3 ms·
Only if the WiFi network is password-protected, which causes connections to be encrypted. Pretty much all WiFi is password-protected nowadays -- if a cafe wants
by eurleif 2y ago
Only if the WiFi network is password-protected, which causes connections to be encrypted. Pretty much all WiFi is password-protected nowadays -- if a cafe wants to enable public access to their WiFi, they'll write the password on the wall -- but that only became the case after Firesheep and other sniffing tools drew attention to this issue around 2010. In the old days, there were plenty of networks with no password (and hence, no encryption) at all.
The GP specified "without cryptography", in reference to a counterfactual world where we weren't allowed to encrypt things.
- quietbritishjim 2y agoAh ok. I thought they were referring back to SSL in their first paragraph. Interesting, I had forgotten that WiFi networks once didn't all have passwords.
- DaiPlusPlus 2y ago> Pretty much all WiFi is password-protected nowadays I was at Disneyland last week and stayed at one of their hotels - and all the guest Wi-Fi networks were passwordless and therefore insecure. Ditto the free WiFi at the airports at both ends; oh, and the in-flight Wi-Fi too. While walking around the park my iPhone listed a bunch of passwordless mobile hotspots too. Are you thinking of captive-portals with logins/passwords? (E.g. Mariott/Hilton “Enter your room-number and last-name” portals) - I assume you’re aware that’s only used to authenticate after the WiFi connection is already established? ——— (I really hope that I’m wrong on this; but I’m not aware of any modern wifi standards that address this…. Of course, corp/edu networks can just use RADIUS or a client-certificate (which works on wired networks too). Also, it’s surprising we still haven’t figured out getting TLS to work with home-user-grade routers’ control-panels…
- kortilla 2y ago> Pretty much all WiFi is password-protected nowadays This is absolutely not true in the US. All major hotel chains have no encryption, airports do not, Starbucks doesn’t, etc. It’s usually small businesses that opt for a WPA pass phrase because that’s easier to setup than the captive portal nonsense that all of the big companies use.
- _yb2s 2y agoAren’t they still just encrypted against the password itself? So if it is a public place like a coffee shop with a known password, anyone can decrypt the data?
- SAI_Peregrinus 2y agoNo, the password just allows key exchange to start. Every client has its own session key.
- _yb2s 2y agoIt appears that in practice this isn't implemented well and there are tools like Wireshark that let you intercept data from other users on WPA.