4 ms·

The fake beacon frame issue is the key one here - relatively few people are using Enterprise WPA2, but ESP8266 (or compatible - such as the Tuya TYWE3S) chips a

The fake beacon frame issue is the key one here - relatively few people are using Enterprise WPA2, but ESP8266 (or compatible - such as the Tuya TYWE3S) chips are in all kinds of random low cost IoT devices. I've got some smart plugs which use them, as well as a few of the dev boards connected up to various sensors, so looks like will have some patching to do...

tialaramex 7y ago
I suppose "relatively few people" is true if you define people the way it would have been understood a century ago. Corporate and institutional systems will almost invariably do WPA2 Enterprise. Without Enterprise, there's just one magic shared key "password" known to every user of the network. The Enterprise mode outsources authentication of participants to a separate service using EAP and nearly always ends up leveraging TLS to actually make this secure one way or another. This enables, for example, EduROAM in which academics and students use their "home" institution credentials to get network access in any participating educational network.
- mpettitt 7y ago
  I was talking in terms of IoT devices using these chips - more of them are likely to be on home networks, using WPA2 Personal than in offices using the enterprise version. For offices, wired smart devices or higher end wireless devices are more common, which tend to use custom silicon, rather than COTS modules like the ESP ones. Hue bulbs, for example, don't use ESP derived chips (if only because they need Zigbee rather than WiFi), and not does Lutron kit (z-wave), although Lifx bulbs do.
  - tidepod12 7y ago
    Home automation on personal networks is certainly a large use case for these devices, but I think you underestimate the number of ESP8266/32 devices that are used in enterprise environments. The Industrial IoT space is pretty big, using small wifi chips like the ESPs for stuff like factory data collection or data center monitoring. I also have personally seen them used in medical device environments and security systems (think wireless door sensors and the like). The "big boys" probably use custom made silicon (but even then I've seen custom-made silicon with an ESP8266 mounted onto it to abstract out the wifi connection part), but I wouldn't be surprised if the majority of IIoT startups use the ESPs as part of their products.
- bscphil 7y ago
  So if it's the norm to connect to unknown APs with SSID "eduroam" and submit your username and password, can I make a rogue AP that sniffs everyone's credentials? Or is this prevented under Enterprise, e.g. through a pre-shared certificate for the authentication server (which isn't run by the AP host)? If the latter, can I make my own real eduroam AP?
  - tialaramex 7y ago
    The AP needs to arrange (typically with a RADIUS server) to tunnel the authentication to a remote EAP at the users institution. The local RADIUS server will discover your username (often an email address) but the other credentials used are up to the institution and only delivered there. It will often be MSCHAPv2 which is designed to authenticate Windows passwords, but it could even do X.509 client certificates. Since TLS ends up in the picture many institutions use the Web PKI, so a typical modern device already understands how to verify that this is the right server for example@example.com to authenticate against, it's the one with a Certificate for the DNS name example.com. But yes, they can do all this with custom certificates instead and I'm sure lots do that. Yes, you can in principle make an EduROAM service. You should probably talk to whatever higher education or further education IT body exists in your country. Notice that only academics and students get to access the network, so unless you're either of those things you'll need to also add an escape hatch for yourself and anybody else you want using it. Offering the service to others does not entitle you to any access, it would be only a courtesy to others.
    - bscphil 7y ago
      Great detailed answer, thanks!

tialaramex 7y ago

I suppose "relatively few people" is true if you define people the way it would have been understood a century ago. Corporate and institutional systems will almost invariably do WPA2 Enterprise. Without Enterprise, there's just one magic shared key "password" known to every user of the network. The Enterprise mode outsources authentication of participants to a separate service using EAP and nearly always ends up leveraging TLS to actually make this secure one way or another. This enables, for example, EduROAM in which academics and students use their "home" institution credentials to get network access in any participating educational network.

mpettitt 7y ago
I was talking in terms of IoT devices using these chips - more of them are likely to be on home networks, using WPA2 Personal than in offices using the enterprise version. For offices, wired smart devices or higher end wireless devices are more common, which tend to use custom silicon, rather than COTS modules like the ESP ones. Hue bulbs, for example, don't use ESP derived chips (if only because they need Zigbee rather than WiFi), and not does Lutron kit (z-wave), although Lifx bulbs do.
- tidepod12 7y ago
  Home automation on personal networks is certainly a large use case for these devices, but I think you underestimate the number of ESP8266/32 devices that are used in enterprise environments. The Industrial IoT space is pretty big, using small wifi chips like the ESPs for stuff like factory data collection or data center monitoring. I also have personally seen them used in medical device environments and security systems (think wireless door sensors and the like). The "big boys" probably use custom made silicon (but even then I've seen custom-made silicon with an ESP8266 mounted onto it to abstract out the wifi connection part), but I wouldn't be surprised if the majority of IIoT startups use the ESPs as part of their products.
bscphil 7y ago
So if it's the norm to connect to unknown APs with SSID "eduroam" and submit your username and password, can I make a rogue AP that sniffs everyone's credentials? Or is this prevented under Enterprise, e.g. through a pre-shared certificate for the authentication server (which isn't run by the AP host)? If the latter, can I make my own real eduroam AP?
- tialaramex 7y ago
  The AP needs to arrange (typically with a RADIUS server) to tunnel the authentication to a remote EAP at the users institution. The local RADIUS server will discover your username (often an email address) but the other credentials used are up to the institution and only delivered there. It will often be MSCHAPv2 which is designed to authenticate Windows passwords, but it could even do X.509 client certificates. Since TLS ends up in the picture many institutions use the Web PKI, so a typical modern device already understands how to verify that this is the right server for example@example.com to authenticate against, it's the one with a Certificate for the DNS name example.com. But yes, they can do all this with custom certificates instead and I'm sure lots do that. Yes, you can in principle make an EduROAM service. You should probably talk to whatever higher education or further education IT body exists in your country. Notice that only academics and students get to access the network, so unless you're either of those things you'll need to also add an escape hatch for yourself and anybody else you want using it. Offering the service to others does not entitle you to any access, it would be only a courtesy to others.
  - bscphil 7y ago
    Great detailed answer, thanks!