Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google knows nearly every Wi-Fi password in the world

blogs.computerworld.com

Post reply on HN
Print view View original

121–130 of 312 posts

Re: Google knows nearly every Wi-Fi password in the world

#121

Post by mathattack »

tytso wrote: post #52

The author is worried about WiFi passwords? If you trust that your WiFi is secure in general, you're in trouble. WPS is horribly insecure, for example, and that's what most home users use. Most user-chosen passwords are incredibly easy to guess for another. The better thing to do is to assume that your network traffic is always under surveillance (since the NSA is tapping Tier1 network providers), and to encrypt ever…

Your analysis is spot on. My first assumption on reading this was, "What does it matter?" I think the starting assumption for everything online is, "This will be read by someone other than it's intended audience until proven otherwise." This is doubly true for Wifi.

Re: Google knows nearly every Wi-Fi password in the world

#123

Post by Amadou »

ganeumann wrote: post #109
Amadou wrote: post #88

Earlier quoted context omitted.

For this to be a worry, every person up both branches of a very large hierarchical organization tree--all the way up to where a Google Ventures employee and a Gmail developer both report to the same person--would have to agree to it. That's ridiculous. The risk isn't institutionalized abuse, the threat is an unscrupulous guy in the Ventures group who has a buddy who works in the gmail (or other) groups. Calls him up…

You make the false assumption that people in different divisions of a very large company would be more likely to help each other outside of the corporate reward structure than they would be to help someone outside the company, who they might just happen to have personal or social obligations to. If there were an unscrupulous person in the gmail group, he would be more likely to break company policy (and, I think, the…

You make the false assumption that people in different divisions of a very large company

I'm assuming that people within a company are more likely to know each other and know what areas they work on versus simply "working at google." They have all kinds of opportunities to rub shoulders - previous projects they've worked on together, company social events, even just riding the google bus to work each day.

While outsiders are also a risk, working for the same company substantially increases the opportunities.

Re: Google knows nearly every Wi-Fi password in the world

#124

Post by PeterisP »

drdaeman wrote: post #119
PeterisP wrote: post #102

Earlier quoted context omitted.

Why is google having my Wifi password a bad thing? I'd be happy to let EVERYONE have it, and the only thing I fear is neighbour teenagers overloading the connection with torrents so that it's not usable for me. As long as I expect them not to overload my wifi too much, I'm perfectly happy with google or FBI or KGB or friends or random strangers to use have that wifi password. If wifi routers were good at traffic shap…

I'm unsure, but doesn't WPA2 password knowledge allows to decrypt your traffic? (Possibly with an active attack to re-initiate handshake?) I.e. someone who knows your password could drive by your home, listen to the air and see what you're doing online.

My internet traffic anyways is wide open and can be probably be tapped by giving a beer to a teenage techie in my local ISP ; or going to a router in our attic (last time i was there, it was behind a tiny padlock) where the wires split out to apartments.

If I use https/ssh, then my traffic is safe even if wifi is open; if I don't, then my traffic is unsafe even if WPA2 is used.

Re: Google knows nearly every Wi-Fi password in the world

#125

Post by jellicle »

wglb wrote: post #55

Or, in other words, Google remembers the things that we agree to have it remember.

In contract law, there's a concept called "meeting of the minds". A contract is formed when there has been a meeting of the minds between two parties as to what the deal is, and the parties have taken some concrete action to initiate the deal - often signing something, or shaking hands, or handing over money, or something like that.

The operative question is: when someone signs into a Google account on an Android device, and without any notification whatsoever the device sends his passwords to Google - which is what happens - has there been a meeting of the minds? Are both parties in agreement about what the deal is here?

Re: Google knows nearly every Wi-Fi password in the world

#126

Post by bjornsing »

devx wrote: post #87
tytso wrote: post #52

The author is worried about WiFi passwords? If you trust that your WiFi is secure in general, you're in trouble. WPS is horribly insecure, for example, and that's what most home users use. Most user-chosen passwords are incredibly easy to guess for another. The better thing to do is to assume that your network traffic is always under surveillance (since the NSA is tapping Tier1 network providers), and to encrypt ever…

Isn't it about time we get new security standards for Wi-Fi? Is there anything in the works right now to replace WPA2?

