4 ms·

> Most of the "shame on public WiFi" comes from VPN companies I would call that a half-truth. When I was a kid (in the early 2000's) it was exceptionally easy

by kodah 5y ago

> Most of the "shame on public WiFi" comes from VPN companies I would call that a half-truth. When I was a kid (in the early 2000's) it was exceptionally easy to crack public wifi networks. A lot of that had to do with misconfiguration and every company scrambling to create public wifi APs. It makes sense that these memories and experiences live on and have become slogans of companies vying for privacy.

RobertMiller 5y ago
For the few years in college I was living off campus, I never paid for internet at all. Cracking WEP was that easy.
- willcipriano 5y ago
  I used this to get internet in my first apartment: https://www.whatsmyip.org/lib/fios-wep-key-calculator/ https://www.whatsmyip.org/lib/fios-wep-key-calculator/
  - bennathanson 5y ago
    Just checked my (old, not-used-anymore) Fios network name and there was the original password! Keeping the default password is never a good idea.
the_snooze 5y ago
TLS/HTTPS was also far less common in the early 2000s. It's so prevalent these days that unencrypted wifi connections really don't matter anymore. Computers are talking to remote servers over encrypted connections regardless of the presence or absence of wifi-level encryption.
- acdha 5y ago
  A related factor was responsibility shirking: some companies tried to claim that the problem for their lack of authentication / encryption was a problem with WiFi. I gave a few talks back then pushing what's now termed zero trust and you could just see the instinctive rejection from the telecom guys who were used to thinking of security as a function of the physical environment. That got criticism at the time, of course, but it really became untenable after so many malware attacks finally got the point through that you could not possibly rely on trusting the network layer.
zokier 5y ago
Also things like Firesheep were pretty high profile back in the days
thot_experiment 5y ago
The early 2000's were a real good time. Default passwords on everything, plain HTTP. In high school I did a MITM on a coffee shop because their router had the default credentials and just had a great time watching everyone else's browsing. My dad blocked battle.net AND found the keylogger I put on his computer to recover the router password to unblock it (though he was impressed enough by my attempt that he didn't ground me) which resulted in my first foray into linux (shouts to BackTrack) so I could crack the neighbors WEP. Once I figured out packet injection (before cellphones) I actually cracked some random company WEP in a parking lot when my friends and I got lost in order to look up directions. Nowadays things are a lot less fun. :(
- zoover2020 5y ago
  Oh boy, bring me back to the WEP-cracking Backtrack days as a kid. I remember buying a network adapter with packet injection capabilities SPECIFICALLY for this haha
  - joeyrobert 5y ago
    While I didn't do this myself, I remember watching Kevin Rose do this on his internet show thebroken. He talks about getting an orinoco PCMCIA wifi adapter because of their broad support for this kind of thing. If you want a blast from the past, you can watch them here: https://archive.org/details/thebroken_xvid https://archive.org/details/thebroken_xvid
- RajT88 5y ago
  There is still a lot of fun to be had! Driver support for packet injection in Kali Linux is fantastic now, making it easy to spray de-auth packets with most hardware and capture your auth packets without having to wait. I tested out Hashcat recently with my GTX 1060 (a modest card), and could burn through 170k WPA2 hashes a second. That's a long way from brute force, but doable for most wordlist attacks.
  - pabs3 5y ago
    Are the driver support for packet injection upstream now? ie can one do this on normal distros not just Kali?
znpy 5y ago
> When I was a kid (in the early 2000's) it was exceptionally easy to crack public wifi networks But you're not a kid anymore and nowadays it's way harder to crack public wifi networks. Fearmongering by VPN vendors is very real. I wouldn't have a problem browsing my home banking on a public wifi network. Everything is tls-encrypted, my browser can do dns-over-https, and anything important (including the login) requires me to enter an one-time code from my non-smart token. And by the way, on a public wifi you might be pray of the occasional wifi attacker where as if you're using a vpn from a vpn vendor you're by definition giving all your traffic to a company whose main specialty is networking, usually under the vague promise not to log your traffic.
- moonchild 5y ago
  Not to detract from your overall point, but a one-time code wouldn't protect you from mitm.
- city41 5y ago
  Not sure why you're so downvoted. Everything you state is correct and the person you are responding to brought up completely irrelevant things. VPN companies really do use fear tactics to sell their products.
Maursault 5y ago
> it was exceptionally easy to crack public wifi networks This may be because public wifi networks are public, which means they're open, which means there's no wifi password or encryption. Cracking a public wifi network takes all the effort of merely joining the wireless network with a mobile device.

