, yet is deliberately setting up a tool to defeat security -- not an abstract tool, useful in surveying and

by dsr_ 8y ago

The author claims to be a computer security engineer, yet is deliberately setting up a tool to defeat security -- not an abstract tool, useful in surveying and thus improving your own security and incidentally capable of being used for mischief, but nothing more than a list of identifiers and passwords. The only indicator you can gain from this is that someone betrayed your trust. If this profession had a board of ethics, this is the sort of thing that it would take action against. If people want you to use their networks, they will offer you access via any one of several convenient mechanisms, including not using encryption putting a sign on the wall with a password handing you a card with credentials telling you a password

tallanvor 8y ago
I'm less concerned with the security issues - WiFi you don't control should always be treated as possibly being compromised. What is a problem is that the networks are password protected and not meant for use by the general public. Airline lounges are providing WiFi for customers who have paid for access (either through the type of ticket or by spending enough to have status to access the lounges). Depending on the location, unauthorized access to the networks can either be categorized as theft of service or unauthorized access to a network. A "security engineer" who is promoting illegal activity isn't actually concerned with security.
- codetrotter 8y ago
  > What is a problem is that the networks are password protected and not meant for use by the general public. I agree but wanted to point out that what you are saying is exactly what parent commenter is saying too.
- drdaeman 8y ago
  It is controversial but there is something in publicly posting already compromised long-living static credentials. I do not approve nor disapprove of this. It could be unethical, could be even illegal but still - it also may force to not rely on this security-through-obscurity approach and maybe actually start doing things right. Sadly, many people don't learn from theoretical implications - they just ignore those and don't implement any security. They only start reacting when their passwords are posted in the open. E.g. if you want only paying customers to access your WiFi, generate unique passwords and print them on their receipts (or tickets or whatever) to look up.
  - deleted 8y ago
    [deleted]
  - ghaff 8y ago
    There are degrees of everything. In an ideal world, they probably wouldn't have passwords at all and trust everyone who doesn't have explicit permission to just not use AIRLINE_CLUB or whatever. We don't live in that world. On the other hand, they probably don't want to use some complicated individualized password scheme because that's a headache for everyone. So they pick a happy medium that keeps out the casual web surfer out on the concourse and, if a few people get it, who cares? But if a static password ceases to be much of a deterrent, then they've got no choice but going to a system that places more burden on everyone.
    - drdaeman 8y ago
      I'm not sure. Your vision looks oddly alien to me. It is human to make accidental mistakes, be tempted to break rules and similar. Half of our folklore is about praising deception, playing around the rules, outsmarting or outright cheating. I don't mean those are good things (they're generally not), but those are part of the human nature. Please don't take this personally, but the ideal world of your description would be boring and... I think "sterile" is the word. Not like this is inherently good or bad (I can see both aspects I think) - just alien. We had plaintext Internet once, but as it grew, it started to fail.So, now most of us cheer for TLS everywhere and believe it's a good idea. Don't see how this is any different.
- jstarfish 8y ago
  There's been an irritating trend of malware authors and other digital miscreants self-identifying as 'security researchers' lately. If they just want to hack other people's shit, they should own up to the antipathy that comes with that. Instead they act like extorting companies over undisclosed vulnerabilities, emptying *coin exchange accounts, posting credential dumps on the internet or exfiltrating gigabytes of data are somehow noble or academic endeavors.
gsich 8y ago
If you don't want your semi-public (ie payed for) WPA2 key to be compromised, use 802.1x. Then you can use whatever you want for authentication, including time based tokens.
sjwright 8y ago
A password that has already been handed out to thousands or tens of thousands of customers isn't "security".
- sneak 8y ago
  At that point it is public information, and sharing it more widely is just journalism or publishing.
  - SOLAR_FIELDS 8y ago
    I would find something like this to be helpful. As a frequent traveler often you don’t have any sort of cell service when you land. Being able to quickly hop on WiFi is often a godsend for quick communication and navigation to final destinations in foreign countries. As an example, in Copenhagen airport there is free WiFi but you have to go to wifi.cphairport.com to access it and if you don’t see one of the signs around the airport you won’t figure it out. Some handy guide that has URL, ID of the WiFi and password is super helpful in situations like this.
