3 ms·

This doesn't seem like it will be too much of a practical problem. As said in the article, YikYak is mostly used on university campuses and odds are if a studen

by stryan 12y ago

This doesn't seem like it will be too much of a practical problem. As said in the article, YikYak is mostly used on university campuses and odds are if a student is on campus they would be connected to the university wifi. From personal experience most university's use some form of WPA2-Enterprise authentication which which wireshark can't decrypt.

saidajigumi 12y ago
> As said in the article, YikYak is mostly used on university campuses University campuses, where students are constantly using the free WiFi in cafes, are on private WiFi networks shared with friends, etc. Even if the University's own WiFi was magically invulnerable, there will be many associated venues ready for use of this exploit.
- pyre 12y ago
  1. Setup an open access point in the middle of campus. 2. Give it a default name (e.g. 'linksys'). 3. Capture packets. 4. Profit.
  - scandinavian 12y ago
    There is no profit though, no one uses YikYak for posting anything remotely important.
    - TazeTSchnitzel 12y ago
      Ehh, people sometimes post embarassing/hateful things on YikYak, being able to out them would be a problem.
      - btown 12y ago
        Or to blackmail them so you don't reveal their identity.
    - smt88 12y ago
      An app should not be considered "secure" because it doesn't currently have important data. Twitter wasn't much of a honeypot, either, until activists and corporations started using it. Did Twitter know the exact moment that happened? No. They should have been secure long before that.
    - pyre 12y ago
      Don't take it so literally. In this case "profit" is just synonym for "goal". See: http://knowyourmeme.com/memes/profit http://knowyourmeme.com/memes/profit
  - semi-extrinsic 12y ago
    There's this thing called a "jasager" that you might also be interested in looking into. Particularly combined with airdrop-ng. I was a bit shocked when I learned how that particular aspect of 802.11 is implemented.
  - TazeTSchnitzel 12y ago
    Or set one up called "Free WiFi" in a location with a WiFi blackspot that many students congregate at.
adamtj 12y ago
What about ARP spoofing? Have all wireless routers ever built somehow gotten this right? It's my understanding that unless the wireless access point is sufficiently smart, any device on the same network can claim to be the router and your phone won't know the difference. Even if an attacking device can't passively decrypt your radio transmissions, it won't matter because the router will actively decrypt and re-encrypt your packets before forwarding them on to the attacking device.
- galvan 12y ago
  Actually, yes! *For enterprise-grade APs generally deployed at university campuses...[0] Moreover, such APs usually have methods to prevent communication between peers on the same wireless network. [0] http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Mobility/secwlandg20/sw2dg/ch4_2_SPMb.html#wp1307340 http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Mo...
ben1040 12y ago
That's assuming the attacker would be a fellow student connecting to the wifi network, and not the school, who has full control of the the network beyond the access point. I'm long out of undergrad so I've never used this app, but I've read that YikYak is at least somewhat known for controversial content regarding schools, school employees/faculty, and fellow students. Seems like there would've been just as much, if not more, incentive for a university administrator to want to get people's post histories in order to divine who posted a particular piece of content.
andrewjkerr 12y ago
> YikYak is mostly used on university campuses and odds are if a student is on campus they would be connected to the university wifi Based on some of the vague locations that Yik Yak gives with each post I'd say a little less than half are actually sent from on campus.

by stryan 12y ago

saidajigumi 12y ago

> As said in the article, YikYak is mostly used on university campuses University campuses, where students are constantly using the free WiFi in cafes, are on private WiFi networks shared with friends, etc. Even if the University's own WiFi was magically invulnerable, there will be many associated venues ready for use of this exploit.

pyre 12y ago
1. Setup an open access point in the middle of campus. 2. Give it a default name (e.g. 'linksys'). 3. Capture packets. 4. Profit.
- scandinavian 12y ago
  There is no profit though, no one uses YikYak for posting anything remotely important.
  - TazeTSchnitzel 12y ago
    Ehh, people sometimes post embarassing/hateful things on YikYak, being able to out them would be a problem.
    - btown 12y ago
      Or to blackmail them so you don't reveal their identity.
  - smt88 12y ago
    An app should not be considered "secure" because it doesn't currently have important data. Twitter wasn't much of a honeypot, either, until activists and corporations started using it. Did Twitter know the exact moment that happened? No. They should have been secure long before that.
  - pyre 12y ago
    Don't take it so literally. In this case "profit" is just synonym for "goal". See: http://knowyourmeme.com/memes/profit http://knowyourmeme.com/memes/profit
- semi-extrinsic 12y ago
  There's this thing called a "jasager" that you might also be interested in looking into. Particularly combined with airdrop-ng. I was a bit shocked when I learned how that particular aspect of 802.11 is implemented.
- TazeTSchnitzel 12y ago
  Or set one up called "Free WiFi" in a location with a WiFi blackspot that many students congregate at.

adamtj 12y ago

What about ARP spoofing? Have all wireless routers ever built somehow gotten this right? It's my understanding that unless the wireless access point is sufficiently smart, any device on the same network can claim to be the router and your phone won't know the difference. Even if an attacking device can't passively decrypt your radio transmissions, it won't matter because the router will actively decrypt and re-encrypt your packets before forwarding them on to the attacking device.

galvan 12y ago
Actually, yes! *For enterprise-grade APs generally deployed at university campuses...[0] Moreover, such APs usually have methods to prevent communication between peers on the same wireless network. [0] http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Mobility/secwlandg20/sw2dg/ch4_2_SPMb.html#wp1307340 http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Mo...

ben1040 12y ago

That's assuming the attacker would be a fellow student connecting to the wifi network, and not the school, who has full control of the the network beyond the access point. I'm long out of undergrad so I've never used this app, but I've read that YikYak is at least somewhat known for controversial content regarding schools, school employees/faculty, and fellow students. Seems like there would've been just as much, if not more, incentive for a university administrator to want to get people's post histories in order to divine who posted a particular piece of content.

andrewjkerr 12y ago

> YikYak is mostly used on university campuses and odds are if a student is on campus they would be connected to the university wifi Based on some of the vague locations that Yik Yak gives with each post I'd say a little less than half are actually sent from on campus.