6 ms·

Wireless networking is/has always had potential for infiltration. It is inherent since the signal is broadcast out without any regard to who is listening. This

Wireless networking is/has always had potential for infiltration. It is inherent since the signal is broadcast out without any regard to who is listening. This security flaw, using brute force, is a good, if slow, way to exploit the open nature of WiFi. They do not specify any timing for breaking a psk so I assume this isn't very fast. And the article doesn't state if the brute force can only be attempted while the back door is temporarily open. Security threat yes. How long to break, who knows. A great reason to use wired when you can!

sown 13y ago
I've wondered about using SSH socks proxy on my devices to help get around this. Even if they break WPA2 they'd deal with SSH traffic only. For example, it seems reasonable that I could have my laptop or phone use a ssh tunnel and it can only go to my wireless router. The router will only accept SSH traffic with a certificate and route traffic to an SSH somewhere on my wired network, or from the router itself. At work I do something similar. I setup a firefox profile (firefox -ProfileManager -no-remote) to use SOCKS proxy on some port and setup SSH to connect to an EC2 instance I have lying around (ssh -i cert.file ec2-user@ec2.machine -ND 8888). This way I can browse sort of in private. :p FYI: Some sites like craigslist or redfin reject ec2 traffic.
- noonespecial 13y ago
  This is a perfect use case for openvpn. I use it whenever I connect to a public wifi to spare me worrying about how secure it may or may not be.
- coreymgilmore 13y ago
  ssh is an interesting option. I had not thought of that. I would, rather, go VPN route though. It is east to use an open VPN service on a protected, but public, WiFi network.
- mdaniel 13y ago
  That's a great system, and I love that OpenSSH has a SOCKS proxy in it (and I make use of it quite a bit). I wanted to comment on your ec2 traffic observation and make you aware of Digital Ocean machines if you were not already aware. Not only are they inexpensive but D.O. offers quite a few egress points from their data centers. I also believe that their hosts have individual public IP addresses, which may help further reduce the chance of being blocked wholesale. Granted, the IP addresses are still clearly identifiable as D.O. machines, so if those services want to filter out "data center traffic" they still can but you might fly under the radar as compared to EC2 traffic.

sown 13y ago

I've wondered about using SSH socks proxy on my devices to help get around this. Even if they break WPA2 they'd deal with SSH traffic only. For example, it seems reasonable that I could have my laptop or phone use a ssh tunnel and it can only go to my wireless router. The router will only accept SSH traffic with a certificate and route traffic to an SSH somewhere on my wired network, or from the router itself. At work I do something similar. I setup a firefox profile (firefox -ProfileManager -no-remote) to use SOCKS proxy on some port and setup SSH to connect to an EC2 instance I have lying around (ssh -i cert.file ec2-user@ec2.machine -ND 8888). This way I can browse sort of in private. :p FYI: Some sites like craigslist or redfin reject ec2 traffic.

noonespecial 13y ago
This is a perfect use case for openvpn. I use it whenever I connect to a public wifi to spare me worrying about how secure it may or may not be.
coreymgilmore 13y ago
ssh is an interesting option. I had not thought of that. I would, rather, go VPN route though. It is east to use an open VPN service on a protected, but public, WiFi network.
mdaniel 13y ago
That's a great system, and I love that OpenSSH has a SOCKS proxy in it (and I make use of it quite a bit). I wanted to comment on your ec2 traffic observation and make you aware of Digital Ocean machines if you were not already aware. Not only are they inexpensive but D.O. offers quite a few egress points from their data centers. I also believe that their hosts have individual public IP addresses, which may help further reduce the chance of being blocked wholesale. Granted, the IP addresses are still clearly identifiable as D.O. machines, so if those services want to filter out "data center traffic" they still can but you might fly under the radar as compared to EC2 traffic.