3 ms·

> “The question that we posed ourselves was, ‘What do we do now?’” says Carlos Cordeiro, [...] Uh, Wi-Fi security still sucks. Can we fix that?

mschuster91 3y ago
Does it? My only gripe is that for whatever goddamn reason Android isn't able to detect what specific subset of WPA2 Enterprise config the AP actually wants/supports and the UI seems to constantly change around over the years, a common annoyance in large campus networks where the admins don't stay on top.
- cryptonector 3y ago
  Yes: I still don't have an easy way to authenticate the network I'm joining. All I have is an SSID name but no public key or fingerprint thereof with which to authenticate the network. When I go to someone's home it'd be nice if they could post a QR code for their guest Wi-Fi network and all I'd have to do is scan it to join it. Plus a QR code could elide the need for a password.
  - lxgr 3y ago
    > Yes: I still don't have an easy way to authenticate the network I'm joining. PSK authentication works both ways. If the network does not know your entered passphrase, your device won't connect to it. The same is true for some (but not all) WPA enterprise EAP authentication methods (EAP-PWD uses it, for example); others do use public key certificates (like anything based on EAP-TTLS/EAP-PEAP). In case of EAP-PEAP-MPSCHAPv2 you even get both.
    - cryptonector 3y ago
      > PSK authentication works both ways. Yes, but the PSK is shared so... > others do use public key certificates What's needed is a mechanism for learning those. That's where the QR code thing comes in.
  - mschuster91 3y ago
    > I still don't have an easy way to authenticate the network I'm joining. If you're using WPA-Enterprise, yes you can - you need to roll out your own SSL PKI though, and almost no consumer-grade APs support it. > When I go to someone's home it'd be nice if they could post a QR code for their guest Wi-Fi network and all I'd have to do is scan it to join it. Plus a QR code could elide the need for a password. That has been a thing for years [1], if you need a generator you can use [2]. [1] https://github.com/zxing/zxing/wiki/Barcode-Contents#wi-fi-network-config-android-ios-11 https://github.com/zxing/zxing/wiki/Barcode-Contents#wi-fi-n... [2] https://qifi.org/ https://qifi.org/
    - cryptonector 3y ago
      Oh nice! TIL. THANK YOU.
transpute 3y ago
Wi-Fi 7 access point firmware vendors could choose to implement optional per-client passphrases, VLANs and device identity for access and traffic control. OSS reference code is available from https://github.com/spr-networks/super https://github.com/spr-networks/super. Wi-Fi 7 Sensing (802.11bf) of humans can measure breathing rate, keystroke typing, position and motion, from outside the walls of homes and business. What's the relationship between human biometric recognition and security?
- cryptonector 3y ago
  > What's the relationship between human biometric recognition and security? Biometrics are great for identification, not so much for authentication.
throw0101b 3y ago
See IEEE 802.11bh Randomized and Changing MAC Addresses and IEEE 802.11bi Enhanced Data Privacy: * https://standards.ieee.org/beyond-standards/data-privacy-and-ease-of-use-in-wireless-networks/ https://standards.ieee.org/beyond-standards/data-privacy-and... * https://datatracker.ietf.org/meeting/112/materials/slides-112-madinas-ieee-80211bhbi-update-01 https://datatracker.ietf.org/meeting/112/materials/slides-11...

mschuster91 3y ago

Does it? My only gripe is that for whatever goddamn reason Android isn't able to detect what specific subset of WPA2 Enterprise config the AP actually wants/supports and the UI seems to constantly change around over the years, a common annoyance in large campus networks where the admins don't stay on top.

cryptonector 3y ago
Yes: I still don't have an easy way to authenticate the network I'm joining. All I have is an SSID name but no public key or fingerprint thereof with which to authenticate the network. When I go to someone's home it'd be nice if they could post a QR code for their guest Wi-Fi network and all I'd have to do is scan it to join it. Plus a QR code could elide the need for a password.
- lxgr 3y ago
  > Yes: I still don't have an easy way to authenticate the network I'm joining. PSK authentication works both ways. If the network does not know your entered passphrase, your device won't connect to it. The same is true for some (but not all) WPA enterprise EAP authentication methods (EAP-PWD uses it, for example); others do use public key certificates (like anything based on EAP-TTLS/EAP-PEAP). In case of EAP-PEAP-MPSCHAPv2 you even get both.
  - cryptonector 3y ago
    > PSK authentication works both ways. Yes, but the PSK is shared so... > others do use public key certificates What's needed is a mechanism for learning those. That's where the QR code thing comes in.
- mschuster91 3y ago
  > I still don't have an easy way to authenticate the network I'm joining. If you're using WPA-Enterprise, yes you can - you need to roll out your own SSL PKI though, and almost no consumer-grade APs support it. > When I go to someone's home it'd be nice if they could post a QR code for their guest Wi-Fi network and all I'd have to do is scan it to join it. Plus a QR code could elide the need for a password. That has been a thing for years [1], if you need a generator you can use [2]. [1] https://github.com/zxing/zxing/wiki/Barcode-Contents#wi-fi-network-config-android-ios-11 https://github.com/zxing/zxing/wiki/Barcode-Contents#wi-fi-n... [2] https://qifi.org/ https://qifi.org/
  - cryptonector 3y ago
    Oh nice! TIL. THANK YOU.

transpute 3y ago

Wi-Fi 7 access point firmware vendors could choose to implement optional per-client passphrases, VLANs and device identity for access and traffic control. OSS reference code is available from https://github.com/spr-networks/super https://github.com/spr-networks/super. Wi-Fi 7 Sensing (802.11bf) of humans can measure breathing rate, keystroke typing, position and motion, from outside the walls of homes and business. What's the relationship between human biometric recognition and security?

cryptonector 3y ago
> What's the relationship between human biometric recognition and security? Biometrics are great for identification, not so much for authentication.

throw0101b 3y ago

See IEEE 802.11bh Randomized and Changing MAC Addresses and IEEE 802.11bi Enhanced Data Privacy: * https://standards.ieee.org/beyond-standards/data-privacy-and-ease-of-use-in-wireless-networks/ https://standards.ieee.org/beyond-standards/data-privacy-and... * https://datatracker.ietf.org/meeting/112/materials/slides-112-madinas-ieee-80211bhbi-update-01 https://datatracker.ietf.org/meeting/112/materials/slides-11...