    - kosmet 8y ago
      Typing 1.1.1.1 or any other IP address usually helps, it automatically redirects to the main login page. If you type a name, your DNS query fails.
      - cytzol 8y ago
        Funny you picked that particular IP -- out of all four billion, 1.1.1.1 is the only one (that I know of) that uses HTTPS!
    - jamessb 8y ago
      Sometimes the resason that you don't get redirected to the wifi network's captive portal is that your browser is trying to access a page using HTTPS. Trying to connect to a HTTP-only site (like http://neverssl.com/ http://neverssl.com/) can solve this.
sneak 8y ago
I think this is a red herring. Not using encryption is unacceptable. Sharing public information is not unethical.
- dsr_ 8y ago
  Not using encryption to hide your public service is perfectly acceptable. If you come to my house, you can access my wifi network. No password needed. It's my gift to you. This information is not public. It is a set of shared secrets. And now it has been shared to everyone in the world, rather than those who the owners wanted it to be shared with.
- nkozyra 8y ago
  What's the red herring here?
- exegete 8y ago
  This isn't public info in some cases though. Airline sky clubs charge a fee and one of the benefits is their wifi (note that on the map, these aren't just airports, but airline sky clubs). That's like you coming to my house, I give you the password to the wifi, and then you go tell all the neighbors about it so they can get "free wifi".
remcob 8y ago
> not using encryption Not a viable option, this would allow anyone to intercept traffic. (To be fair, a lot of wifi routers are broken and will forward you all decrypted traffic from other users anyway on request. Try running WireShark on public wifis.) The big problem is that Wifi with no password provides no privacy. Ideally we would have a wifi mode that is encrypted, but does not require a password. Just like Https.
- frgewut 8y ago
  Actually WPA with pre-shared key doesn't provide any security if key is publicly known (as someone can setup mitm device). For wifi without password you should look at WPS.
  - blincoln 8y ago
    It's not that someone can set up a MitM device. Wifi with a shared password can be passively captured using a variety of tools and decrypted using WireShark.[1] The "coffee shop" scenario, where a WPA2 Personal password is written where anyone can see it, is essentially as insecure as non-encrypted wireless. WPA2 Personal is only secure if the password is very strong[2] and never given to untrusted parties. The only wireless security I put any real trust in is WPA2 Enterprise with 802.1x certificate-based authentication specifically.[3] [1] https://wiki.wireshark.org/HowToDecrypt802.11 https://wiki.wireshark.org/HowToDecrypt802.11 [2] Otherwise it's possible to mount a hash-cracking attack after capturing the four-way handshake for clients that have the password. [3] WPA2 Enterprise with per-user password-based authentication is vulnerable to an "evil twin attack" unless the password is very strong, which is usually not the case, because organizations typically have it authenticate against Active Directory or another LDAP.
    - zielmicha 8y ago
      > The only wireless security I put any real trust in is WPA2 Enterprise with 802.1x certificate-based authentication specifically. 802.1x with a certificate for Radius server (TTLS mode, which simply layers the plaintext password via TLS) and plain passwords for users is also good enough.
labourcurious 8y ago
WiFi passwords aren't about security for the people using the network, they're about blocking people who haven't paid for it. If, as an attacker, one of your targets is using JFK's airport WiFi, getting the password for that WiFi is the least of your problems. Whether it's ethical to hand out passwords to people who haven't paid for WiFi is another question entirely, but wouldn't it be sweet if businesses just let anyone join their WiFi? Bike repair shops always leave a pump outside for anyone to use, not just customers.
- wild_preference 8y ago
  No, because wifi bandwidth is finite and shared.
- zerkten 8y ago
  > wouldn't it be sweet if businesses just let anyone join their WiFi? Bike repair shops always leave a pump outside for anyone to use, not just customers. That's a flawed analogy. It'd be sweet if I could do any prohibited thing whenever I feel like it. How frequently is the pump oversubscribed that it causes a queue and blocks the sidewalk? If this happened, the repair shop would soon stop leaving a pump outside. With a WiFi network in an airport you have regular situations where demand outstrips capacity. This isn't something that is discovered later, it's common sense before you even operate the service. Users attempt to download movies at the last minute for their flights, and in many cases each person will attempt to connect multiple devices to the hotspot. The hotspot provider setup things to support their clientele. They'd have set it up differently if they wanted it available for use by all.

