7 ms·
For the number of engineers they have you'd think they'd have figured out how to build a decent wifi network with some actual security in it. Instead every WeWo
by tedivm 7y ago
For the number of engineers they have you'd think they'd have figured out how to build a decent wifi network with some actual security in it. Instead every WeWork has the same password for the wifi (literally a variant on `P@ssw0rd`) and it is super easy to spy on other people's connections. The hilarious thing is they actually built a secure wifi network for their staff, so they clearly recognize the need.
They also use the dumbest access points- they don't support roaming and connect you to the least congested point regardless of speed. It used to be a morning ritual of mine to toggle wifi on and off again until I had a decent connection.
- UncleMeat 7y agoWifi is largely insecure anyway. You should largely assume that the network is malicious no matter what and just rely on application layer security.
- geofft 7y agoThat's a reasonable position to take for networks in general like coffee shops, but if I'm paying WeWork to provide office infrastructure, I expect the network to not be malicious, just like I expect not to need to boil and chlorine-treat the water I get from their water fountains.
- simonebrunozzi 7y agoNot everybody knows or appreciates the use of a VPN. I don't think yours is enough justification for WeWork for not having built a proper service.
- ghaff 7y agoWhat is a "proper service" in this case? Many company networks routinely allow access using fairly straightforward and rarely rotated passwords. Of course, access to actual company resources like email require 2FA etc. But as others note, the main purpose of having a password at all is to stop casual passersby from leeching off your network.
- Chlorus 7y ago> What is a "proper service" in this case? Something like one of the 802.11 Enterprise modes that don't use a PSK and actually check against a user DB before handing out a session.
- ghaff 7y agoSo now there’s significant complexity to getting on the network. Seems like a poor choice for a co-working space. And, as I say, plenty of large companies with competent IT departments don’t seem to think that’s necessarily. And how about when you’re having a meeting with outside people who need to get onto a network?
- Chlorus 7y ago> So now there’s significant complexity to getting on the network Not really, every OS (even Network Manager does a good job) has support for the WPA enterprise login flow. You basically get 1 prompt to trust a cert, then enter your username + pass (usually tied to AD) which you can save to your OS keychain. I've never had to fiddle with the one at my corporate network since first signing in months ago. I don't know about the actual security benefits, but I do know it stops the typical "capture the handshake & game over" > And how about when you’re having a meeting with outside people who need to get onto a network? You set up a crappy rinky-dink "FooBarGuest" network with a PSK that has no real access to the rest of the network and pretty much can just be used for web browsing.
- namibj 7y agoIt's not hard to automate guest accounts.
- parliament32 7y agoMost universities and schools have a similar setup. No idea how WeWork works but I assume you have some sort of user account already (how do you pay them otherwise?) that you can use to authenticate yourself. Then your AP just needs to talk to a auth gateway (usually RADIUS) which then talks to your actual auth backend (LDAP, AD, or whatever online login form they use). For guests you either generate guest account or just have a guest network. We don't care if guests fight over the guest network because there aren't that many of them around at any one time... the problem is that actual WeWork customers shouldn't be fighting over insecure APs.
- bspammer 7y agoApplication layer security doesn't just mean VPNs. What websites are you connecting to with sensitive information that don't use HTTPS with HSTS preload nowadays?
- geofft 7y agoHere's one from just yesterday: the password reset form for sched.com, which the Linux Foundation uses for schedules, is HTTP. I had to follow this link to upload my slides for a talk I'm giving at a LF conference next week. Yes, the ideal, which we should all be actively working towards, is HTTPS. That doesn't mean that the world is already there.
- dankohn1 7y agoNote that Let's Encrypt, which is making universal https possible, is also part of the Linux Foundation. I was going to complain to sched.com for you, but I can't replicate the problem: https://ossna19.sched.com/password-reset https://ossna19.sched.com/password-reset is the default and http://ossna19.sched.com/password-reset http://ossna19.sched.com/password-reset redirects to it. (I work for the Linux Foundation.)
- geofft 7y agoThe email you get in your inbox when you do that is http. It starts with http://a.sched.com/track/click/ http://a.sched.com/track/click/.
- dankohn1 7y agoI worked with Sched.com this week based on your feedback and that link is now https. Thanks.
- quickthrower2 7y agoAwesome work
- tictoc 7y agoWhat VPNs should one be using? Should I create my own because what's the guarantee of a vpn actually being trustworthy?
- fs111 7y agohttps://github.com/trailofbits/algo https://github.com/trailofbits/algo is pretty good for self hosted
- klinskyc 7y agoOur WeWork was so close to another WeWork that the WiFi networks interfered with each other, and caused the WiFi to drop out every hour or so. Took them a month to fix.
- zaroth 7y agoHaving the same WPA2-PSK authentication secret does not allow spying over WiFi, unless you are willing to actively spoof the network.
