4 ms·
> When using this tool, it is good practice to hash the password for the wireless network before storing it in the configuration file (encrypt it in a way that
by asveikau 4y ago
> When using this tool, it is good practice to hash the password for the wireless network before storing it in the configuration file (encrypt it in a way that cannot be reversed).
This is bullshit. The device ultimately needs the wifi passcode in plaintext. What this person is asking for is obfuscation and cryptography theater, not real security.
Of course if you root the device you can read the wifi passcode. This is not shocking.
- nimih 4y ago> The device ultimately needs the wifi passcode in plaintext. Why is this the case? There are a number of cryptographic methods of varying complexity which allow a server to authenticate a client against a password without storing the password itself.
- asveikau 4y agoBecause if you had such a scheme it would no longer be wifi. WPA needs the device to have a key. You cannot replace WPA with your own key derivation scheme to avoid storing keys to keep this ridiculous statement in the blog post happy. Whatever scheme it is, it's probably compromised by rooting the device storing secrets... To make a reference to the quote used by Raymond Chen, the security flaw "rather involved being on the other side of this airtight hatchway".
- nimih 4y agoThat makes sense, thanks for clarifying.
- BenHays42 4y agoThe wpa_passphrase tool simply stores the raw hash used by WPA to authenticate to the AP. This is the behavior performed under the hood even when the plaintext is utilized. You could still reuse the stored hash to maintain the same level of access afforded by the plaintext passphrase, but wpa_passphrase isn't security theater or obfuscation.
- asveikau 4y agoIt doesn't gain you anything. Someone has that, they can use your wifi. The security hole, if there is one, is compromising the storage.