by dsr_ 8y ago

tallanvor 8y ago

I'm less concerned with the security issues - WiFi you don't control should always be treated as possibly being compromised. What is a problem is that the networks are password protected and not meant for use by the general public. Airline lounges are providing WiFi for customers who have paid for access (either through the type of ticket or by spending enough to have status to access the lounges). Depending on the location, unauthorized access to the networks can either be categorized as theft of service or unauthorized access to a network. A "security engineer" who is promoting illegal activity isn't actually concerned with security.

codetrotter 8y ago
> What is a problem is that the networks are password protected and not meant for use by the general public. I agree but wanted to point out that what you are saying is exactly what parent commenter is saying too.
drdaeman 8y ago
It is controversial but there is something in publicly posting already compromised long-living static credentials. I do not approve nor disapprove of this. It could be unethical, could be even illegal but still - it also may force to not rely on this security-through-obscurity approach and maybe actually start doing things right. Sadly, many people don't learn from theoretical implications - they just ignore those and don't implement any security. They only start reacting when their passwords are posted in the open. E.g. if you want only paying customers to access your WiFi, generate unique passwords and print them on their receipts (or tickets or whatever) to look up.
- deleted 8y ago
  [deleted]
- ghaff 8y ago
  There are degrees of everything. In an ideal world, they probably wouldn't have passwords at all and trust everyone who doesn't have explicit permission to just not use AIRLINE_CLUB or whatever. We don't live in that world. On the other hand, they probably don't want to use some complicated individualized password scheme because that's a headache for everyone. So they pick a happy medium that keeps out the casual web surfer out on the concourse and, if a few people get it, who cares? But if a static password ceases to be much of a deterrent, then they've got no choice but going to a system that places more burden on everyone.
  - drdaeman 8y ago
    I'm not sure. Your vision looks oddly alien to me. It is human to make accidental mistakes, be tempted to break rules and similar. Half of our folklore is about praising deception, playing around the rules, outsmarting or outright cheating. I don't mean those are good things (they're generally not), but those are part of the human nature. Please don't take this personally, but the ideal world of your description would be boring and... I think "sterile" is the word. Not like this is inherently good or bad (I can see both aspects I think) - just alien. We had plaintext Internet once, but as it grew, it started to fail.So, now most of us cheer for TLS everywhere and believe it's a good idea. Don't see how this is any different.
jstarfish 8y ago
There's been an irritating trend of malware authors and other digital miscreants self-identifying as 'security researchers' lately. If they just want to hack other people's shit, they should own up to the antipathy that comes with that. Instead they act like extorting companies over undisclosed vulnerabilities, emptying *coin exchange accounts, posting credential dumps on the internet or exfiltrating gigabytes of data are somehow noble or academic endeavors.

gsich 8y ago

If you don't want your semi-public (ie payed for) WPA2 key to be compromised, use 802.1x. Then you can use whatever you want for authentication, including time based tokens.

sjwright 8y ago

A password that has already been handed out to thousands or tens of thousands of customers isn't "security".

sneak 8y ago
At that point it is public information, and sharing it more widely is just journalism or publishing.
- SOLAR_FIELDS 8y ago
  I would find something like this to be helpful. As a frequent traveler often you don’t have any sort of cell service when you land. Being able to quickly hop on WiFi is often a godsend for quick communication and navigation to final destinations in foreign countries. As an example, in Copenhagen airport there is free WiFi but you have to go to wifi.cphairport.com to access it and if you don’t see one of the signs around the airport you won’t figure it out. Some handy guide that has URL, ID of the WiFi and password is super helpful in situations like this.
  - kosmet 8y ago
    Typing 1.1.1.1 or any other IP address usually helps, it automatically redirects to the main login page. If you type a name, your DNS query fails.
    - cytzol 8y ago
      Funny you picked that particular IP -- out of all four billion, 1.1.1.1 is the only one (that I know of) that uses HTTPS!
  - jamessb 8y ago
    Sometimes the resason that you don't get redirected to the wifi network's captive portal is that your browser is trying to access a page using HTTPS. Trying to connect to a HTTP-only site (like http://neverssl.com/ http://neverssl.com/) can solve this.

