Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WPA3 Enterprise 192-bit mode at home

smallstep.com

Post reply on HN
Print view View original

121–130 of 201 posts

Re: WPA3 Enterprise 192-bit mode at home

#121

Post by sneak »

boringuser2 wrote: post #104

I think this is generally barking up the wrong tree and addressing the wrong attack vectors for home wifi. An actual over-engineered home wifi looks like this: 1. Use, at the very least, prosumer grade router access points. I use *sense and Aruba access points, but you don't need to get this serious. 2. Use heavy DNS filters. This will block a lot of malware by itself. Quad9 DNS is a good starting point. 3. Use a sec…

Items 4-9 accomplish nothing. Your LAN is not a security perimeter. This ain’t token ring.

Re: WPA3 Enterprise 192-bit mode at home

#122

Post by dgl »

zamadatix wrote: post #7
transpute wrote: post #4

A middle ground in complexity is WPA3 with a unique passphrase per VLAN, which allows grouping of devices by risk, or even giving each device a unique identity for access control and traffic management. OSS golang reference code is available, https://news.ycombinator.com/item?id=38402289 VLAN tagging per SSID is a valid approach as well if a router supports it. Thats a lot stronger than how many routers implement the…

I wish more consumer devices supported multiple PSKs on the same SSID. It's a handy feature much better for airtime than creating multiple separate SSIDs and much better for sanity than 802.1x user or cert auth.

Doing multiple PSK / PPSK is not compatible with WPA3 (at least as supported by most APs today*, as WPA3 requires management frame encryption), so you limit to WPA2 only, therefore you're better off just having multiple SSIDs with WPA3 support. (Also that way you can have a "secure" network which is WPA3 Personal only, much easier than using WPA Enterprise and gives a reasonable level of security for home use.)

*: In theory password identifiers (https://www.gabriel.urdhr.fr/2022/06/07/impact-of-the-differ...) could be used with WPA3-SAE, but I don't know how good the support is currently...

Re: WPA3 Enterprise 192-bit mode at home

#123

Post by tonetegeatinst »

TLS 1.2 and not 1.3?

Could a swore we moved to 1.3 a while ago

Also many I'm just not familiar enough with cryptography but that key size seems kinda small.....am I wrong?

Ik RSA uses a different algorithm but RSA it isn't uncommon to see keys 1024 or larger in size. I generated a key of 65,536 and 131,072 bits a few times to see if it would work or break any applications I was using. Also just to I can say "yeah back in my day we generated keys way bigger" cuz I know at least 1 other person in the world did it.

Is their any standard for securing a network both wired and WiFi using a post quantum algorithm?

Also where can I easily find switches that support these standards? AFAIK wpa3 enterprise dosnt always mean this standard is supported....or that some other standard is supported. Is their some database that lists every router/AP and the supported features?

Re: WPA3 Enterprise 192-bit mode at home

#124

Post by tonetegeatinst »

amluto wrote: post #113
pierat wrote: post #84

Earlier quoted context omitted.

> It makes me sad that even WPA3 doesn’t have a native provisioning mechanism. And that's how you get spoofing management frames, deauthing, and all sorts of fun attacks. Cause the moment you talk to unauthenticated and unencrypted machines, well, yeah. Payday. So you cant do that, even if you really want to.

Huh? Almost every cryptographic session protocol starts out with the parties sending unauthenticated data of some sort to each other. Having a way for a party to send a blob as part of its request to be let in is straightforward. Plus we’re taking about WPA, which, AFAIK, still uses a horrible hack for EAP even in WPA3, and as you can see mentioned elsewhere in the comments, EAP makes a pretty strong showing in its q…

Their was a defcon or a blackhat talk on this issue. Even though the data might be encrypted....developers can leak so much metadata via the handshake that you can build profiles and track devices

Re: WPA3 Enterprise 192-bit mode at home

#125

Post by callalex »

staplers wrote: post #118
callalex wrote: post #112

Earlier quoted context omitted.

