6 ms·

An IP address can be assigned to a person that can be held legally responsible easily enough, though.

Zirro 14y ago
Which raises the question often brought up in various forms: Is a person responsible if someone has been using his or her router for file-sharing because they were able to crack its WEP-encryption, while the accused in question hardly knows what a router is?
- jiggy2011 14y ago
  Most non tech people are just using an ISP provided router, every ISP that I know of provides a router with WPA2 and went around replacing old WEP routers a few years ago. I can't remember the last time a WEP network showed up on my smartphone. Of course there are other ways someone may have broken into your network.
  - gnaffle 14y ago
    Actually, many routers have easily predicable WPA2 passwords. Based on the MAC address or the access point name, it is often possible to deduce the default key (which many/most people don't change).
  - lgeek 14y ago
    Many APs have WPS implementations that can be trivially brute-forced and can't be disabled. Paper: http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf Open-source tool: http://code.google.com/p/reaver-wps/ http://code.google.com/p/reaver-wps/
  - tsahyt 14y ago
    It's not like WPA2 would be terribly secure either. One minute of googling directs you to a step-by-step tutorial using aircrack. WiFi is nice to have but one has to be aware of the security issues that arise with it.
    - jiggy2011 14y ago
      All of the WPA2 attacks I've seen assume predictable SSIDs and Passwords. Again , ISPs seem to be ahead of this. Looking in my local area most of the APs have names like "BThub543897534895" and I assume that the passwords are randomly generated.
      - tsahyt 14y ago
        aircrack-ng assumes pre-shared keys. Cracking long passwords is quite time-consuming (read: takes a VERY long time). They actually explicitly state that in their wiki. I'm not exactly sure but I think I read something about using GPUs to accelerate bruce-force times with a speedup of 100x. That's quite substantial, however even with that brute-forcing is not an option here, which gets us back to the fact that an attacker will hope for a weak password, possibly in a dictionary. You're right about ISPs being on the safe side with their SSIDs and passwords, but I think you're underestimating the users here. For the sake of it I've spent an hour and a half driving around town a year ago, logging locations of access points. I never did anything with the data except for looking at how access points are distributed across my town. Most of the AP names where common words or a combination of such. Concerning passwords, I've used wifi at friends and coworkers places quite a few times and most of them had weak passwords. An attacker might just go and do some wardriving and randomly attack access points and I believe he'll find one weak enough without much of a hassle. Bottom line it's the same as always: In the real world security isn't as depended on technology as it is on how much the user is concerned with it. How that works out in a lawsuit is a different question though.
jdietrich 14y ago
If someone cracks your WEP, are you responsible for what they do over your connection? If someone steals your car, are you responsible if they use it as the getaway car for a bank robbery?
- jiggy2011 14y ago
  I read something a while ago from an IP lawyer, he said that in such an occurrence they would instead just sue you for negligence. There don't seem to be many wireless LANs using WEP anymore anyway because of the obvious security flaws. Perhaps some grandma with an old router could get away with claiming ignorance as a defence but the average HN reader probably couldn't. As for the car analogy perhaps this would be similar to leaving your car unlocked knowing full well that it was likely to be stolen by criminals.
  - pavel_lishin 14y ago
    If I were to leave my car unlocked in a high-crime neighborhood, my insurance may turn me down, but I still would not be liable for any crimes the thieves committed while using my car. Then again, it's just an analogy, which holds little sway in a court of law.
  - smokeyj 14y ago
    An IP still isn't a person as your computer could be remotely controlled. Maybe grandma shouldn't have been so negligent when updating her Java package when a known zero day exists.. Expecting anyone besides a HN dork to know WEP is outdated shows how closed minded some of us are.
    - ben0x539 14y ago
      I agree with you in principle but I don't think legal doctrine in most countries where filesharing ligitation happens does. If your computer is compromised while used to torrent a movie, you'll have a hard time convincing a court of that ten months later.
    - jiggy2011 14y ago

