3 ms·

The user's device would somehow have to be sure it's talking to the legitimate router, and not one an attacker set up with a deceptively similar SSID. I can't t

The user's device would somehow have to be sure it's talking to the legitimate router, and not one an attacker set up with a deceptively similar SSID. I can't think of a way this would be possible, unless popular access points were signed by CAs.

Herring 15y ago
You could require physical contact in order to connect. Touch your ipad to this surface & exchange keys. Cumbersome, though.
- steve-howard 15y ago
  We already have Wi-Fi Protected Setup, which allows you to press a button on the router to connect. http://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup http://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup I think it's legitimate to want encryption even if you can't verify identity. Man in the middle may be trivial in that case, but it's still harder than just sniffing packets.
drzaiusapelord 15y ago
This is the classic excuse to not implement encryption: "but we need a web of trust and certificate authorities and central management of identities and a million complex things that'll never work right even if implemented." Encryption without identity validation is a worthy goal in itself, especially when we're talking consumer grade stuff.
- wmf 15y ago
  MITM is so trivial on Wi-Fi that protecting against passive sniffing but not MITM just provides a false sense of security. Fortunately there is some progress in this area: http://www.usenix.org/events/sec11/tech/full_papers/Gollakota.pdf http://www.usenix.org/events/sec11/tech/full_papers/Gollakot...
tomp 15y ago
That's really just another way of saying that users shouldn't connect to routers they do not trust. There's this new feature of SSH key generators, where the user is shown an ASCII art of the generated SSH key, to be able to visually remember and recognize it. A standardized graphical representation of certificates could be used to confirm the identity of the router. Imagine walking into Starbucks or any WiFi enabled place, you see a sign on the wall that gives you the network name and the "VisiSign", you connect to the router, your computer shows you the VisiSign of the router, and you can visually confirm the identity of the router.
icebraining 15y ago
Publish the key fingerprint visibly? Then at least savvy users could verify it.

Herring 15y ago

You could require physical contact in order to connect. Touch your ipad to this surface & exchange keys. Cumbersome, though.

steve-howard 15y ago
We already have Wi-Fi Protected Setup, which allows you to press a button on the router to connect. http://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup http://en.wikipedia.org/wiki/Wi-Fi_Protected_Setup I think it's legitimate to want encryption even if you can't verify identity. Man in the middle may be trivial in that case, but it's still harder than just sniffing packets.

drzaiusapelord 15y ago

This is the classic excuse to not implement encryption: "but we need a web of trust and certificate authorities and central management of identities and a million complex things that'll never work right even if implemented." Encryption without identity validation is a worthy goal in itself, especially when we're talking consumer grade stuff.

wmf 15y ago
MITM is so trivial on Wi-Fi that protecting against passive sniffing but not MITM just provides a false sense of security. Fortunately there is some progress in this area: http://www.usenix.org/events/sec11/tech/full_papers/Gollakota.pdf http://www.usenix.org/events/sec11/tech/full_papers/Gollakot...

tomp 15y ago

That's really just another way of saying that users shouldn't connect to routers they do not trust. There's this new feature of SSH key generators, where the user is shown an ASCII art of the generated SSH key, to be able to visually remember and recognize it. A standardized graphical representation of certificates could be used to confirm the identity of the router. Imagine walking into Starbucks or any WiFi enabled place, you see a sign on the wall that gives you the network name and the "VisiSign", you connect to the router, your computer shows you the VisiSign of the router, and you can visually confirm the identity of the router.

icebraining 15y ago

Publish the key fingerprint visibly? Then at least savvy users could verify it.