Trying to deploy WPA3 on my home network • Hacker News Board

Re: Trying to deploy WPA3 on my home network

#11

Post by ech000 » Mon, Jan 07, 2019, 7:26 AM UTC

jtl999 wrote: post #8

cbhl wrote: post #4

Earlier quoted context omitted.

Device drivers don't usually need to be updated unless the driver interface changes (i.e. when you update the Linux kernel) or the driver needs to be updated to accommodate quirks of new software (i.e. graphics drivers and new video games). They probably do want to be getting the latest security patches to the kernel and base OS.

I remember the creator of CopperheadOS claiming the "Nexus 5" (which is EOL) is not secure because of hardware (baseband?) vulnerabilities that wouldn't be trivial to fix. Citation: https://twitter.com/DanielMicay/status/1058103333414522880

Can anyone recommend a post that introduces these kind of issues for Android outsiders?

I assumed Android ROMs carry a fully fledged distribution, including the kernel and firmware. Sure, the latter might be out of date.

When I tried digging into the question "where does this so-called open source come from", I stumbled upon Kernels that basically have one commit adding the whole blob.

Is the ROM merely the application software built for a target kernel (which is persistent on the device)?

I've hacked around with Kernel modules on Android before, but miss the big picture in that regard.

Edit: especially the new update infrastructure (treble?), Does it change anything here?

Re: Trying to deploy WPA3 on my home network

#12

Post by tgsovlerkhgsel » Mon, Jan 07, 2019, 7:33 AM UTC

AlyssaRowan wrote: post #5

Use WPA3-Enterprise (you can use Let's Encrypt to get a valid certificate so it works fine in a home environment). Don't use SAE (which is, indeed, an instantiation of Dragonfly). I have a strong suspicion that the way it is used, there will be a practical attack.

I was unable to find the spec for SAE as used in WPA3, but SAE itself doesn't seem to hash the shared secret into the session key, which would be an easy way to provide resistance to both quantum attackers and random implementation screwups (e.g. bad PRNGs) that defeat the security of the asymmetric parts of the scheme.

Basically, take the original password/secret, derive two secrets A and B, run SAE with A as the secret, get a session key K, then use hash(K|B) as the actual session key.

If they don't have anything like that, I wouldn't be surprised if real-world implementations end up being less secure than up-to-date WPA2.

Re: Trying to deploy WPA3 on my home network

#13

Post by chaosite » Mon, Jan 07, 2019, 9:29 AM UTC

maxyme wrote: post #9

alexandernst wrote: post #2

Synology Routers support WPA3 by default

They also support a mode where they will use WPA3 when supported and fall back to WPA2 when there isn't device support.

That's just WPA2 with extra steps.

Re: Trying to deploy WPA3 on my home network

#14

Post by lclarkmichalek » Mon, Jan 07, 2019, 10:17 AM UTC

jtl999 wrote: post #8

cbhl wrote: post #4

Earlier quoted context omitted.

Device drivers don't usually need to be updated unless the driver interface changes (i.e. when you update the Linux kernel) or the driver needs to be updated to accommodate quirks of new software (i.e. graphics drivers and new video games). They probably do want to be getting the latest security patches to the kernel and base OS.

I remember the creator of CopperheadOS claiming the "Nexus 5" (which is EOL) is not secure because of hardware (baseband?) vulnerabilities that wouldn't be trivial to fix. Citation: https://twitter.com/DanielMicay/status/1058103333414522880

I think he's more saying that Nexus 5 is not secure going forwards because the firmware for the hardware is not getting updates. I can't see any reference to specific vulnerabilities, but when a platform is complex they're bound to exist. When you combine that with not getting updates, you have an insecure platform.

Re: Trying to deploy WPA3 on my home network

#15

Post by [deleted] » Mon, Jan 07, 2019, 11:39 AM UTC

[deleted]

Re: Trying to deploy WPA3 on my home network

#16

Post by arghwhat » Mon, Jan 07, 2019, 1:37 PM UTC

jtl999 wrote: post #8

cbhl wrote: post #4

Earlier quoted context omitted.

Device drivers don't usually need to be updated unless the driver interface changes (i.e. when you update the Linux kernel) or the driver needs to be updated to accommodate quirks of new software (i.e. graphics drivers and new video games). They probably do want to be getting the latest security patches to the kernel and base OS.

I remember the creator of CopperheadOS claiming the "Nexus 5" (which is EOL) is not secure because of hardware (baseband?) vulnerabilities that wouldn't be trivial to fix. Citation: https://twitter.com/DanielMicay/status/1058103333414522880

Basebands are generally terrible black boxes. Even for new devices, they're a major security concern.

Re: Trying to deploy WPA3 on my home network

#17

Post by Spivak » Mon, Jan 07, 2019, 2:32 PM UTC

chaosite wrote: post #13

maxyme wrote: post #9

Earlier quoted context omitted.

They also support a mode where they will use WPA3 when supported and fall back to WPA2 when there isn't device support.

That's just WPA2 with extra steps.

I mean from a security standpoint you're right, but having opportunistic WPA3 seems to be the only sensible way to deploy until you reach acceptable device support.

Re: Trying to deploy WPA3 on my home network

#18

Post by duckerude » Mon, Jan 07, 2019, 2:57 PM UTC

chaosite wrote: post #13

maxyme wrote: post #9

Earlier quoted context omitted.

They also support a mode where they will use WPA3 when supported and fall back to WPA2 when there isn't device support.

That's just WPA2 with extra steps.

Wouldn't you keep (much of) the advantages of WPA3's forward secrecy?

Re: Trying to deploy WPA3 on my home network

#19

Post by ghusbands » Mon, Jan 07, 2019, 4:41 PM UTC

lclarkmichalek wrote: post #14

jtl999 wrote: post #8

Earlier quoted context omitted.

I remember the creator of CopperheadOS claiming the "Nexus 5" (which is EOL) is not secure because of hardware (baseband?) vulnerabilities that wouldn't be trivial to fix. Citation: https://twitter.com/DanielMicay/status/1058103333414522880

I think he's more saying that Nexus 5 is not secure going forwards because the firmware for the hardware is not getting updates. I can't see any reference to specific vulnerabilities, but when a platform is complex they're bound to exist. When you combine that with not getting updates, you have an insecure platform.

The firmware for the Nexus 5 wifi chip has well-known remotely-exploitable code-execution vulnerabilities [1] that were never patched. Nearly all modern devices have a full software stack inside the wifi (and other radio) chips and they all have plenty of security flaws and they're all proprietary and unaffected by the OS.

So it's not just about it not being secure going forwards. It and most other similar age handsets are insecure because a fix has never been released for the older chips.

[1] https://googleprojectzero.blogspot.com/2017/04/over-air-expl...

Re: Trying to deploy WPA3 on my home network

#20

Post by xenithorb » Mon, Jan 07, 2019, 5:00 PM UTC

zokier wrote: post #6

AlyssaRowan wrote: post #5

Use WPA3-Enterprise (you can use Let's Encrypt to get a valid certificate so it works fine in a home environment). Don't use SAE (which is, indeed, an instantiation of Dragonfly). I have a strong suspicion that the way it is used, there will be a practical attack.

Or just use WPA2-Enterprise, afaik there are no pressing security needs to upgrade to WPA3 if you are using EAP, and it is widely supported out of the box

The problem with this I found for home use is that IoT devices don't typically support enterprise modes. And without PSK you just flat-out can't use those devices with WiFi