13 ms·

Google Ordered To Teach America How To Put Passwords On Wi-Fi Networks

24 points by shawnee_ 14y ago

faet 14y ago
> Google is going to teach naive people how to put passwords on their Wi-Fi networks. Good luck with that. Setting up passwords varies between different routers. So what may work in their ad may not work for grandpa down the road. Telling manufacturers to set a wifi password by default would probably do more to secure people.
- gcr 14y ago
  Many newer routers come with a "first setup" page that forces you to pick a wifi password. http://portforward.com/ http://portforward.com/ exists to help people set up port forwarding, so it is possible to do something similar for passwords.
- dmiladinov 14y ago
  Setting wifi passwords would be a good start, but then you'd still have to address the security flaws in wps[1] and upnp[2][pdf]. [1]: http://code.google.com/p/reaver-wps/ http://code.google.com/p/reaver-wps/ [2]: https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf https://community.rapid7.com/servlet/JiveServlet/download/21...
  - cbhl 14y ago
    Well, it doesn't need to be secure _per se_, just secure enough that it mitigates Google's liability. Like the password/PIN rules at the bank.
- justincormack 14y ago
  They are probably hoping Google create a router.
marssaxman 14y ago
> to instruct Americans not to let neighbors free-ride on their Wi-Fi networks This is such a weirdly negative framing. What's wrong with sharing? I've always left my wifi routers open and unsecured so my neighbors can use the bandwidth if they want.
- burntsushi 14y ago
  > What's wrong with sharing? A few things. Some of these things can be mitigated, but I think then we've moved beyond simple sharing. 1. Your neighbor could use too much bandwidth, thereby impacting your usage negatively. 2. Your neighbor could do naughty things on your Internet connection, and you'll be held liable. Practically, this might mean getting a bunch of DMCA notices. For some ISPs, this has a real impact on your account. 3. Many applications by default share their data with whoever is on your network. Maybe this is OK, but maybe it has stuff that you'd rather your neighbors did not see. To clarify, I think sharing is great if you decide to do it. But I also think that the uninformed should be advised to not share by default because of the issues I mentioned above.
  - marssaxman 14y ago
    Of course those things are possible in theory, but I've been doing this for 14 years and nothing bad has ever happened. I don't believe that it's as big a deal as people make it out to be.
    - cbhl 14y ago
      The question is whether you trust your neighbors enough. If you live near a post-secondary institution, say, you might not be willing to leave your network that open.
  - crististm 14y ago
    1. This is not necessarily wrong. Maybe I set it up so he can use all the bandwidth that he can get 2. Why is only the penultimate hop responsible for the last hop? Why should he be responsible in the first place? And why shouldn't all the network hops in-between be responsible as well??? 3.Yes, it is OK "Link sharing" is OK regardless of your decision whether to share or not. Don't blame the technology man.
baltimore 14y ago
Aren't two issues being conflated here? (1) Securing access to your wi-fi with a password so that your neighbor can't free-ride on your ISP and (2) Encrypting your wi-fi traffic so that your neighbor (or Google) can't spy on you.
- pdonis 14y ago
  Conceptually, yes, these are two different issues. But since wifi security pretty much requires encryption of the traffic (otherwise anyone could just sniff your credentials during the access negotiation), and encryption requires some sort of access control anyway, they always go together in practice.
drzaiusapelord 14y ago
What a bullshit case, judgement, and punishment. Unencrypted wifi should be collectable. Don't broadcast in the plain on a public channel if you want some special level of privacy. This is an incredible case and probably not politically worth the fight for google. All of our rights have been limited by this judgement.
- g8oz 14y ago
  But most unencrypted wifi exists because of tech illiteracy/laziness on the part of users. Its not a conscious choice they made. Commercial collection is exploiting this. Finally your last sentence is unnecessarily hyperbolic.
  - drzaiusapelord 14y ago
    Generally, it isnt the job of the state to protect the ignorant and the lazy. Sorry, but this kind of precedent is going to lead to even more draconian judgements over "computer trespassing" and "hacking." Computer crime laws aren't reasonable as-is and now with this new case law, they're arguably worse. The ISM band exists within strict FCC control. There is no "don't sniff" provision and if there was, it would make promiscuous mode or applications like inssider illegal.
    - shardling 14y ago
      It is exactly the job of the state, because the ignorant do not know how to protect themselves, or even that they are ignorant. I dare say that every day you are protected by the state from those who would take advantage of your ignorance in many, many aspects of the world. The system works well enough that you don't even notice what you're ignorant of!
      - JagMicker 14y ago
        So, by that logic, the "state" is obligated to provide security to homeowners who can not be bothered to lock their homes?
zem 14y ago
schneier on open wifi networks (he's for them): http://www.schneier.com/blog/archives/2011/04/security_risks_7.html http://www.schneier.com/blog/archives/2011/04/security_risks...
- pdonis 14y ago
  I normally agree with Schneier, but I think he's wrong on this one. Basically his argument is that, rather than try to secure your wifi, you should just leave it open and make sure your personal computers are secure enough to be used on an open network. He points out that, if you use your laptop on public networks, you have to secure it anyway, so there's no additional risk to having your home wifi basically be a public network. All that may be true (though I would argue that, since you use your home connection a lot more than any other, your risk exposure is much greater and therefore it makes sense to have a layered defense there), but it completely misses the point that you are responsible to your ISP for how your internet connection gets used. Starbuck's may be able to say "look, we're a public place, we can't possibly control everything that everybody does on our wifi", and get away with just making people check an "I agree to your terms of use" box when they connect to their wifi. You, as a home user, are not likely to get away with that. Schneier also says this: "if someone did commit a crime using my network the police might visit, but what better defense is there than the fact that I have an open wireless network? If I enabled wireless security on my network and someone hacked it, I would have a far harder time proving my innocence." This seems backwards to me: if you have enabled wireless security, you know exactly who you have authorized access to--it's whoever you gave your passphrase to. So it's easy to distinguish authorized from unauthorized use. If you leave your wifi open and someone uses it for something nefarious, how can you defend yourself? You're still liable for the use of your internet connection, and you can't say the use was unauthorized because, well, you left your wifi open for anyone to use.
  - crististm 14y ago
    "You, as a home user, are not likely to get away with that." His point is that you _should_ be able to get away with that. Precisely because there is no difference between an open network and a cracked one!!!
snowwrestler 14y ago
I would like to propose that we, as technologically literate people, start to separate the concepts of encrypting your WiFi signal, and sharing your WiFi signal. Encryption has true security benefits, primarily the prevention of HTTP session hijacks via tools like Firesheep. You can still share your network by simply putting the password in the SSID. Name your network "Password is 12345" or something. Encryption protects against Firesheep even if everyone knows the password.
- MichaelGG 14y ago
  Are you sure about that? How does that possibly work? If the shared secret is known, how can you possibly prevent people from hijacking the connection?
  - jessaustin 14y ago
    Both the AP and the client station produce nonces, which together with the passphrase and other values are used to calculate "pairwise" keys and eventually session keys. This makes hijacking more difficult. As you intuit, however, it can certainly be done by one who knows the passphrase and is able to sniff the nonces.
- ajasmin 14y ago
  Unfortunately, there's no widely supported way of encrypting the traffic of individual users on a publicly accessible network. WiFi is designed to trust everyone on the LAN/subnet. But LANs are not secure. People roam between networks all the time. I have around 20 WiFi networks saved on my smartphone right now. Sadly, people are trained to password protect their WiFi these days. Other than security issues, bandwidth caps and the risk of being held accountable for your internet connections are of concern to a lot of people.

