4 ms·

I'm less concerned with the security issues - WiFi you don't control should always be treated as possibly being compromised. What is a problem is that the netw

I'm less concerned with the security issues - WiFi you don't control should always be treated as possibly being compromised. What is a problem is that the networks are password protected and not meant for use by the general public. Airline lounges are providing WiFi for customers who have paid for access (either through the type of ticket or by spending enough to have status to access the lounges). Depending on the location, unauthorized access to the networks can either be categorized as theft of service or unauthorized access to a network. A "security engineer" who is promoting illegal activity isn't actually concerned with security.

codetrotter 8y ago
> What is a problem is that the networks are password protected and not meant for use by the general public. I agree but wanted to point out that what you are saying is exactly what parent commenter is saying too.
drdaeman 8y ago
It is controversial but there is something in publicly posting already compromised long-living static credentials. I do not approve nor disapprove of this. It could be unethical, could be even illegal but still - it also may force to not rely on this security-through-obscurity approach and maybe actually start doing things right. Sadly, many people don't learn from theoretical implications - they just ignore those and don't implement any security. They only start reacting when their passwords are posted in the open. E.g. if you want only paying customers to access your WiFi, generate unique passwords and print them on their receipts (or tickets or whatever) to look up.
- deleted 8y ago
  [deleted]
- ghaff 8y ago
  There are degrees of everything. In an ideal world, they probably wouldn't have passwords at all and trust everyone who doesn't have explicit permission to just not use AIRLINE_CLUB or whatever. We don't live in that world. On the other hand, they probably don't want to use some complicated individualized password scheme because that's a headache for everyone. So they pick a happy medium that keeps out the casual web surfer out on the concourse and, if a few people get it, who cares? But if a static password ceases to be much of a deterrent, then they've got no choice but going to a system that places more burden on everyone.
  - drdaeman 8y ago
    I'm not sure. Your vision looks oddly alien to me. It is human to make accidental mistakes, be tempted to break rules and similar. Half of our folklore is about praising deception, playing around the rules, outsmarting or outright cheating. I don't mean those are good things (they're generally not), but those are part of the human nature. Please don't take this personally, but the ideal world of your description would be boring and... I think "sterile" is the word. Not like this is inherently good or bad (I can see both aspects I think) - just alien. We had plaintext Internet once, but as it grew, it started to fail.So, now most of us cheer for TLS everywhere and believe it's a good idea. Don't see how this is any different.
jstarfish 8y ago
There's been an irritating trend of malware authors and other digital miscreants self-identifying as 'security researchers' lately. If they just want to hack other people's shit, they should own up to the antipathy that comes with that. Instead they act like extorting companies over undisclosed vulnerabilities, emptying *coin exchange accounts, posting credential dumps on the internet or exfiltrating gigabytes of data are somehow noble or academic endeavors.

codetrotter 8y ago

> What is a problem is that the networks are password protected and not meant for use by the general public. I agree but wanted to point out that what you are saying is exactly what parent commenter is saying too.

drdaeman 8y ago

It is controversial but there is something in publicly posting already compromised long-living static credentials. I do not approve nor disapprove of this. It could be unethical, could be even illegal but still - it also may force to not rely on this security-through-obscurity approach and maybe actually start doing things right. Sadly, many people don't learn from theoretical implications - they just ignore those and don't implement any security. They only start reacting when their passwords are posted in the open. E.g. if you want only paying customers to access your WiFi, generate unique passwords and print them on their receipts (or tickets or whatever) to look up.

deleted 8y ago
[deleted]
ghaff 8y ago
There are degrees of everything. In an ideal world, they probably wouldn't have passwords at all and trust everyone who doesn't have explicit permission to just not use AIRLINE_CLUB or whatever. We don't live in that world. On the other hand, they probably don't want to use some complicated individualized password scheme because that's a headache for everyone. So they pick a happy medium that keeps out the casual web surfer out on the concourse and, if a few people get it, who cares? But if a static password ceases to be much of a deterrent, then they've got no choice but going to a system that places more burden on everyone.
- drdaeman 8y ago
  I'm not sure. Your vision looks oddly alien to me. It is human to make accidental mistakes, be tempted to break rules and similar. Half of our folklore is about praising deception, playing around the rules, outsmarting or outright cheating. I don't mean those are good things (they're generally not), but those are part of the human nature. Please don't take this personally, but the ideal world of your description would be boring and... I think "sterile" is the word. Not like this is inherently good or bad (I can see both aspects I think) - just alien. We had plaintext Internet once, but as it grew, it started to fail.So, now most of us cheer for TLS everywhere and believe it's a good idea. Don't see how this is any different.

jstarfish 8y ago

There's been an irritating trend of malware authors and other digital miscreants self-identifying as 'security researchers' lately. If they just want to hack other people's shit, they should own up to the antipathy that comes with that. Instead they act like extorting companies over undisclosed vulnerabilities, emptying *coin exchange accounts, posting credential dumps on the internet or exfiltrating gigabytes of data are somehow noble or academic endeavors.