5 ms·
Is it sufficiently secure if the WiFi is setup with WPA2 TKIP and the SSID and passphrase are set to the same value? By sufficiently secure, I mean one node on
by chime 16y ago
Is it sufficiently secure if the WiFi is setup with WPA2 TKIP and the SSID and passphrase are set to the same value? By sufficiently secure, I mean one node on the WiFi cannot snoop in on other nodes even for HTTP traffic. What if we all open WiFi SSIDs are set to "Open*" and the passphrase is easily guessable (could be same as the SSID, could be the zipcode, could be just OpenOpenOpen)?
The goal is not to prevent someone some getting on the network but rather to keep all clients separated. Is that possible using existing devices/protocols?
- yuhong 16y agoThe problem is that with WPA-PSK it is easy to derive the PTK from the PMK by capturing and using the 4-way handshake.
- weavejester 16y agoForgive my ignorance, but are you saying that if I know the key to a WPA-PSK secured network, I can listen in to other connections accessing that same network? Does this apply to WPA2 as well?
- sigil 16y agoYes. WPA and WPA2 secure the network segment as a whole, not conversations between each pair of devices on the network.
- Groxx 16y agoForgive my ignorance, but that seems like insanity. Security 0.1 stuff, below even 101. Why is it still like this?
- sigil 16y agoThis is the way a normal ethernet network works. Consumers expect it. For instance, I have a printer that connects to my WPA2 network, how else would I print stuff?
- Groxx 16y agoWired != wireless. One is passively observable, the other isn't. How else would you print stuff? How does the printer having its own encrypted channel prevent it from printing stuff?
- sigil 16y ago> Wired != wireless. One is passively observable, the other isn't. Not true. Ever heard of promiscuous mode? > How does the printer having its own encrypted channel prevent it from printing stuff? It doesn't. You can set up an encrypted channel between your computer and the printer by using a secure printing protocol. The point is that "the network" doesn't provide secure channels between all pairs of clients; it's up to the clients.
- Groxx 16y agoPromiscuous mode in a wired network still requires you to physically connect to the network. At best you can use a passive EM detector to see all the traffic on a set of wires, so you don't have to cut them temporarily, but that still requires physical contact, and can only see things which are routed down that cable. For any business that guards its doors and ethernet ports, and has routers/switches instead of hubs, this is pretty much complete security. For wireless, you... sit up to a few hundred feet away (miles if you have a good parabolic antenna), and run Wireshark. It's entirely passive and undetectable.