24 points by shawnee_ 14y ago

faet 14y ago

> Google is going to teach naive people how to put passwords on their Wi-Fi networks. Good luck with that. Setting up passwords varies between different routers. So what may work in their ad may not work for grandpa down the road. Telling manufacturers to set a wifi password by default would probably do more to secure people.

gcr 14y ago
Many newer routers come with a "first setup" page that forces you to pick a wifi password. http://portforward.com/ http://portforward.com/ exists to help people set up port forwarding, so it is possible to do something similar for passwords.
dmiladinov 14y ago
Setting wifi passwords would be a good start, but then you'd still have to address the security flaws in wps[1] and upnp[2][pdf]. [1]: http://code.google.com/p/reaver-wps/ http://code.google.com/p/reaver-wps/ [2]: https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf https://community.rapid7.com/servlet/JiveServlet/download/21...
- cbhl 14y ago
  Well, it doesn't need to be secure _per se_, just secure enough that it mitigates Google's liability. Like the password/PIN rules at the bank.
justincormack 14y ago
They are probably hoping Google create a router.

marssaxman 14y ago

> to instruct Americans not to let neighbors free-ride on their Wi-Fi networks This is such a weirdly negative framing. What's wrong with sharing? I've always left my wifi routers open and unsecured so my neighbors can use the bandwidth if they want.

burntsushi 14y ago
> What's wrong with sharing? A few things. Some of these things can be mitigated, but I think then we've moved beyond simple sharing. 1. Your neighbor could use too much bandwidth, thereby impacting your usage negatively. 2. Your neighbor could do naughty things on your Internet connection, and you'll be held liable. Practically, this might mean getting a bunch of DMCA notices. For some ISPs, this has a real impact on your account. 3. Many applications by default share their data with whoever is on your network. Maybe this is OK, but maybe it has stuff that you'd rather your neighbors did not see. To clarify, I think sharing is great if you decide to do it. But I also think that the uninformed should be advised to not share by default because of the issues I mentioned above.
- marssaxman 14y ago
  Of course those things are possible in theory, but I've been doing this for 14 years and nothing bad has ever happened. I don't believe that it's as big a deal as people make it out to be.
  - cbhl 14y ago
    The question is whether you trust your neighbors enough. If you live near a post-secondary institution, say, you might not be willing to leave your network that open.
- crististm 14y ago
  1. This is not necessarily wrong. Maybe I set it up so he can use all the bandwidth that he can get 2. Why is only the penultimate hop responsible for the last hop? Why should he be responsible in the first place? And why shouldn't all the network hops in-between be responsible as well??? 3.Yes, it is OK "Link sharing" is OK regardless of your decision whether to share or not. Don't blame the technology man.