Zirro 14y ago

Which raises the question often brought up in various forms: Is a person responsible if someone has been using his or her router for file-sharing because they were able to crack its WEP-encryption, while the accused in question hardly knows what a router is?

jiggy2011 14y ago
Most non tech people are just using an ISP provided router, every ISP that I know of provides a router with WPA2 and went around replacing old WEP routers a few years ago. I can't remember the last time a WEP network showed up on my smartphone. Of course there are other ways someone may have broken into your network.
- gnaffle 14y ago
  Actually, many routers have easily predicable WPA2 passwords. Based on the MAC address or the access point name, it is often possible to deduce the default key (which many/most people don't change).
- lgeek 14y ago
  Many APs have WPS implementations that can be trivially brute-forced and can't be disabled. Paper: http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf Open-source tool: http://code.google.com/p/reaver-wps/ http://code.google.com/p/reaver-wps/
- tsahyt 14y ago
  It's not like WPA2 would be terribly secure either. One minute of googling directs you to a step-by-step tutorial using aircrack. WiFi is nice to have but one has to be aware of the security issues that arise with it.
  - jiggy2011 14y ago
    All of the WPA2 attacks I've seen assume predictable SSIDs and Passwords. Again , ISPs seem to be ahead of this. Looking in my local area most of the APs have names like "BThub543897534895" and I assume that the passwords are randomly generated.
    - tsahyt 14y ago
      aircrack-ng assumes pre-shared keys. Cracking long passwords is quite time-consuming (read: takes a VERY long time). They actually explicitly state that in their wiki. I'm not exactly sure but I think I read something about using GPUs to accelerate bruce-force times with a speedup of 100x. That's quite substantial, however even with that brute-forcing is not an option here, which gets us back to the fact that an attacker will hope for a weak password, possibly in a dictionary. You're right about ISPs being on the safe side with their SSIDs and passwords, but I think you're underestimating the users here. For the sake of it I've spent an hour and a half driving around town a year ago, logging locations of access points. I never did anything with the data except for looking at how access points are distributed across my town. Most of the AP names where common words or a combination of such. Concerning passwords, I've used wifi at friends and coworkers places quite a few times and most of them had weak passwords. An attacker might just go and do some wardriving and randomly attack access points and I believe he'll find one weak enough without much of a hassle. Bottom line it's the same as always: In the real world security isn't as depended on technology as it is on how much the user is concerned with it. How that works out in a lawsuit is a different question though.

jdietrich 14y ago

If someone cracks your WEP, are you responsible for what they do over your connection? If someone steals your car, are you responsible if they use it as the getaway car for a bank robbery?

jiggy2011 14y ago
I read something a while ago from an IP lawyer, he said that in such an occurrence they would instead just sue you for negligence. There don't seem to be many wireless LANs using WEP anymore anyway because of the obvious security flaws. Perhaps some grandma with an old router could get away with claiming ignorance as a defence but the average HN reader probably couldn't. As for the car analogy perhaps this would be similar to leaving your car unlocked knowing full well that it was likely to be stolen by criminals.
- pavel_lishin 14y ago
  If I were to leave my car unlocked in a high-crime neighborhood, my insurance may turn me down, but I still would not be liable for any crimes the thieves committed while using my car. Then again, it's just an analogy, which holds little sway in a court of law.
- smokeyj 14y ago
  An IP still isn't a person as your computer could be remotely controlled. Maybe grandma shouldn't have been so negligent when updating her Java package when a known zero day exists.. Expecting anyone besides a HN dork to know WEP is outdated shows how closed minded some of us are.
  - ben0x539 14y ago
    I agree with you in principle but I don't think legal doctrine in most countries where filesharing ligitation happens does. If your computer is compromised while used to torrent a movie, you'll have a hard time convincing a court of that ten months later.
  - jiggy2011 14y ago