6 ms·

When addressing various physical home security issues, I came to the realization that if a trained team of attackers equipped with body armor and night vision b

When addressing various physical home security issues, I came to the realization that if a trained team of attackers equipped with body armor and night vision broke into my home, the issue escalated beyond anything I could sensibly prepare for. The article reminded me of that. If someone attacks my home wifi with network sniffing hardware, sophisticated password guessing tools, hours of planning and execution, etc then, well, the issue escalated beyond anything I could sensibly prepare for. I realize these computing tools are easy to come by and not terribly hard to use. Ditto body armor, night vision, and combat training. And if someone is inclined to apply them against my pathetic existence, I'm screwed. Planning for such events is pretty pointless, I have other things to do.

brigade 14y ago
A physical assault carries a high chance of being noticed, and unless carried out by law enforcement, a significant chance of being punished with jail time. So it's not something that has a high chance of happening. Additionally, it's hard to defend against, and you definitely don't want to defend against a SWAT team. Whereas a bored teenage neighbor could attack your wireless network with a very small chance of being detected. Or with a sensitive directional antenna it doesn't even have to be your neighbor if the goal is just to sniff traffic. Plus, the only cost to you in defending against this attack is entering a more complex password on new devices. Stick a note on the fridge or choose a phrase.
- SiVal 14y ago
  I'm no security expert, but after I saw each new wifi password standard cracked within days of its release, I stopped passwording my wifi and used a little script I put on a home linux server to watch the router and if it spotted any unrecognized MAC addresses getting an IP address from DHCP, it would throw them out within a few seconds. These days, I just turn on the MAC address filter that's built in to most wifi base stations. Now, unless I've manually entered your MAC address into my whitelist, my router won't connect you. My wifi shows up as "open" to any machine that passes by, yet it won't connect. Many (most?) of you know more about security than I do. How secure is the MAC address whitelist approach compared to a password approach?
  - archon 14y ago
    I'm chagrined to admit that this simple approach didn't even occur to me. I'm interested as well; are there any disadvantages to this?
    - rcxdude 14y ago
      It's a terrible way to secure a network. MAC addresses are easily spoofed, and without encryption anyone can sniff your traffic anyway. Even using WEP is better since then there's (usually) a requirement to see a connected client for longer than a few seconds in order to break the encryption. The only reasonable approach for a home network imo in practice is WPA2 PSK with a decent password.
    - ctdonath 14y ago
      Convenience. Easier to give a visitor a password than get the device's MAC address and enter it into the router's whitelist.
  - EvilTerran 14y ago
    Someone's said in the Ars Technica comments that MAC addresses are freely available in the packets-in-flight, and MACs are spoofable, so MAC filtering will only deter the casual, passing wifi-borrower, not anyone actually determined to gain access.
    - nollidge 14y ago
      > MAC filtering will only deter the casual, passing wifi-borrower, not anyone actually determined to gain access. Isn't that true of WPA and WPA2 though also?
      - rcxdude 14y ago
        WPA2 is as strong as the password used on it, so it can easily be strong enough to deter any attacker from that perspective.
      - EvilTerran 14y ago
- ctdonath 14y ago
  a bored teenage neighbor could attack your wireless network He would have to be very bored indeed. Singling out my home to spend considerable time at an inconvenient in-range location to crack passwords to access ... what, exactly? view pictures of my toddlers? copy my slightly deranged music collection? If he's looking for free network access, he can go down the street and get it from McDonalds or Starbucks or wherever while sitting in a comfortable chair sipping a soda. I realize a bored teen is different from a SWAT team. Both, however, would need unusual motivation to turn their talents on my abode.
Dylan16807 14y ago
>network sniffing hardware a large fraction of normal wifi devices that can be set into a proper receiving mode >sophisticated password guessing tools some password cracker they downloaded in minutes >hours of planning pressing a button or typing a couple commands >and execution taking a nap It's not hard to secure a network from extremely simple attacks. At least for now. And that analogy is nonsense. Body armor, night vision, combat training don't help them break into a house. At best it'll get them past the armed guards you don't even have.
- ctdonath 14y ago
  The analogy is fine. Walk into a well stocked military surplus store and you can walk out with all the tools you need to break into a house in short order, and trust me it doesn't take long to learn how to use them well enough. The point is that once someone is determined enough to get into either your home or network, it doesn't take much to reach a stage where the owner has to go to great lengths to resist a very unlikely occurring, but very likely successful, attack.
  - hef19898 14y ago
    Like locks at doors, only meant to desuade the random amateur. Given enough dedtermination, preparation, tools and skills one can enter anything. But since I'm not the Pentagon I don't live in nuclear bunkers and don't employ regiments of cybersecurity people. I uess the risk of being cracked by pros is just part of the normal risk of live.
  - Dylan16807 14y ago
    My point is that you don't need any tools to break into a house. Kick in a door or throw a rock through a window. That is why the analogy is bad. Someone has to be very determined at breaking in to buy all those things. Someone has to be very determined to break into a secured network. But someone does not have to be determined to break into the average house. And they do not have to be determined to break into a network that is misconfigured. Using WPA2 with a long password and turning off WDS makes a network safe from direct attack.