by kodah 5y ago

RobertMiller 5y ago

For the few years in college I was living off campus, I never paid for internet at all. Cracking WEP was that easy.

willcipriano 5y ago
I used this to get internet in my first apartment: https://www.whatsmyip.org/lib/fios-wep-key-calculator/ https://www.whatsmyip.org/lib/fios-wep-key-calculator/
- bennathanson 5y ago
  Just checked my (old, not-used-anymore) Fios network name and there was the original password! Keeping the default password is never a good idea.

the_snooze 5y ago

TLS/HTTPS was also far less common in the early 2000s. It's so prevalent these days that unencrypted wifi connections really don't matter anymore. Computers are talking to remote servers over encrypted connections regardless of the presence or absence of wifi-level encryption.

acdha 5y ago
A related factor was responsibility shirking: some companies tried to claim that the problem for their lack of authentication / encryption was a problem with WiFi. I gave a few talks back then pushing what's now termed zero trust and you could just see the instinctive rejection from the telecom guys who were used to thinking of security as a function of the physical environment. That got criticism at the time, of course, but it really became untenable after so many malware attacks finally got the point through that you could not possibly rely on trusting the network layer.

zokier 5y ago

Also things like Firesheep were pretty high profile back in the days

thot_experiment 5y ago

The early 2000's were a real good time. Default passwords on everything, plain HTTP. In high school I did a MITM on a coffee shop because their router had the default credentials and just had a great time watching everyone else's browsing. My dad blocked battle.net AND found the keylogger I put on his computer to recover the router password to unblock it (though he was impressed enough by my attempt that he didn't ground me) which resulted in my first foray into linux (shouts to BackTrack) so I could crack the neighbors WEP. Once I figured out packet injection (before cellphones) I actually cracked some random company WEP in a parking lot when my friends and I got lost in order to look up directions. Nowadays things are a lot less fun. :(

zoover2020 5y ago
Oh boy, bring me back to the WEP-cracking Backtrack days as a kid. I remember buying a network adapter with packet injection capabilities SPECIFICALLY for this haha
- joeyrobert 5y ago
  While I didn't do this myself, I remember watching Kevin Rose do this on his internet show thebroken. He talks about getting an orinoco PCMCIA wifi adapter because of their broad support for this kind of thing. If you want a blast from the past, you can watch them here: https://archive.org/details/thebroken_xvid https://archive.org/details/thebroken_xvid
RajT88 5y ago
There is still a lot of fun to be had! Driver support for packet injection in Kali Linux is fantastic now, making it easy to spray de-auth packets with most hardware and capture your auth packets without having to wait. I tested out Hashcat recently with my GTX 1060 (a modest card), and could burn through 170k WPA2 hashes a second. That's a long way from brute force, but doable for most wordlist attacks.
- pabs3 5y ago
  Are the driver support for packet injection upstream now? ie can one do this on normal distros not just Kali?

znpy 5y ago

> When I was a kid (in the early 2000's) it was exceptionally easy to crack public wifi networks But you're not a kid anymore and nowadays it's way harder to crack public wifi networks. Fearmongering by VPN vendors is very real. I wouldn't have a problem browsing my home banking on a public wifi network. Everything is tls-encrypted, my browser can do dns-over-https, and anything important (including the login) requires me to enter an one-time code from my non-smart token. And by the way, on a public wifi you might be pray of the occasional wifi attacker where as if you're using a vpn from a vpn vendor you're by definition giving all your traffic to a company whose main specialty is networking, usually under the vague promise not to log your traffic.

moonchild 5y ago
Not to detract from your overall point, but a one-time code wouldn't protect you from mitm.
city41 5y ago
Not sure why you're so downvoted. Everything you state is correct and the person you are responding to brought up completely irrelevant things. VPN companies really do use fear tactics to sell their products.

Maursault 5y ago

> it was exceptionally easy to crack public wifi networks This may be because public wifi networks are public, which means they're open, which means there's no wifi password or encryption. Cracking a public wifi network takes all the effort of merely joining the wireless network with a mobile device.