4 ms·

Woof, can we fix this once and for all? Changing protocols every couple years is exhausting.

by bprater 18y ago

pmjordan 18y ago
Realistically, I don't see a way other than strong, SSL-style crypto with private keys and AP certificates. I'd like to see a crypto expert analyse and write about RADIUS-authenticated WPA2 in a way us mortals can understand. My understanding is that it should be safe, but I'd like to hear about it from someone like Schneier. A lot of APs actually support RADIUS, but you do still need to set up your own RADIUS server somewhere on the network. I guess the open-source firmware available for some APs could help here. My current OpenVPN solution is actually pretty user-friendly - it doesn't "magically" connect as soon as my AP comes into range, but it is just one click to start. It's almost certainly possible to run the script from the event directly. The nice thing is that you can implement this now, and OpenVPN runs on Linux, OSX, Windows, probably the BSDs too. I also have an OpenVPN server that's accessible from the internet, which is handy to use from public wifi. I realise that it's not end-to-end encryption, but having my cookies etc. available to everyone around is just a little too scary.
- jcl 18y ago
  Of course, Schneier runs his wireless open, so he doesn't have this problem. http://www.schneier.com/blog/archives/2008/01/my_open_wireles.html http://www.schneier.com/blog/archives/2008/01/my_open_wirele...
  - pmjordan 18y ago
    With the US legal situation that might be feasible, but in some countries you can get yourself into pretty deep trouble. From what I remember, German law in particular makes this a really bad idea. (aside from the fact that cease-and-desists cost money in Germany) Austrian law is often quite close to the German counterpart so I'm not going to risk it, even though I strongly doubt anyone would try to leech my wifi around here. (mine is the only wifi signal I can detect, and we get about one car per hour on our road, so not exactly where it's at) EDIT: I'm no lawyer, and it's been a while since I read the articles on the topic, but the issue was effectively that you fall into one of two categories operating an open AP: - you get treated as an ISP. In that case I think you need to establish some kind of (implied or explicit) contractual relationship with your "customers" (paying or not) and are subject to various regulations. Hardly feasible. - everything your "users" do is your responsibility. I misremembered some of this stuff, and there are no doubt various subtleties I didn't go into. The subject was covered in various articles in the popular German c't magazine. http://www.heise.de/ct/ http://www.heise.de/ct/

Woof, can we fix this once and for all? Changing protocols every couple years is exhausting.

by bprater 18y ago

Woof, can we fix this once and for all? Changing protocols every couple years is exhausting.

Realistically, I don't see a way other than strong, SSL-style crypto with private keys and AP certificates. I'd like to see a crypto expert analyse and write about RADIUS-authenticated WPA2 in a way us mortals can understand. My understanding is that it should be safe, but I'd like to hear about it from someone like Schneier. A lot of APs actually support RADIUS, but you do still need to set up your own RADIUS server somewhere on the network. I guess the open-source firmware available for some APs could help here. My current OpenVPN solution is actually pretty user-friendly - it doesn't "magically" connect as soon as my AP comes into range, but it is just one click to start. It's almost certainly possible to run the script from the event directly. The nice thing is that you can implement this now, and OpenVPN runs on Linux, OSX, Windows, probably the BSDs too. I also have an OpenVPN server that's accessible from the internet, which is handy to use from public wifi. I realise that it's not end-to-end encryption, but having my cookies etc. available to everyone around is just a little too scary.

jcl 18y ago
Of course, Schneier runs his wireless open, so he doesn't have this problem. http://www.schneier.com/blog/archives/2008/01/my_open_wireles.html http://www.schneier.com/blog/archives/2008/01/my_open_wirele...
- pmjordan 18y ago
  With the US legal situation that might be feasible, but in some countries you can get yourself into pretty deep trouble. From what I remember, German law in particular makes this a really bad idea. (aside from the fact that cease-and-desists cost money in Germany) Austrian law is often quite close to the German counterpart so I'm not going to risk it, even though I strongly doubt anyone would try to leech my wifi around here. (mine is the only wifi signal I can detect, and we get about one car per hour on our road, so not exactly where it's at) EDIT: I'm no lawyer, and it's been a while since I read the articles on the topic, but the issue was effectively that you fall into one of two categories operating an open AP: - you get treated as an ISP. In that case I think you need to establish some kind of (implied or explicit) contractual relationship with your "customers" (paying or not) and are subject to various regulations. Hardly feasible. - everything your "users" do is your responsibility. I misremembered some of this stuff, and there are no doubt various subtleties I didn't go into. The subject was covered in various articles in the popular German c't magazine. http://www.heise.de/ct/ http://www.heise.de/ct/