Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WPA3 Enterprise 192-bit mode at home

smallstep.com

Post reply on HN
Print view View original

141–150 of 201 posts

Re: WPA3 Enterprise 192-bit mode at home

#141

Post by solatic »

transpute wrote: post #120
callalex wrote: post #112

Earlier quoted context omitted.

What is your threat model to warrant this effort at home? Are your work-related machines not networking through an encrypted tunnel in some other way (that would be a serious oversight!)? What government are you living under that is routinely compromising WPA3 from mobile vans? Are friends/guests so untrustworthy that you can allow them into your home but can’t trust the VLAN implementation of your network equipment…

> unhealthy for the human brain Fortunately, wired networking continues to work reliably, unlike frequently "New and Improved" wireless increments.

Honestly, wired networking can be less secure, depending on your threat model. Not everyone lives in some kind of a physical fortress; breaking into someone's house is usually a simple matter of some lock picks that you can buy off the Internet, then compromising the wired network just requires installing an interceptor, not to mention stuff like hardware keyloggers. The truly paranoid user needs to check all their wired connections before each and every use, which few people do. They will need to seal the cases of each of their machines with some kind of tamper-evident seal, with transparent cases to ensure that nothing has been added internally with countermeasures taken against the tamper-evident seal, including the cases on the video cameras that they have set up to try and catch would-be intruders.

The point remains, people either generally feel safe in their homes, or they don't. If you do, then honestly a lot of these security measures are just overkill. If you don't, then you should deal with the root cause instead of its symptoms.

Re: WPA3 Enterprise 192-bit mode at home

#142

Post by whatindaheck »

fragmede wrote: post #134
ghostpepper wrote: post #69

Earlier quoted context omitted.

Would love to hear more about how you provision wireguard. I have a simple VLAN setup where I can open a tunnel from my "guest/home" network to my "lab" network (ie. docker hosts, desktop PCs that I use for development, etc) and a second tunnel from the lab network to the network that can access mgmt interfaces, however it's all mostly manual (ie. sudo wg-quick up in a terminal)

Tailscale. It's Wireguard under the hood but with a company doing got UX on top.

I’m familiar with Tailscale but could you provide more detail on how to use it as an authentication method?

The two ways I see:

On my home server, only allow incoming connections from the Tailnet. However, this seems lockout prone.

Or I could create a VLAN and put all hardwired devices in it. All running Tailscale. But this wouldn’t cover securing my laptop (has to be on WiFi in my situation). This still seems lockout prone?

Additionally, the router is still exposed “normally” and can be compromised without requiring VPN access

Sorry if this post is a bit of A mess. Thanks.

Re: WPA3 Enterprise 192-bit mode at home

#143

Post by e12e »

mmalone wrote: post #91
e12e wrote: post #73

Earlier quoted context omitted.

Right. I think it makes a lot of sense to integrate Radius in your product. But the only way giving full trust to a third party ca could be dubbed "NSA-grade" - would be that it puts you within the reach of the NSA by way of an NSL to that third party? (I'm not generally aiming to mitigate state level actors, but you put "NSA-grade" in the headline...).

Well... the title is hyperbolic (as titles are wont to be), but the goal was to configure Wifi that aligns with the CNSA Suite[1] / CNSSP 15[2], which I think is fair to call "NSA-grade" since they wrote the standard. If the NSA wants to get a certificate that your system trusts there are already dozens of organizations with root certs in your system trust store that they can strongarm. Most organizations can't affor…

> And, we also have on-prem and open source if you really need something air-gapped ;)

You support a self-hosted foss solution that enables on-prem wpa3 eap tls?

Re: WPA3 Enterprise 192-bit mode at home

#144

Post by philsnow »

lolinder wrote: post #14
outworlder wrote: post #6

Earlier quoted context omitted.

And in this case the coverage would be even worse unless they duplicated all APs for both networks. It's probably much more cost effective to do what you suggest, and that's exactly what I do. Multiple SSIDs (one for the household, another for IOT stuff, another for work and another for guests) and control access via VLANs.

Is there a reason you split IoT stuff off of the guest network? On my network we just have a guest network which denies LAN access to anything connected to it, but I'm wondering if there's a good reason to split IoT off entirely.

I have a separate VLAN for things like security cameras with perhaps-dodgy firmware, and a firewall rule that drops connections that devices on that VLAN try to establish. They have no business connecting anywhere, when I want to see what they see I'll ask them.

Re: WPA3 Enterprise 192-bit mode at home

#145

Post by privacyking »

Gh0stRAT wrote: post #24
lolinder wrote: post #14

Earlier quoted context omitted.

Is there a reason you split IoT stuff off of the guest network? On my network we just have a guest network which denies LAN access to anything connected to it, but I'm wondering if there's a good reason to split IoT off entirely.