brigade 14y ago

A physical assault carries a high chance of being noticed, and unless carried out by law enforcement, a significant chance of being punished with jail time. So it's not something that has a high chance of happening. Additionally, it's hard to defend against, and you definitely don't want to defend against a SWAT team. Whereas a bored teenage neighbor could attack your wireless network with a very small chance of being detected. Or with a sensitive directional antenna it doesn't even have to be your neighbor if the goal is just to sniff traffic. Plus, the only cost to you in defending against this attack is entering a more complex password on new devices. Stick a note on the fridge or choose a phrase.

SiVal 14y ago
I'm no security expert, but after I saw each new wifi password standard cracked within days of its release, I stopped passwording my wifi and used a little script I put on a home linux server to watch the router and if it spotted any unrecognized MAC addresses getting an IP address from DHCP, it would throw them out within a few seconds. These days, I just turn on the MAC address filter that's built in to most wifi base stations. Now, unless I've manually entered your MAC address into my whitelist, my router won't connect you. My wifi shows up as "open" to any machine that passes by, yet it won't connect. Many (most?) of you know more about security than I do. How secure is the MAC address whitelist approach compared to a password approach?
- archon 14y ago
  I'm chagrined to admit that this simple approach didn't even occur to me. I'm interested as well; are there any disadvantages to this?
  - rcxdude 14y ago
    It's a terrible way to secure a network. MAC addresses are easily spoofed, and without encryption anyone can sniff your traffic anyway. Even using WEP is better since then there's (usually) a requirement to see a connected client for longer than a few seconds in order to break the encryption. The only reasonable approach for a home network imo in practice is WPA2 PSK with a decent password.
  - ctdonath 14y ago
    Convenience. Easier to give a visitor a password than get the device's MAC address and enter it into the router's whitelist.
- EvilTerran 14y ago
  Someone's said in the Ars Technica comments that MAC addresses are freely available in the packets-in-flight, and MACs are spoofable, so MAC filtering will only deter the casual, passing wifi-borrower, not anyone actually determined to gain access.
  - nollidge 14y ago
    > MAC filtering will only deter the casual, passing wifi-borrower, not anyone actually determined to gain access. Isn't that true of WPA and WPA2 though also?
    - rcxdude 14y ago
      WPA2 is as strong as the password used on it, so it can easily be strong enough to deter any attacker from that perspective.
    - EvilTerran 14y ago
ctdonath 14y ago
a bored teenage neighbor could attack your wireless network He would have to be very bored indeed. Singling out my home to spend considerable time at an inconvenient in-range location to crack passwords to access ... what, exactly? view pictures of my toddlers? copy my slightly deranged music collection? If he's looking for free network access, he can go down the street and get it from McDonalds or Starbucks or wherever while sitting in a comfortable chair sipping a soda. I realize a bored teen is different from a SWAT team. Both, however, would need unusual motivation to turn their talents on my abode.

Dylan16807 14y ago

>network sniffing hardware a large fraction of normal wifi devices that can be set into a proper receiving mode >sophisticated password guessing tools some password cracker they downloaded in minutes >hours of planning pressing a button or typing a couple commands >and execution taking a nap It's not hard to secure a network from extremely simple attacks. At least for now. And that analogy is nonsense. Body armor, night vision, combat training don't help them break into a house. At best it'll get them past the armed guards you don't even have.

ctdonath 14y ago
The analogy is fine. Walk into a well stocked military surplus store and you can walk out with all the tools you need to break into a house in short order, and trust me it doesn't take long to learn how to use them well enough. The point is that once someone is determined enough to get into either your home or network, it doesn't take much to reach a stage where the owner has to go to great lengths to resist a very unlikely occurring, but very likely successful, attack.
- hef19898 14y ago
  Like locks at doors, only meant to desuade the random amateur. Given enough dedtermination, preparation, tools and skills one can enter anything. But since I'm not the Pentagon I don't live in nuclear bunkers and don't employ regiments of cybersecurity people. I uess the risk of being cracked by pros is just part of the normal risk of live.
- Dylan16807 14y ago
  My point is that you don't need any tools to break into a house. Kick in a door or throw a rock through a window. That is why the analogy is bad. Someone has to be very determined at breaking in to buy all those things. Someone has to be very determined to break into a secured network. But someone does not have to be determined to break into the average house. And they do not have to be determined to break into a network that is misconfigured. Using WPA2 with a long password and turning off WDS makes a network safe from direct attack.