- ustolemyname 7y agoYes it does. If you capture the authentication handshake, it's as straightforward as putting the passphrase into Wireshark.
- zaroth 7y agoI could have sworn there was a DH key negotiation? And I worked in WiFi for a decade, a decade ago... Sorry, obviously I have not had enough coffee yet today. Looks like this was only added in WPA3!
- geofft 7y agoI think you can also do it with WPA2-Enterprise, so a common trick is to set up enough infrastructure to let your users use EAP-TLS or something, and IIRC EAP sets up a per-client session key in the handshake. The public LinkNYC wifi network, for instance, has both an open network and an EAP-TTLS one that you can download a provisioning profile for.
- paxys 7y agoHow do you spy on other people's connections at a WeWork?
- tedivm 7y agohttps://mrncciew.com/2014/08/16/decrypt-wpa2-psk-using-wireshark/ https://mrncciew.com/2014/08/16/decrypt-wpa2-psk-using-wires...
- Gpetrium 7y agoBe mindful that if you get caught, it is likely to be a breach of contract with WeWork and may end up involving the authorities.
- selimthegrim 7y agoOne could argue it wouldn't...(puts on David Caruso sunglasses)...be WeFi otherwise
- SkyPuncher 7y agoI don't see the issue. The password isn't to protect you against other WeWorkers, it's to exclude people on the outside. Personally, I think any attempt at them to provide serious security on the shared network would be a really bad idea. It'd make people feel comfortable but somebody would find a hole and suddenly have access to a ton of devices. If security is an issue, just use a VPN/Wireguard.
- tedivm 7y agoYour first point is actually part of my point- the fact that they have a single password means excluding people on the outside is basically impossible. If someone has a lease at WeWork but then leaves there's no way to keep them off the network without changing the password for everyone. Since the password is really simple (like, "easy to guess" simple), and since it's possible that people have shared it publicly, their network is not that far away from just being an open wifi network. And yes, we did setup a VPN for all of our employees to use while we were in the WeWork office. I don't think that changes my point that the WeWork network is not setup well at all.
- basch 7y ago>their network is not that far away from just being an open wifi network. It is an open network, they just are limiting bandwidth use of passer byers.
- parliament32 7y agoIn addition, enterprise WPA (802.1x) doesn't work like that. In WPA-Personal, if you have the password (PSK) and capture the handshake (easy), you have easy decryption of any other clients' traffic. In WPA-Enterprise, all the connections are segregated (because the handshake uses your certs and mutual auth).
- Gpetrium 7y agoAs the provider of the overall service/experience, the major issue that their clients should have is that they might not be actively letting renters/users know of the risks and advising on the steps that can/should be taken if their Wireless network is intended for privacy sensitive material (e-mail login, credit card, etc).
- skrebbel 7y agoI thought I knew this stuff, but now I'm not so sure anymore. If I take care to only visit https sites, what's the risk in being on an open network or a network with a stupid password? They can see what domains I connect to and when, but that's it, correct? No MITM, no further snooping, right?
- stefan_ 7y agoA favorite attack vector is various auto-updating software on your computer that downloads updates or update metadata over HTTP. For the longest time Sparkle (an update framework used in Mac apps such as VLC, iTerm, ..) defaulted to HTTP. Once an attacker is in your network, it's more or less trivial to make that software connect to a malicious update server.
- Kalium 7y agoThere's a limited amount of room to exploit this, this so long as signing is handled correctly. The Debian Apt system worked this way for a long time. Of course, a lot of code signing systems are mismanaged, so...
- chrischen 7y agoIf you run local dev servers and expose them they could be accessed. Also IP addresses and domain names you visit are visible.
- Kalium 7y agoFortunately for everyone, encrypted SNI is becoming a thing. DNS queries are probably still visible though, and responses potentially poisoned.
- Kalium 7y agoIf the network is open, your machine may be open to being sent traffic - or attacked - from other devices on the network.
- 7y ago
- com2kid 7y agoThe Wi-Fi at the WeWork I'm at is blazing fast, even in an open office with a 4 or 5 dozen laptops + cell phones connected. I can get 20-40MB/s, not the fastest I've seen, when I was plugged into gigabit at MSFT I could basically saturate my network card, but far faster than my home connection and good enough for any possible need my development laptop has. TBF to your complaints, I am mostly stationary, and the WeWork labs floor I'm on doesn't have very many walls, but I've roamed video calls before and not had an issue. (The space I'm in is super new though, it was constructed last November, so that may be part of the difference as well?)
- tedivm 7y agoMy experience is with the WeWork in Berkeley. If we had a good connection our speed was great, but we would have to toggle wifi on and off to get that connection.
- treve 7y agoYou need some password to have encryption at all. This is just a better alternative to open networks with captive portals. I think it's perfectly fine to expect some risk connecting to someone else's network. At least they didn't make it an open network. If you're a person that wouldn't connect to the internet in a cafe without a VPN, you shouldn't either at a WeWork.