81–90 of 144 posts
Does it work?
Earlier quoted context omitted.
I'm no security expert, but after I saw each new wifi password standard cracked within days of its release, I stopped passwording my wifi and used a little script I put on a home linux server to watch the router and if it spotted any unrecognized MAC addresses getting an IP address from DHCP, it would throw them out within a few seconds. These days, I just turn on the MAC address filter that's built in to most wifi b…
Someone's said in the Ars Technica comments that MAC addresses are freely available in the packets-in-flight, and MACs are spoofable, so MAC filtering will only deter the casual, passing wifi-borrower, not anyone actually determined to gain access.
Isn't that true of WPA and WPA2 though also?
Earlier quoted context omitted.
One of the things I try very hard to drive home to people is that WPA2 uses a pass phrase and not a password. I highly encourage people to use something like a favorite movie quote or a line from a book. Something like "Alas, poor Yorick! I knew him Horatio;" is both harder to crack and easier for a human to remember than something like "v3$bk:j". You're essentially taking natural language, which is something humans…
The problem with movie quotes and lines from books is that they're out there in a database somewhere. That means they're not nearly as hard for a computer to guess as you might think.
Earlier quoted context omitted.
A physical assault carries a high chance of being noticed, and unless carried out by law enforcement, a significant chance of being punished with jail time. So it's not something that has a high chance of happening. Additionally, it's hard to defend against, and you definitely don't want to defend against a SWAT team. Whereas a bored teenage neighbor could attack your wireless network with a very small chance of bein…
I'm no security expert, but after I saw each new wifi password standard cracked within days of its release, I stopped passwording my wifi and used a little script I put on a home linux server to watch the router and if it spotted any unrecognized MAC addresses getting an IP address from DHCP, it would throw them out within a few seconds. These days, I just turn on the MAC address filter that's built in to most wifi b…
* WPA2 hasn't been 'cracked' * Without 'passwording', all your traffic is unencrypted and can be trivially sniffed * Spoofing one of your whitelisted MAC addresses in order to use your network is easy
Earlier quoted context omitted.
One of the things I try very hard to drive home to people is that WPA2 uses a pass phrase and not a password. I highly encourage people to use something like a favorite movie quote or a line from a book. Something like "Alas, poor Yorick! I knew him Horatio;" is both harder to crack and easier for a human to remember than something like "v3$bk:j". You're essentially taking natural language, which is something humans…
The problem with movie quotes and lines from books is that they're out there in a database somewhere. That means they're not nearly as hard for a computer to guess as you might think.
The precomputed tables that make cracking WPA2 feasible have to not only target passwords, but password+SSID combinations as a result.
I think you're grossly overstating the relative weakness of a longer passphrase. The more obscure, the better, obviously, but the chances of any given quote or phrase of any length appearing in a precomputed table are relatively minimal.
More importantly, any variations in punctuation, capitalization, spacing, etc would make a precomputed table worthless while still making the passphrase far easier for a human to remember than a random string of 8 characters.
A couple of naive questions about the design of the security system: 1. Why is it possible to do the password tests remotely? Why would the key on the router be allowed to be transmitted? Even a 6 character password should be safe if you don't allow multiple tries. 2. Why isn't the handshake protocol encrypted?
My strategy is to use a human-readable password for my guest network (which I actually considered leaving completely open), and a crazy-long random password that I copy and paste from my password manager for my internal network.