Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WPA3 Enterprise 192-bit mode at home

smallstep.com

Post reply on HN
Print view View original

101–110 of 201 posts

Re: WPA3 Enterprise 192-bit mode at home

#101

Post by kortilla »

xyst wrote: post #94

I would like to see something like this for “home” setups but it would have a much better user experience: 1) user attempts to connect to “home-wifi” 2) owner of “home-wifi” gets notification to confirm or deny access request 3) owner can optionally verify further 4) if approved, then between AP and client device it will create the client certificates with short expiration dates 5) if denied, then no access granted.…

How do you think that blacklist would work that can’t be trivially rotated around by changing client identities?

Re: WPA3 Enterprise 192-bit mode at home

#102

Post by Klathmon »

hunter2_ wrote: post #100
xyst wrote: post #94

I would like to see something like this for “home” setups but it would have a much better user experience: 1) user attempts to connect to “home-wifi” 2) owner of “home-wifi” gets notification to confirm or deny access request 3) owner can optionally verify further 4) if approved, then between AP and client device it will create the client certificates with short expiration dates 5) if denied, then no access granted.…

Wardrivers with sufficient randomization to avoid any denylist you implement will get very annoying if you let those notifications interrupt you. Maybe only receive such requests while you expect guests.

You could just not have notifications.

I'd be fine with a system where when someone tries to connect to my network, I need to open an app or go to a web page and pick from the list of attempts to allow.

It's not perfect, and it still leaves open a DoS by filling the DB with spam, but at that point you know something is wrong.

Re: WPA3 Enterprise 192-bit mode at home

#103

Post by lolinder »

iforgotpassword wrote: post #19
lolinder wrote: post #14

Earlier quoted context omitted.

Is there a reason you split IoT stuff off of the guest network? On my network we just have a guest network which denies LAN access to anything connected to it, but I'm wondering if there's a good reason to split IoT off entirely.

I guess it depends on what kind of friends you have, but assuming iot devices are insecure rubbish, I wouldn't want them on the same network as guests. But then again you might want to turn on client isolation for the guest network, so that wouldn't really be an issue.

Yeah, I have guests all isolated from the LAN already.

Re: WPA3 Enterprise 192-bit mode at home

#104

Post by boringuser2 »

I think this is generally barking up the wrong tree and addressing the wrong attack vectors for home wifi.

An actual over-engineered home wifi looks like this:

1. Use, at the very least, prosumer grade router access points. I use *sense and Aruba access points, but you don't need to get this serious.

2. Use heavy DNS filters. This will block a lot of malware by itself. Quad9 DNS is a good starting point.

3. Use a secure wifi password.

4. Don't enable upnp, etc.

5. Don't enable ssh or any kind of remote access.

6. Don't open any ports to the outside. This is the default ruleset for pretty much any firewall.

7. If you ever have guests who require wifi, segment these users on a guest wifi or vlan.

8. Reduce your reliance on wifi-powered devices. Favor zigbee smart home devices over wifi devices.

9. (Optional) segment your IoT devices on a vlan.

10. (Optional) use some kind of security package that includes layer 7 monitoring on your LAN.

11. (Optional) use some kind of security package that includes IPS/IDS.

Re: WPA3 Enterprise 192-bit mode at home

#105

Post by eru »

dfc wrote: post #47
londons_explore wrote: post #8

I want to know why WPA3 doesn't have a mode where a password is used for the initial connection , but then the client and AP generate a keypair and each store their half and use that for all future connections. For all future connections, the AP can validate every client, and the client can validate that it is connecting to the same AP. The AP could have an interface to 'revoke' access to any single client if necessa…

Saying that it is like WPA3 Enterprise after the initial pairing is somewhat unfair. The trust in the initial pairing is a large part of the draw. The trust on first use model you describe is similar to using a self signed certificate on a website. Sure, after you connect and trust the self signed certificate your connection to the server can use the same algorithms that it would have used with a trusted CA. But for…

SSH does mostly fine with trust-on-first-use.

Re: WPA3 Enterprise 192-bit mode at home

#106

Post by wishfish »

hunter2_ wrote: post #100
xyst wrote: post #94

I would like to see something like this for “home” setups but it would have a much better user experience: 1) user attempts to connect to “home-wifi” 2) owner of “home-wifi” gets notification to confirm or deny access request 3) owner can optionally verify further 4) if approved, then between AP and client device it will create the client certificates with short expiration dates 5) if denied, then no access granted.…

Wardrivers with sufficient randomization to avoid any denylist you implement will get very annoying if you let those notifications interrupt you. Maybe only receive such requests while you expect guests.

That would be the best way. Turn on notifications when you're expecting a new device. Turn off notifications and auto-deny the rest of the time.

Re: WPA3 Enterprise 192-bit mode at home

#107

Post by eli »

hunter2_ wrote: post #100
xyst wrote: post #94

I would like to see something like this for “home” setups but it would have a much better user experience: 1) user attempts to connect to “home-wifi” 2) owner of “home-wifi” gets notification to confirm or deny access request 3) owner can optionally verify further 4) if approved, then between AP and client device it will create the client certificates with short expiration dates 5) if denied, then no access granted.…

Wardrivers with sufficient randomization to avoid any denylist you implement will get very annoying if you let those notifications interrupt you. Maybe only receive such requests while you expect guests.

That seems unlikely to be something I'd ever encounter and solved by muting requests after too many in a row. Yes, a local attacker could DoS the convenience features for my guest wifi. That's fine.

Re: WPA3 Enterprise 192-bit mode at home

#108

Post by callalex »

xyst wrote: post #94

I would like to see something like this for “home” setups but it would have a much better user experience: 1) user attempts to connect to “home-wifi” 2) owner of “home-wifi” gets notification to confirm or deny access request 3) owner can optionally verify further 4) if approved, then between AP and client device it will create the client certificates with short expiration dates 5) if denied, then no access granted.…

It’s a crying shame that WPS was fumbled so hard. It was a consumer friendly idea.

Re: WPA3 Enterprise 192-bit mode at home

#109

Post by stephen_g »

I haven't gone quite this crazy, but I do have three SSIDs broadcast from my UniFi APs - my main network (WPA3 PSK), a guest one, and a devices network for IoT devices. All these are on different subnets/VLANs and firewalled off from each other.

A lot of the IoT stuff doesn't work with WPA3 or 5GHz, so it's useful even for that reason, but the main thing is screening them off from everything else.

I am setting up a NUC as a little home Proxmox server (for some other stuff mainly) but for "fun" I can actually see myself setting up a Samba 4 Active Directory domain controller and hooking FreeRADIUS up to that to do Enterprise for my main SSID, but we'll see!

Re: WPA3 Enterprise 192-bit mode at home

#110

Post by est31 »

mattbee wrote: post #63
londons_explore wrote: post #8

I want to know why WPA3 doesn't have a mode where a password is used for the initial connection , but then the client and AP generate a keypair and each store their half and use that for all future connections. For all future connections, the AP can validate every client, and the client can validate that it is connecting to the same AP. The AP could have an interface to 'revoke' access to any single client if necessa…

You can already do this with hostapd under WPA3 or WPA2 - The password alone can identify each client, and activate different configs for each one. Some commercial APs support this under different names but it's hard to make it work with RADIUS, which is usually necessary on larger installations. But without preloaded certificates, the clients don't know that they're not connecting to a rogue access point. Hotspot 2.…

> The password alone can identify each client, and activate different configs for each one.

That's interesting, first time I hear this. How would that be represented in the hostapd config file? Would it be WPA enterprise using a radius server, or would it actually use WPA-PSK?

Post reply on HN