Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Wi-Fi Security

threadreaderapp.com

Post reply on HN
Print view View original

11–16 of 16 posts

Re: Open Wi-Fi Security

#11

Post by _8j50 »

Nextgrid wrote: post #8
_8j50 wrote: post #7

Ugh, this is so horrible. Mostly because they have thr right idea but did it half-baked. Avoiding wifi passwords is great, but you still need connection security,mitm is not hard to pull! You could be on a VPN and someone can mitm you! Client isolation is nice but evil twins are a thing. The best practical solution is to use EAP-TLS, ideally you would have a captive portal that instructs clients to either run some wh…

> If someone loses money or worse because they trusted your enlightened security model,be prepared for a lawsuit! The network is provided without any guarantee. In fact with a non-secured network there's not even a way to prove that they were connecting to the hotel's network and not someone pretending to be the hotel. Furthermore, given your logic, would you sue ISPs, transit providers, hosting providers, etc if the…

If another guest was the pepetrator? Yes, you can sue. Much like how you can sue the hotel if another guest beats you up. Whether you win in court depends on your lawyers and the judge.

Re: Open Wi-Fi Security

#12

Post by Nextgrid »

_8j50 wrote: post #11
Nextgrid wrote: post #8

Earlier quoted context omitted.

> If someone loses money or worse because they trusted your enlightened security model,be prepared for a lawsuit! The network is provided without any guarantee. In fact with a non-secured network there's not even a way to prove that they were connecting to the hotel's network and not someone pretending to be the hotel. Furthermore, given your logic, would you sue ISPs, transit providers, hosting providers, etc if the…

If another guest was the pepetrator? Yes, you can sue. Much like how you can sue the hotel if another guest beats you up. Whether you win in court depends on your lawyers and the judge.

> If another guest was the pepetrator?

How do you prove that on an unsecured network where no clients are authenticated?

Also, if you've identified the perpetrator, why not just go after them directly?

Re: Open Wi-Fi Security

#13

Post by _8j50 »

Nextgrid wrote: post #12
_8j50 wrote: post #11

Earlier quoted context omitted.

If another guest was the pepetrator? Yes, you can sue. Much like how you can sue the hotel if another guest beats you up. Whether you win in court depends on your lawyers and the judge.

> If another guest was the pepetrator? How do you prove that on an unsecured network where no clients are authenticated? Also, if you've identified the perpetrator, why not just go after them directly?

You can find them after the fact if they still have a persistent connection to you device (logs or radio isolation). Or perhaps they admitted to the fact?

Why not go after them? Why not go after all liable parties? What if the perpetrator is not in a jurisdiction where you can sue?

Btw, lookup the APT group "darkhotel" and their activities.

Re: Open Wi-Fi Security

#14

Post by tinus_hn »

Nextgrid wrote: post #9
tinus_hn wrote: post #5

It would be nice if the standard allowed host names as SSIDs so you could have certificates for them. But it doesn’t.

How would you make that work? How do you prove to the certification authority that you are the rightful owner of a certain SSID? What if a place somewhere else wants to use the same SSID? Who's supposed to decide (and based on what criteria?) who's the "rightful" owner of a particular SSID?

If the SSID is a hostname that’s easy, like it already is for secure websites.

Re: Open Wi-Fi Security

#15

Post by tptacek »

_8j50 wrote: post #7

Ugh, this is so horrible. Mostly because they have thr right idea but did it half-baked. Avoiding wifi passwords is great, but you still need connection security,mitm is not hard to pull! You could be on a VPN and someone can mitm you! Client isolation is nice but evil twins are a thing. The best practical solution is to use EAP-TLS, ideally you would have a captive portal that instructs clients to either run some wh…

Against a network-level adversary, DNSSEC does exactly nothing: it's a server-to-server protocol, and the interaction between the resolver on your desktop and the DNS server remains unprotected. And, of course, as you mention, even if you ran a recursive validating resolver on your desktop, DNSSEC still doesn't encrypt anything.

People should simply not bother with DNSSEC.

Re: Open Wi-Fi Security

#16

Post by _8j50 »

tptacek wrote: post #15
_8j50 wrote: post #7

Ugh, this is so horrible. Mostly because they have thr right idea but did it half-baked. Avoiding wifi passwords is great, but you still need connection security,mitm is not hard to pull! You could be on a VPN and someone can mitm you! Client isolation is nice but evil twins are a thing. The best practical solution is to use EAP-TLS, ideally you would have a captive portal that instructs clients to either run some wh…

Against a network-level adversary, DNSSEC does exactly nothing: it's a server-to-server protocol, and the interaction between the resolver on your desktop and the DNS server remains unprotected. And, of course, as you mention, even if you ran a recursive validating resolver on your desktop, DNSSEC still doesn't encrypt anything. People should simply not bother with DNSSEC.

What do you recommend then? I think DNSCrypt is nice for client-to-server.

Edit: nvm, forgot DoH and DoT were a thing

Post reply on HN