4 ms·

It means that someone else in the area can't listen to your traffic and decrypt it, among other things. That might not be perfect, but it's far better than noth

It means that someone else in the area can't listen to your traffic and decrypt it, among other things. That might not be perfect, but it's far better than nothing.

jake_the_third 8y ago
As long as it's not presented as secure to users, I think it's a good thing.
- DuskStar 8y ago
  I think it also protects against people injecting content into the stream such as with the (possibly acryphorial, but IMO hilarious) goatse attack at Defcon 12[0]. Yes, people can still impersonate the AP, but that attack takes a little more effort and hardware. 0: https://emaknyus.blogspot.com/2011/07/airpwn-bringing-goatse-and-friends-to.html https://emaknyus.blogspot.com/2011/07/airpwn-bringing-goatse... (warning, likely contains goatse - image did not load for me)
  - rrdharan 8y ago
    I think you mean apocryphal?
    - DuskStar 8y ago
      Well, that's embarrassing... Past the edit window too.
zamadatix 8y ago
It does that like putting a wad of money behind a window protects your cash. If I'm going to walk into Starbucks to sniff the guest wireless all WPA3 changes is I have to make my laptop advertise itself as "Google Starbucks" and you send me all of your traffic with an encryption key we both know. People act like there is 0 harm in prematurely releasing a security feature in a network standard not remembering the various network hardware that will be made based on this don't follow a software development lifecycle where you just publish sprint 2 a few weeks from now with improvements and the world moves on. Even when things get updated wireless clients that are easily updatable (e.g. iOS/Windows devices) are only just recently using TLS 1.2 in their PEAP sessions. We shouldn't be playing fast and lose with security implementation in a future standard just because it sounds nice at first glance and assume sounds nice is better than nothing. What if we decide the next iteration of this design is to rely on PKI to create a chain of trust and now we've created 5 years of shit not working because wireless implementations are so shotty? Similar things have happened with other wireless standard revisions already... hell 802.11ac spent a lot of time and planning on MIMO (which is well established in other radio specifications already) and we still got an entire generation of wireless hardware that worked better without it enabled due to lack of real world vetting. The best hope in this case is everyone realizes this doesn't provide any meaningful security in the current revision even though it's already available and being pranced around as a great security benefit. /Rant of a network standards guy
- toomim 8y ago
  That's just a case that it doesn't help with. But—correct me if I'm wrong—it does help in the case where you have a home wifi network, that your devices all connect to, and remember the network. It will encrypt all the traffic of your devices. An attacker can't create a different network with the same SSID and trick existing devices to connect to it, right? If I'm right, then this is quite valuable. It means that most home users can have an encrypted LAN without having to remember the password and tell all their guests what it is whenever they have a visitor.
  - konschubert 8y ago
    > An attacker can't create a different network with the same SSID and trick existing devices to connect to it, right? Can't he? Wouldn't the existing devices just try to connect to whatever broadcasts that SSID.
    - josteink 8y ago
      Some devices actually verify the MAC of the sender, but that’s probably the exception and not the rule.
      - NickNameNick 8y ago
        That wouldn't help - Its trivial to configure an access point to advertise a user-selected MAC address, and the MAC address of an AP is broadcast in the clear even on WPA2 encrypted networks.
        vengefulduck 8y ago
        I think the parent post is referting to a Message Authentication Code not a mac address which an attacker couldn't forge.
  - Avamander 8y ago
    The signal just has to be stronger and they will at some point.

It means that someone else in the area can't listen to your traffic and decrypt it, among other things. That might not be perfect, but it's far better than nothing.

jake_the_third 8y ago

As long as it's not presented as secure to users, I think it's a good thing.

DuskStar 8y ago
I think it also protects against people injecting content into the stream such as with the (possibly acryphorial, but IMO hilarious) goatse attack at Defcon 12[0]. Yes, people can still impersonate the AP, but that attack takes a little more effort and hardware. 0: https://emaknyus.blogspot.com/2011/07/airpwn-bringing-goatse-and-friends-to.html https://emaknyus.blogspot.com/2011/07/airpwn-bringing-goatse... (warning, likely contains goatse - image did not load for me)
- rrdharan 8y ago
  I think you mean apocryphal?
  - DuskStar 8y ago
    Well, that's embarrassing... Past the edit window too.

zamadatix 8y ago

It does that like putting a wad of money behind a window protects your cash. If I'm going to walk into Starbucks to sniff the guest wireless all WPA3 changes is I have to make my laptop advertise itself as "Google Starbucks" and you send me all of your traffic with an encryption key we both know. People act like there is 0 harm in prematurely releasing a security feature in a network standard not remembering the various network hardware that will be made based on this don't follow a software development lifecycle where you just publish sprint 2 a few weeks from now with improvements and the world moves on. Even when things get updated wireless clients that are easily updatable (e.g. iOS/Windows devices) are only just recently using TLS 1.2 in their PEAP sessions. We shouldn't be playing fast and lose with security implementation in a future standard just because it sounds nice at first glance and assume sounds nice is better than nothing. What if we decide the next iteration of this design is to rely on PKI to create a chain of trust and now we've created 5 years of shit not working because wireless implementations are so shotty? Similar things have happened with other wireless standard revisions already... hell 802.11ac spent a lot of time and planning on MIMO (which is well established in other radio specifications already) and we still got an entire generation of wireless hardware that worked better without it enabled due to lack of real world vetting. The best hope in this case is everyone realizes this doesn't provide any meaningful security in the current revision even though it's already available and being pranced around as a great security benefit. /Rant of a network standards guy

toomim 8y ago
That's just a case that it doesn't help with. But—correct me if I'm wrong—it does help in the case where you have a home wifi network, that your devices all connect to, and remember the network. It will encrypt all the traffic of your devices. An attacker can't create a different network with the same SSID and trick existing devices to connect to it, right? If I'm right, then this is quite valuable. It means that most home users can have an encrypted LAN without having to remember the password and tell all their guests what it is whenever they have a visitor.
- konschubert 8y ago
  > An attacker can't create a different network with the same SSID and trick existing devices to connect to it, right? Can't he? Wouldn't the existing devices just try to connect to whatever broadcasts that SSID.
  - josteink 8y ago
    Some devices actually verify the MAC of the sender, but that’s probably the exception and not the rule.
    - NickNameNick 8y ago
      That wouldn't help - Its trivial to configure an access point to advertise a user-selected MAC address, and the MAC address of an AP is broadcast in the clear even on WPA2 encrypted networks.
      - vengefulduck 8y ago
        I think the parent post is referting to a Message Authentication Code not a mac address which an attacker couldn't forge.
- Avamander 8y ago
  The signal just has to be stronger and they will at some point.