What is your threat model to warrant this effort at home? Are your work-related machines not networking through an encrypted tunnel in some other way (that would be a serious oversight!)? What government are you living under that is routinely compromising WPA3 from mobile vans? Are friends/guests so untrustworthy that you can allow them into your home but can’t trust the VLAN implementation of your network equipment…

What government are you living under that is routinely compromising WPA3 from mobile vans? I imagine living in any decent sized downtown area would have your network being scanned by thousands of machines daily. Especially if near important infrastructure, law enforcement, etc.

That is not enough for a threat actor to modify the network control plane with WPA3. There are tight timings involved. It is only enough to be able to passively capture packets that can be retroactively decrypted and even then if there isn’t TLS working on those packets you already screwed up worse anyways.

Re: WPA3 Enterprise 192-bit mode at home

#126

Post by forward1 »

sandworm101 wrote: post #86
Rebelgecko wrote: post #25

Earlier quoted context omitted.

Yeah, they put out an article a few years ago talking about how a limited number of SCIFs have WiFi now

Do they broadcast an SSID? They can't have "NotYourSCIF". That's my home network. Someone else is the building is using "FSB_BugsNet". Another local one i see is "CEyeA".

It's not official until you change the MAC OID to 00:20:91 as well.

Re: WPA3 Enterprise 192-bit mode at home

#127

Post by unethical_ban »

callalex wrote: post #112
xoa wrote: post #64

Personally I've essentially given up on depending on WiFi auth for anything important. For general access, segmenting various users, IOT etc for performance, monitoring and light privacy WPA-EAP and PPSKs with VLANs does some work as an initial first layer fine and in a simple reliable way that works with everything. It's a low pass filter. But for all sensitive access I use internal Wireguard now. WiFi auth gets a c…

What is your threat model to warrant this effort at home? Are your work-related machines not networking through an encrypted tunnel in some other way (that would be a serious oversight!)? What government are you living under that is routinely compromising WPA3 from mobile vans? Are friends/guests so untrustworthy that you can allow them into your home but can’t trust the VLAN implementation of your network equipment…

You might be right, but this person might just be really intuitively good at network config and this is their hobby.

Re: WPA3 Enterprise 192-bit mode at home

#128

Post by tamimio »

xyst wrote: post #94

I would like to see something like this for “home” setups but it would have a much better user experience: 1) user attempts to connect to “home-wifi” 2) owner of “home-wifi” gets notification to confirm or deny access request 3) owner can optionally verify further 4) if approved, then between AP and client device it will create the client certificates with short expiration dates 5) if denied, then no access granted.…

> if user tries to connect multiple times and gets denied for all of them, then their device is blacklisted. No notification.

Blackhat 2026: WPA free(not three) Enterprise, how to flood and bypass WPA3 with certificate forgery and dual pair attack in 5min!

Re: WPA3 Enterprise 192-bit mode at home

#129

Post by forward1 »

pcthrowaway wrote: post #79
WatchDog wrote: post #31

> In the “When using this certificate” dropdown, select “Always Trust.” Shouldn't it be possible to only enable “Always Trust.” in the "X.509 Basic Policy" setting, instead of allowing the certificate to be used for everything(including SSL)?

On Mac (which the author appears to be talking about), I believe agreeing to Always Trust when connecting to a WPA3 network only enables it for the "X.509 Basic Policy" setting. I don't know much about how the different trust policies on OSX work though, and it makes me very uncomfortable that trusting self-signed root certificates may become more common for connecting to wifi networks. If you do trust the root cert…

Not only MITM traffic, but also run arbitrary software since it could also govern code signing.

Re: WPA3 Enterprise 192-bit mode at home

#130

Post by Rebelgecko »

sandworm101 wrote: post #86
Rebelgecko wrote: post #25

Earlier quoted context omitted.

Yeah, they put out an article a few years ago talking about how a limited number of SCIFs have WiFi now

Do they broadcast an SSID? They can't have "NotYourSCIF". That's my home network. Someone else is the building is using "FSB_BugsNet". Another local one i see is "CEyeA".

To be compliant with NSA TEMPEST regulations, the SSID has to be set to FBI_SURVEILLANCE_VAN_69
Post reply on HN