baltimore 14y ago

Aren't two issues being conflated here? (1) Securing access to your wi-fi with a password so that your neighbor can't free-ride on your ISP and (2) Encrypting your wi-fi traffic so that your neighbor (or Google) can't spy on you.

pdonis 14y ago
Conceptually, yes, these are two different issues. But since wifi security pretty much requires encryption of the traffic (otherwise anyone could just sniff your credentials during the access negotiation), and encryption requires some sort of access control anyway, they always go together in practice.

drzaiusapelord 14y ago

What a bullshit case, judgement, and punishment. Unencrypted wifi should be collectable. Don't broadcast in the plain on a public channel if you want some special level of privacy. This is an incredible case and probably not politically worth the fight for google. All of our rights have been limited by this judgement.

g8oz 14y ago
But most unencrypted wifi exists because of tech illiteracy/laziness on the part of users. Its not a conscious choice they made. Commercial collection is exploiting this. Finally your last sentence is unnecessarily hyperbolic.
- drzaiusapelord 14y ago
  Generally, it isnt the job of the state to protect the ignorant and the lazy. Sorry, but this kind of precedent is going to lead to even more draconian judgements over "computer trespassing" and "hacking." Computer crime laws aren't reasonable as-is and now with this new case law, they're arguably worse. The ISM band exists within strict FCC control. There is no "don't sniff" provision and if there was, it would make promiscuous mode or applications like inssider illegal.
  - shardling 14y ago
    It is exactly the job of the state, because the ignorant do not know how to protect themselves, or even that they are ignorant. I dare say that every day you are protected by the state from those who would take advantage of your ignorance in many, many aspects of the world. The system works well enough that you don't even notice what you're ignorant of!
    - JagMicker 14y ago
      So, by that logic, the "state" is obligated to provide security to homeowners who can not be bothered to lock their homes?

zem 14y ago

schneier on open wifi networks (he's for them): http://www.schneier.com/blog/archives/2011/04/security_risks_7.html http://www.schneier.com/blog/archives/2011/04/security_risks...

pdonis 14y ago
I normally agree with Schneier, but I think he's wrong on this one. Basically his argument is that, rather than try to secure your wifi, you should just leave it open and make sure your personal computers are secure enough to be used on an open network. He points out that, if you use your laptop on public networks, you have to secure it anyway, so there's no additional risk to having your home wifi basically be a public network. All that may be true (though I would argue that, since you use your home connection a lot more than any other, your risk exposure is much greater and therefore it makes sense to have a layered defense there), but it completely misses the point that you are responsible to your ISP for how your internet connection gets used. Starbuck's may be able to say "look, we're a public place, we can't possibly control everything that everybody does on our wifi", and get away with just making people check an "I agree to your terms of use" box when they connect to their wifi. You, as a home user, are not likely to get away with that. Schneier also says this: "if someone did commit a crime using my network the police might visit, but what better defense is there than the fact that I have an open wireless network? If I enabled wireless security on my network and someone hacked it, I would have a far harder time proving my innocence." This seems backwards to me: if you have enabled wireless security, you know exactly who you have authorized access to--it's whoever you gave your passphrase to. So it's easy to distinguish authorized from unauthorized use. If you leave your wifi open and someone uses it for something nefarious, how can you defend yourself? You're still liable for the use of your internet connection, and you can't say the use was unauthorized because, well, you left your wifi open for anyone to use.
- crististm 14y ago
  "You, as a home user, are not likely to get away with that." His point is that you _should_ be able to get away with that. Precisely because there is no difference between an open network and a cracked one!!!

snowwrestler 14y ago

I would like to propose that we, as technologically literate people, start to separate the concepts of encrypting your WiFi signal, and sharing your WiFi signal. Encryption has true security benefits, primarily the prevention of HTTP session hijacks via tools like Firesheep. You can still share your network by simply putting the password in the SSID. Name your network "Password is 12345" or something. Encryption protects against Firesheep even if everyone knows the password.

MichaelGG 14y ago
Are you sure about that? How does that possibly work? If the shared secret is known, how can you possibly prevent people from hijacking the connection?
- jessaustin 14y ago
  Both the AP and the client station produce nonces, which together with the passphrase and other values are used to calculate "pairwise" keys and eventually session keys. This makes hijacking more difficult. As you intuit, however, it can certainly be done by one who knows the passphrase and is able to sniff the nonces.
ajasmin 14y ago
Unfortunately, there's no widely supported way of encrypting the traffic of individual users on a publicly accessible network. WiFi is designed to trust everyone on the LAN/subnet. But LANs are not secure. People roam between networks all the time. I have around 20 WiFi networks saved on my smartphone right now. Sadly, people are trained to password protect their WiFi these days. Other than security issues, bandwidth caps and the risk of being held accountable for your internet connections are of concern to a lot of people.