I want my guests to be able to cast to my TV, add songs to the Spotify queue, etc. As far as I can tell, these sorts of features work via broadcast frames and thus require the relevant devices to be on the same subnet. Things like my printer and wifi-connected grill live on a much more restrictive VLAN. (with some firewall rules to allow devices on the trusted network to still print to my printer's hard-coded IP addr…

You can do it some routers (e.g. opnsense) that let you retransmit that (e.g. with UDP broadcast relay). The main downside is that you have to set it up for each type, and open ports, troubleshoot a lot, waste many hours, etc.

I used to do this but it became too much of a hassle.

Re: WPA3 Enterprise 192-bit mode at home

#146

Post by callalex »

mcv wrote: post #57
toast0 wrote: post #9

Earlier quoted context omitted.

It's not unusual to run multiple APs on a single SSID. Your scheme doesn't work for that without coordination between the APs. Also, it means replacing an AP would require reconfiguring all the clients.

Isn't coordination between APs something that Ubiquiti APs already do?

They have a rather clean implementation of standards called RADIUS and 802.11r, if that’s what you are talking about. It’s not unique to one manufacturer, that’s the whole point of Wi-Fi Alliance standards.

Re: WPA3 Enterprise 192-bit mode at home

#147

Post by iforgotpassword »

postpawl wrote: post #27
iforgotpassword wrote: post #23

On the topic of WPA3, I recently found that the old iPad 2 or 3 doesn't connect to wifi if it's set to WPA3+2, it only works in pure WPA2 mode. Tried on two different AP vendors, though I have no idea if they might use the same chip or driver or something. It's the only device that didn't work in this mode, everything else was fine, including some whacky iot devices like picture frames and an inverter.

You’re sure it’s not actually the PMF setting causing that? More details here: https://www.reddit.com/r/Ubiquiti/comments/rq6jtr/psa_if_you...

Hm, in that post they say all of the 2.4ghz devices had the problem, while in my case it was just the iPad, and it was broken on both bands. But maybe it still was this (or a similar) issue. I only have access to one of the two APs right now, and there is pretty much nothing configurable regarding WiFi security apart from selecting from WPA1+2, WPA2 only, WPA2+3.

Re: WPA3 Enterprise 192-bit mode at home

#148

Post by soraminazuki »

callalex wrote: post #112
xoa wrote: post #64

Personally I've essentially given up on depending on WiFi auth for anything important. For general access, segmenting various users, IOT etc for performance, monitoring and light privacy WPA-EAP and PPSKs with VLANs does some work as an initial first layer fine and in a simple reliable way that works with everything. It's a low pass filter. But for all sensitive access I use internal Wireguard now. WiFi auth gets a c…

What is your threat model to warrant this effort at home? Are your work-related machines not networking through an encrypted tunnel in some other way (that would be a serious oversight!)? What government are you living under that is routinely compromising WPA3 from mobile vans? Are friends/guests so untrustworthy that you can allow them into your home but can’t trust the VLAN implementation of your network equipment…

That's the wrong question to ask. Instead, we should be asking ourselves, why is it after all these years that we still don't have secure and easy to use multi-account WiFi networks with per-account configurable security policies in our homes? It's the current state of things that's unhealthy, not the people demanding better.

Security measures should be evaluated based on their own merits, not by appealing to friendship or any other relationships. We can lock our front doors and have a healthy relationship with our neighbors! These two things aren't mutually exclusive. Though I will add that trusting government authorities not to routinely abuse their powers is a hard ask given their track record all across the globe, even in democratic countries.

WiFi is ubiquitous and is used to exchange sensitive information 24/7. Its compromise can result in financial, reputational, or even physical risk. Considering that raw signals can be intercepted outside of our homes, devices on the network should at the very least be mutually authenticated and their connections encrypted.

Also, let's not forget about the devices too. Say you trust the people you let into your home. Can you also trust their devices and the software that runs on it? Do you trust your work laptop and its "security" software to respect your privacy? Do you even fully trust your own devices? Do you have faith in current commercial hardware and software to respect boundaries, or even comprehend the concept of user ownership? Because the answer to all these questions increasingly sounds like a "no."

Re: WPA3 Enterprise 192-bit mode at home

#149

Post by [deleted] »

londons_explore wrote: post #8

I want to know why WPA3 doesn't have a mode where a password is used for the initial connection , but then the client and AP generate a keypair and each store their half and use that for all future connections. For all future connections, the AP can validate every client, and the client can validate that it is connecting to the same AP. The AP could have an interface to 'revoke' access to any single client if necessa…

[deleted]

Re: WPA3 Enterprise 192-bit mode at home

#150

Post by iforgotpassword »

lolinder wrote: post #103
iforgotpassword wrote: post #19

Earlier quoted context omitted.

I guess it depends on what kind of friends you have, but assuming iot devices are insecure rubbish, I wouldn't want them on the same network as guests. But then again you might want to turn on client isolation for the guest network, so that wouldn't really be an issue.

Yeah, I have guests all isolated from the LAN already.

Client isolation means the clients on the network can't reach each other. This would prevent them from attacking each other or your insecure iot devices. Otherwise your friends will backdoor your security camera. ;-)
Post reply on HN