There's nothing seriously wrong with WPA2 itself. I'd consider it as secure as pretty much anything else out there that uses 128bit AES (given that your key exchange is secure of course - read on below).

The problem is with the PSK variety, mainly that it's susceptible to offline dictionary attack: about 5% of actual WPA2-PSKs can be easily guessed [1].

There is stuff in the works to fix this though. My favorite is EAP-PWD [2]. It's resistant to offline dictionary attacks, it has perfect forward secrecy and it's already supported by Android. Basically, it's what WPA2-PSK should have been.

In the mean time, if you're security conscious just set a long random PSK or configure e.g. EAP-TLS. Both will give you strong security against pretty much any attacker.

1. http://wpa.darkircop.org/

2. http://tools.ietf.org/html/rfc5931

Re: Google knows nearly every Wi-Fi password in the world

#127

Post by claudius »

a-priori wrote: post #98
devx wrote: post #87

Earlier quoted context omitted.

Isn't it about time we get new security standards for Wi-Fi? Is there anything in the works right now to replace WPA2?

The problem isn't limited to WPA2. As far as I know, in and of itself it's actually fairly secure. Most of the problem is that passwords are either easy for computers to crack or hard for humans to remember. The middle ground has disappeared as computational power has increased.

Fortunately, it is entirely unnecessary to remember your Wifi password (provided that you trust your devices…).

Create a near-random 63 char password, put it in a text file on a USB key and possibly print it out as a QR code and you’ll never have to worry about either entering it by hand or it getting cracked by that strange kid across the street.

Re: Google knows nearly every Wi-Fi password in the world

#128

Post by ebbv »

tytso wrote: post #52

The author is worried about WiFi passwords? If you trust that your WiFi is secure in general, you're in trouble. WPS is horribly insecure, for example, and that's what most home users use. Most user-chosen passwords are incredibly easy to guess for another. The better thing to do is to assume that your network traffic is always under surveillance (since the NSA is tapping Tier1 network providers), and to encrypt ever…

Yeah and those locks on your doors are a joke! Why are you pretending your home has an expectation of privacy? So dumb! Of COURSE anybody can just come into your house any time they want.

Re: Google knows nearly every Wi-Fi password in the world

#129

Post by grandalf »

ebbv wrote: post #128
tytso wrote: post #52

The author is worried about WiFi passwords? If you trust that your WiFi is secure in general, you're in trouble. WPS is horribly insecure, for example, and that's what most home users use. Most user-chosen passwords are incredibly easy to guess for another. The better thing to do is to assume that your network traffic is always under surveillance (since the NSA is tapping Tier1 network providers), and to encrypt ever…

Yeah and those locks on your doors are a joke! Why are you pretending your home has an expectation of privacy? So dumb! Of COURSE anybody can just come into your house any time they want.

Not sure if you were joking, but you are right:

http://en.wikipedia.org/wiki/Lock_bumping

Re: Google knows nearly every Wi-Fi password in the world

#130

Post by srollyson »

tytso wrote: post #52

The author is worried about WiFi passwords? If you trust that your WiFi is secure in general, you're in trouble. WPS is horribly insecure, for example, and that's what most home users use. Most user-chosen passwords are incredibly easy to guess for another. The better thing to do is to assume that your network traffic is always under surveillance (since the NSA is tapping Tier1 network providers), and to encrypt ever…

Honestly, I use WEP encryption because I know that WiFi security is a house of cards in general. As you've said, it's enough to prevent the typical user from leeching bandwidth.

The nice thing about using WEP is that if someone does end up using my network for something nefarious and I end up holding the bag for it, I (or an expert witness) can point out that WEP is known to be vulnerable in court giving me an out.

Post reply on HN