3 ms·
Is there a reason for recommending an insecure network? Would suggesting a global default password for an encrypted network be better. It can be as simple as 'o
by jtokoph 12y ago
Is there a reason for recommending an insecure network? Would suggesting a global default password for an encrypted network be better. It can be as simple as 'openwireless'.
- majika 12y agoWhat would that protect against? The only use that I see for a standard-password approach is that it would circumvent some ISPs' terms of service that say you can't run an open network. But even then, a court may find that a closed network with a password like `openwireless` (i.e. as part of OpenWireless.org) is an "open network" anyway.
- jtokoph 12y agoUsing an open network without encryption allows a passerby to listen in to all of your traffic. Unfortunately not all websites are using SSL yet.
- mike_esspe 12y agoIf attacker knows network pre-shared key, and intercepted handshake, they can decrypt your traffic.
- jtokoph 12y agoI guess I should have read the comments on this post: http://steve.grc.com/2010/10/28/instant-hotspot-protection-from-firesheep/ http://steve.grc.com/2010/10/28/instant-hotspot-protection-f...
- tendom 12y agoNo, because you can set up a honeypot knowing this password, and then mirror your input to the sites you visit after I collect your information.
- GregorStocks 12y agoThat's possible without a password too, except that anybody in the area can MITM you instead of just people who bothered to set up honeypots. AFAIK WiFi only provides encryption on networks with a password.
- swinglock 12y agoHow isn't such a setup insecure?
- nodata 12y agoper-device (session?) keys.
- jrochkind1 12y agoUsing current standard consumer technology, it would have some security issues. That's why they say: > We're working with a coalition of volunteer engineers to build technologies that will let users open their wireless networks without compromising their security or sacrificing bandwidth. There are a variety of technological solutions possible, many of which could be implemented in firmware (see OpenWRT). I'd guess if we dig deeper on their website, we might get to their tech plans; I am not familiar with them specifically. Although, honestly, if you're counting on nobody being able to sniff your traffic in transit for security, you don't have enough security anyway. But still, yeah, I wouldn't want to make it that easy.
- chongli 12y agoThat's not a password, that's a shared private key. Encrypting everyone's traffic with the same private key provides no real security benefit at all.
- sp332 12y agoRight, this would avoid Google's argument that they can sniff unencrypted data from your wifi since it's being broadcast in the clear out into the street. At least having a per-session key would count as a legal defense against drive-by sniffers.