3 ms·

> What is a "proper service" in this case? Something like one of the 802.11 Enterprise modes that don't use a PSK and actually check against a user DB before h

> What is a "proper service" in this case? Something like one of the 802.11 Enterprise modes that don't use a PSK and actually check against a user DB before handing out a session.

ghaff 7y ago
So now there’s significant complexity to getting on the network. Seems like a poor choice for a co-working space. And, as I say, plenty of large companies with competent IT departments don’t seem to think that’s necessarily. And how about when you’re having a meeting with outside people who need to get onto a network?
- Chlorus 7y ago
  > So now there’s significant complexity to getting on the network Not really, every OS (even Network Manager does a good job) has support for the WPA enterprise login flow. You basically get 1 prompt to trust a cert, then enter your username + pass (usually tied to AD) which you can save to your OS keychain. I've never had to fiddle with the one at my corporate network since first signing in months ago. I don't know about the actual security benefits, but I do know it stops the typical "capture the handshake & game over" > And how about when you’re having a meeting with outside people who need to get onto a network? You set up a crappy rinky-dink "FooBarGuest" network with a PSK that has no real access to the rest of the network and pretty much can just be used for web browsing.
- namibj 7y ago
  It's not hard to automate guest accounts.
- parliament32 7y ago
  Most universities and schools have a similar setup. No idea how WeWork works but I assume you have some sort of user account already (how do you pay them otherwise?) that you can use to authenticate yourself. Then your AP just needs to talk to a auth gateway (usually RADIUS) which then talks to your actual auth backend (LDAP, AD, or whatever online login form they use). For guests you either generate guest account or just have a guest network. We don't care if guests fight over the guest network because there aren't that many of them around at any one time... the problem is that actual WeWork customers shouldn't be fighting over insecure APs.
  - ghaff 7y ago
    Fair enough. Although I'm familiar with quite a few situations where most people just use a single network for wireless (whether employees or guests) and confidential company resources are put behind SSO and/or VPN using 2FA. Others do have separate networks of course and maybe that makes sense in the case of something like WeWork that probably has more people who aren't employees/paying customers coming in and out and getting on the network than the typical company office does.
    - parliament32 7y ago
      I think the problem is that providing internet access is part of WeWork's core product. It doesn't matter if your accountant's office just has one shitty wifi connection for everyone -- you'd still go visit them even if they didn't have wifi. But literally the entire point of WeWork is renting space to work, with internet. They should be held to a higher standard in this regard, IMO.
  - tedivm 7y ago
    Every WeWork member has a dedicated account which is tied to their company and badge (which is used for building access). This account is also used for reserving rooms.

> What is a "proper service" in this case? Something like one of the 802.11 Enterprise modes that don't use a PSK and actually check against a user DB before handing out a session.

ghaff 7y ago

So now there’s significant complexity to getting on the network. Seems like a poor choice for a co-working space. And, as I say, plenty of large companies with competent IT departments don’t seem to think that’s necessarily. And how about when you’re having a meeting with outside people who need to get onto a network?

Chlorus 7y ago
> So now there’s significant complexity to getting on the network Not really, every OS (even Network Manager does a good job) has support for the WPA enterprise login flow. You basically get 1 prompt to trust a cert, then enter your username + pass (usually tied to AD) which you can save to your OS keychain. I've never had to fiddle with the one at my corporate network since first signing in months ago. I don't know about the actual security benefits, but I do know it stops the typical "capture the handshake & game over" > And how about when you’re having a meeting with outside people who need to get onto a network? You set up a crappy rinky-dink "FooBarGuest" network with a PSK that has no real access to the rest of the network and pretty much can just be used for web browsing.
namibj 7y ago
It's not hard to automate guest accounts.
parliament32 7y ago
Most universities and schools have a similar setup. No idea how WeWork works but I assume you have some sort of user account already (how do you pay them otherwise?) that you can use to authenticate yourself. Then your AP just needs to talk to a auth gateway (usually RADIUS) which then talks to your actual auth backend (LDAP, AD, or whatever online login form they use). For guests you either generate guest account or just have a guest network. We don't care if guests fight over the guest network because there aren't that many of them around at any one time... the problem is that actual WeWork customers shouldn't be fighting over insecure APs.
- ghaff 7y ago
  Fair enough. Although I'm familiar with quite a few situations where most people just use a single network for wireless (whether employees or guests) and confidential company resources are put behind SSO and/or VPN using 2FA. Others do have separate networks of course and maybe that makes sense in the case of something like WeWork that probably has more people who aren't employees/paying customers coming in and out and getting on the network than the typical company office does.
  - parliament32 7y ago
    I think the problem is that providing internet access is part of WeWork's core product. It doesn't matter if your accountant's office just has one shitty wifi connection for everyone -- you'd still go visit them even if they didn't have wifi. But literally the entire point of WeWork is renting space to work, with internet. They should be held to a higher standard in this regard, IMO.
- tedivm 7y ago
  Every WeWork member has a dedicated account which is tied to their company and badge (which is used for building access). This account is also used for reserving rooms.