6 ms·

So, how secure is a network when the teenagers in the house give out the WiFi key to all their friends when they visit? How secure is it when said teenagers ask

So, how secure is a network when the teenagers in the house give out the WiFi key to all their friends when they visit? How secure is it when said teenagers ask Dad to change the previous random-character password to a simple phrase to make it easier for their friends to type it in? Asking for a friend. :) In other words, about 99% of the WiFi passwords out there are vulnerable to a brute force attack. But we knew that already, didn't we? Was it not already possible to brute force WPA2 before this new attack? How much easier/faster is this new attack? It would have been nice if the article itself said something like: "This new attack increases brute force attack rate by a factor of 10x". Or whatever the right value is.

rooam-dev 8y ago
I started to encode it as QR code and share it with guests. It is cross platform :)
- copperx 8y ago
  Are there any devices with a built-in QR code reader? Android and iOS require a download. Not to mention Windows and Mac. Do you ask people to download a QR code reader on their devices so they can access your WiFi router? That's a bit too crazy, don't you think?
  - lhabjane 8y ago
    Latest iOS supports QR codes through a standard camera app, no extra app needed
  - pirocks 8y ago
    Afaik, the default camera app on most android installs can recognize/read qr codes.
    - lucb1e 8y ago
      Never seen one that does this, but I only ever saw a Samsung (from 2012 and 2013), Lenovo (2016), Xiaomi (2018) and Huawei (2018) because my girlfriend and I don't swap them out every other year (heck, not even every four years). I feel like friends might have mentioned it as well, as the topic of a good, FOSS QR code scanner came up a few times in some chats.
      - jarfil 8y ago
        Huawei has it, but it's kind of hidden and only accessible from the lockscreen (wtf, right?).
  - tomjakubowski 8y ago
    A fun fact I recently discovered when bored and "3D Touching" every app on my phone: Twitter.app has a built in QR code reader. It works pretty well, but I'll concede it might still be crazy to presume guests have the Twitter app installed :-) edit: oh wow, as sibling commenter points out: the camera app detects QR codes now. neat!
    - mikeyouse 8y ago
      FWIW, 3D touching the Chrome icon also opens a QR Reader.
conception 8y ago
I'm not sure when/how but all the newer wifi home systems I've seen prompt people's devices to share the password when someone tries to join. So you can have a complex password. Also a lot of those have guest networks so if you need a week network you can have them. Finally you can xkcd your password and make it something like "maytheforcebewithmyfriendmark" - doesn't have to be complex.
- jdwithit 8y ago
  This is a feature of iOS and macOS, at least. If you have a wifi network's password saved in your device, you can bring it physically close to another device that doesn't and it will ask whether you want to share. You have to affirm you want to give them the login before it will happen. Very handy when traveling as only one person in the group has to find and (mis)type the password :)
- lucb1e 8y ago
  > Finally you can xkcd your password and make it something like "maytheforcebewithmyfriendmark" No, no, no. The rest of your comment is spot-on, but I've done projects on passphrases and everyone gets this backwards. That is not what XKCD says. Let me quote the XKCD: > four random common words Random words, not a phrase like "may the force be with" and "my friend mark" (I'm sure you can find those two online). When cracking public hash dumps using phrases from public sources, I get hundreds of thousands of hits. If your phrase (partially) exists online, it's not a secret one. Someone else mentioned diceware. Six random words from that dictionary (potentially generated using real dice) is pretty much unbreakable, though it has only a small security margin for when a protocol gets weakened but not broken.
  - dogma1138 8y ago
    These passwords are not reselient to complicated attacks and are more easily cracked than randomly generated passwords. Limit the dictionary to the top Xk most common English words, if leetspeak substitution is used you can also easily mask it. We did this experiment and even randomly generating 6 word passwords using Wikipedia as dictionary resulted in passwords which are faster to crack than 16 character randomly generated passwords and that is because you can’t count the entropy as single characters sure if you brute force it char by char it will take longer but if you use words as your base unit then you only need to find 4-6 from a fairly limited pool of possibilities. You can further limit it down by using grammar rules if your target is using passphrases those are even faster to crack and can be generated using markov chains or any basic grammar rule engine.
palant 8y ago
The article actually does explain it. The bruteforcing speed doesn't change at all, the same value (PMK) as before is being bruteforced. What changes is merely the approach to get it from the router - an attacker no longer needs to wait for a legitimate user to authenticate, they can ask the router themselves.
- mangix 8y ago
  It's a little faster because of no nonce error correction shenanigans.
trumped 8y ago
I have a guest wifi network that is isolated from the wifi network that I commonly use... it's probably a bit safer this way.
zaarn 8y ago
Guest Wifi. I maintain a strict "guests aren't allowed on the main wifi" rule. The password is 100 characters and if I find a guest on the wifi the password is rotated. Happened once then they stopped and just handed out the guest password.
ectospheno 8y ago
Don't give your family the wifi password. Type it in for them. You should be doing the same thing with administrative account passwords. Guests can use guest wifi or plug into the guest switch.