sneak 8y ago

I think this is a red herring. Not using encryption is unacceptable. Sharing public information is not unethical.

dsr_ 8y ago
Not using encryption to hide your public service is perfectly acceptable. If you come to my house, you can access my wifi network. No password needed. It's my gift to you. This information is not public. It is a set of shared secrets. And now it has been shared to everyone in the world, rather than those who the owners wanted it to be shared with.
nkozyra 8y ago
What's the red herring here?
exegete 8y ago
This isn't public info in some cases though. Airline sky clubs charge a fee and one of the benefits is their wifi (note that on the map, these aren't just airports, but airline sky clubs). That's like you coming to my house, I give you the password to the wifi, and then you go tell all the neighbors about it so they can get "free wifi".

remcob 8y ago

> not using encryption Not a viable option, this would allow anyone to intercept traffic. (To be fair, a lot of wifi routers are broken and will forward you all decrypted traffic from other users anyway on request. Try running WireShark on public wifis.) The big problem is that Wifi with no password provides no privacy. Ideally we would have a wifi mode that is encrypted, but does not require a password. Just like Https.

frgewut 8y ago
Actually WPA with pre-shared key doesn't provide any security if key is publicly known (as someone can setup mitm device). For wifi without password you should look at WPS.
- blincoln 8y ago
  It's not that someone can set up a MitM device. Wifi with a shared password can be passively captured using a variety of tools and decrypted using WireShark.[1] The "coffee shop" scenario, where a WPA2 Personal password is written where anyone can see it, is essentially as insecure as non-encrypted wireless. WPA2 Personal is only secure if the password is very strong[2] and never given to untrusted parties. The only wireless security I put any real trust in is WPA2 Enterprise with 802.1x certificate-based authentication specifically.[3] [1] https://wiki.wireshark.org/HowToDecrypt802.11 https://wiki.wireshark.org/HowToDecrypt802.11 [2] Otherwise it's possible to mount a hash-cracking attack after capturing the four-way handshake for clients that have the password. [3] WPA2 Enterprise with per-user password-based authentication is vulnerable to an "evil twin attack" unless the password is very strong, which is usually not the case, because organizations typically have it authenticate against Active Directory or another LDAP.
  - zielmicha 8y ago
    > The only wireless security I put any real trust in is WPA2 Enterprise with 802.1x certificate-based authentication specifically. 802.1x with a certificate for Radius server (TTLS mode, which simply layers the plaintext password via TLS) and plain passwords for users is also good enough.

labourcurious 8y ago

WiFi passwords aren't about security for the people using the network, they're about blocking people who haven't paid for it. If, as an attacker, one of your targets is using JFK's airport WiFi, getting the password for that WiFi is the least of your problems. Whether it's ethical to hand out passwords to people who haven't paid for WiFi is another question entirely, but wouldn't it be sweet if businesses just let anyone join their WiFi? Bike repair shops always leave a pump outside for anyone to use, not just customers.

wild_preference 8y ago
No, because wifi bandwidth is finite and shared.
zerkten 8y ago
> wouldn't it be sweet if businesses just let anyone join their WiFi? Bike repair shops always leave a pump outside for anyone to use, not just customers. That's a flawed analogy. It'd be sweet if I could do any prohibited thing whenever I feel like it. How frequently is the pump oversubscribed that it causes a queue and blocks the sidewalk? If this happened, the repair shop would soon stop leaving a pump outside. With a WiFi network in an airport you have regular situations where demand outstrips capacity. This isn't something that is discovered later, it's common sense before you even operate the service. Users attempt to download movies at the last minute for their flights, and in many cases each person will attempt to connect multiple devices to the hotspot. The hotspot provider setup things to support their clientele. They'd have set it up differently if they wanted it available for use by all.