Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Map of Wireless Passwords from Airports and Lounges

foxnomad.com

Post reply on HN
Print view View original

101–110 of 124 posts

Re: A Map of Wireless Passwords from Airports and Lounges

#101

Post by exegete »

sneak wrote: post #43
dsr_ wrote: post #12

The author claims to be a computer security engineer, yet is deliberately setting up a tool to defeat security -- not an abstract tool, useful in surveying and thus improving your own security and incidentally capable of being used for mischief, but nothing more than a list of identifiers and passwords. The only indicator you can gain from this is that someone betrayed your trust. If this profession had a board of et…

I think this is a red herring. Not using encryption is unacceptable. Sharing public information is not unethical.

This isn't public info in some cases though. Airline sky clubs charge a fee and one of the benefits is their wifi (note that on the map, these aren't just airports, but airline sky clubs).

That's like you coming to my house, I give you the password to the wifi, and then you go tell all the neighbors about it so they can get "free wifi".

Re: A Map of Wireless Passwords from Airports and Lounges

#102

Post by blincoln »

frgewut wrote: post #75
remcob wrote: post #67

Earlier quoted context omitted.

> not using encryption Not a viable option, this would allow anyone to intercept traffic. (To be fair, a lot of wifi routers are broken and will forward you all decrypted traffic from other users anyway on request. Try running WireShark on public wifis.) The big problem is that Wifi with no password provides no privacy. Ideally we would have a wifi mode that is encrypted, but does not require a password. Just like Ht…

Actually WPA with pre-shared key doesn't provide any security if key is publicly known (as someone can setup mitm device). For wifi without password you should look at WPS.

It's not that someone can set up a MitM device. Wifi with a shared password can be passively captured using a variety of tools and decrypted using WireShark.[1]

The "coffee shop" scenario, where a WPA2 Personal password is written where anyone can see it, is essentially as insecure as non-encrypted wireless.

WPA2 Personal is only secure if the password is very strong[2] and never given to untrusted parties.

The only wireless security I put any real trust in is WPA2 Enterprise with 802.1x certificate-based authentication specifically.[3]

[1] https://wiki.wireshark.org/HowToDecrypt802.11 [2] Otherwise it's possible to mount a hash-cracking attack after capturing the four-way handshake for clients that have the password. [3] WPA2 Enterprise with per-user password-based authentication is vulnerable to an "evil twin attack" unless the password is very strong, which is usually not the case, because organizations typically have it authenticate against Active Directory or another LDAP.

Re: A Map of Wireless Passwords from Airports and Lounges

#103

Post by vzaliva »

Uberphallus wrote: post #33

This is already done here [0] and it's not limited to airports or lounges. [0] https://play.google.com/store/apps/details?id=com.instabridg...

I am using Instabridge for a few years and it is really great! I wish more people knew about it and use it.

Re: A Map of Wireless Passwords from Airports and Lounges

#104

Post by Rjevski »

Bromskloss wrote: post #96
paublyrne wrote: post #78

I'm not sure this is a good thing to do, but airports that don't have free open wifi annoy me. It's so useful to have internet access when you arrive in a foreign country, for figuring out how to get into the city, or to communicate with a hotel etc, and sometimes its unfeasible to use your own sim abroad. It just seems a petty thing for airports to do, to try and make a few dollars or euros or pounds that way.

> It just seems a petty thing for airports to do, to try and make a few dollars or euros or pounds that way. Doesn't the party on the other side of the transaction – i.e. you and I who do not want to pay for an Internet connection – have the same attitude?

Often you can't even easily pay for it. If they would just put an "ATM" where you insert your card/cash and get a WPA2 password in exchange it would be so much better.

Re: A Map of Wireless Passwords from Airports and Lounges

#105

Post by asavadatti »

paultopia wrote: post #100
jamessb wrote: post #54

Earlier quoted context omitted.

Sometimes the resason that you don't get redirected to the wifi network's captive portal is that your browser is trying to access a page using HTTPS. Trying to connect to a HTTP-only site (like http://neverssl.com/ ) can solve this.

Yeah. And this is a complete shitshow as everyone on earth pushes https as hard as possible. How do people who haven't heard of neverssl manage to connect to these captive portals? Sooner or later, the drive toward secure http is just going to kill off anything with a captive portal for most internet users.

Just use example.com

Re: A Map of Wireless Passwords from Airports and Lounges

#106

Post by blntechie »

1024core wrote: post #95
realusername wrote: post #84

Earlier quoted context omitted.

I also hate people who put an open wifi requiring an SMS token in an Airport... You know, the only place where you have a good chance of your SIM Card not working for being abroad...

Exactly! I'm looking at you, Delhi Airport! The f'n morons advertise "free wifi! free wifi!!" everywhere, but when you actually want to use it, they demand a phone number to send an SMS message. Are the people in charge there really that clueless??

Knowing India, it's probably Government mandated for what they call 'security reasons'. It's hard to get free WiFi or internet without providing a phone number in India.

Re: A Map of Wireless Passwords from Airports and Lounges

#107

Post by ryandrake »

7952 wrote: post #63
sjwright wrote: post #42

Earlier quoted context omitted.

A password that has already been handed out to thousands or tens of thousands of customers isn't "security".

In the physical world social convention is used all the time instead of real security. If my boss needs some peace and quiet he closes his door. It is not locked, but people know not to enter. If it is open I can walk in and have a chat. A WIFI password is a social convention asking you to not share. Everyone knows that it is not secure. But it is much easier than having a captive portal login system. By respecting t…

There is no social convention on the Internet. If you live in a quiet safe neighborhood you can often get away with leaving your door unlocked at night. But when parking in a city of millions of strangers you always lock your door. On the Internet of billions of people, lock your doors.

I rotate my home WiFi passwords regularly. A business with revenue can’t afford to do this?

Re: A Map of Wireless Passwords from Airports and Lounges

#108

Post by rossboss »

sbr464 wrote: post #73

I needed to connect an Apple TV to a blocked wifi at a hotel, Just sharing, here are the instructions using a macbook to get past hotspot auth, since there isn't a browser on an Apple TV 1. Disconnect from ap by option+click status bar wifi icon 2. Write down your current wifi mac address ifconfig en0 | grep ether 3. Switch macbook to Apple TV mac address sudo ifconfig en0 ether [apple tv mac address] 4. Connect to w…

Thank You! I have been trying to figure this out to connect to xfinity hotspots

Re: A Map of Wireless Passwords from Airports and Lounges

#109

Post by sbr464 »

rossboss wrote: post #108
sbr464 wrote: post #73

I needed to connect an Apple TV to a blocked wifi at a hotel, Just sharing, here are the instructions using a macbook to get past hotspot auth, since there isn't a browser on an Apple TV 1. Disconnect from ap by option+click status bar wifi icon 2. Write down your current wifi mac address ifconfig en0 | grep ether 3. Switch macbook to Apple TV mac address sudo ifconfig en0 ether [apple tv mac address] 4. Connect to w…

Thank You! I have been trying to figure this out to connect to xfinity hotspots

Cheers. It was a ceremony before of hacks/ethernet before. This just works and no extra gear.
Post reply on HN