rooam-dev 8y ago

I started to encode it as QR code and share it with guests. It is cross platform :)

copperx 8y ago
Are there any devices with a built-in QR code reader? Android and iOS require a download. Not to mention Windows and Mac. Do you ask people to download a QR code reader on their devices so they can access your WiFi router? That's a bit too crazy, don't you think?
- lhabjane 8y ago
  Latest iOS supports QR codes through a standard camera app, no extra app needed
- pirocks 8y ago
  Afaik, the default camera app on most android installs can recognize/read qr codes.
  - lucb1e 8y ago
    Never seen one that does this, but I only ever saw a Samsung (from 2012 and 2013), Lenovo (2016), Xiaomi (2018) and Huawei (2018) because my girlfriend and I don't swap them out every other year (heck, not even every four years). I feel like friends might have mentioned it as well, as the topic of a good, FOSS QR code scanner came up a few times in some chats.
    - jarfil 8y ago
      Huawei has it, but it's kind of hidden and only accessible from the lockscreen (wtf, right?).
- tomjakubowski 8y ago
  A fun fact I recently discovered when bored and "3D Touching" every app on my phone: Twitter.app has a built in QR code reader. It works pretty well, but I'll concede it might still be crazy to presume guests have the Twitter app installed :-) edit: oh wow, as sibling commenter points out: the camera app detects QR codes now. neat!
  - mikeyouse 8y ago
    FWIW, 3D touching the Chrome icon also opens a QR Reader.

conception 8y ago

I'm not sure when/how but all the newer wifi home systems I've seen prompt people's devices to share the password when someone tries to join. So you can have a complex password. Also a lot of those have guest networks so if you need a week network you can have them. Finally you can xkcd your password and make it something like "maytheforcebewithmyfriendmark" - doesn't have to be complex.

jdwithit 8y ago
This is a feature of iOS and macOS, at least. If you have a wifi network's password saved in your device, you can bring it physically close to another device that doesn't and it will ask whether you want to share. You have to affirm you want to give them the login before it will happen. Very handy when traveling as only one person in the group has to find and (mis)type the password :)
lucb1e 8y ago
> Finally you can xkcd your password and make it something like "maytheforcebewithmyfriendmark" No, no, no. The rest of your comment is spot-on, but I've done projects on passphrases and everyone gets this backwards. That is not what XKCD says. Let me quote the XKCD: > four random common words Random words, not a phrase like "may the force be with" and "my friend mark" (I'm sure you can find those two online). When cracking public hash dumps using phrases from public sources, I get hundreds of thousands of hits. If your phrase (partially) exists online, it's not a secret one. Someone else mentioned diceware. Six random words from that dictionary (potentially generated using real dice) is pretty much unbreakable, though it has only a small security margin for when a protocol gets weakened but not broken.
- dogma1138 8y ago
  These passwords are not reselient to complicated attacks and are more easily cracked than randomly generated passwords. Limit the dictionary to the top Xk most common English words, if leetspeak substitution is used you can also easily mask it. We did this experiment and even randomly generating 6 word passwords using Wikipedia as dictionary resulted in passwords which are faster to crack than 16 character randomly generated passwords and that is because you can’t count the entropy as single characters sure if you brute force it char by char it will take longer but if you use words as your base unit then you only need to find 4-6 from a fairly limited pool of possibilities. You can further limit it down by using grammar rules if your target is using passphrases those are even faster to crack and can be generated using markov chains or any basic grammar rule engine.

palant 8y ago

The article actually does explain it. The bruteforcing speed doesn't change at all, the same value (PMK) as before is being bruteforced. What changes is merely the approach to get it from the router - an attacker no longer needs to wait for a legitimate user to authenticate, they can ask the router themselves.

mangix 8y ago
It's a little faster because of no nonce error correction shenanigans.

trumped 8y ago

I have a guest wifi network that is isolated from the wifi network that I commonly use... it's probably a bit safer this way.

zaarn 8y ago

Guest Wifi. I maintain a strict "guests aren't allowed on the main wifi" rule. The password is 100 characters and if I find a guest on the wifi the password is rotated. Happened once then they stopped and just handed out the guest password.

ectospheno 8y ago

Don't give your family the wifi password. Type it in for them. You should be doing the same thing with administrative account passwords. Guests can use guest wifi or plug into the guest switch.