Earlier quoted context omitted.
I wish more consumer devices supported multiple PSKs on the same SSID. It's a handy feature much better for airtime than creating multiple separate SSIDs and much better for sanity than 802.1x user or cert auth.
Doing multiple PSK / PPSK is not compatible with WPA3 (at least as supported by most APs today*, as WPA3 requires management frame encryption), so you limit to WPA2 only, therefore you're better off just having multiple SSIDs with WPA3 support. (Also that way you can have a "secure" network which is WPA3 Personal only, much easier than using WPA Enterprise and gives a reasonable level of security for home use.) *: In…
WPA3 Enterprise 192-bit mode at home
151–160 of 201 posts
Re: WPA3 Enterprise 192-bit mode at home
#152Earlier quoted context omitted.
> unhealthy for the human brain Fortunately, wired networking continues to work reliably, unlike frequently "New and Improved" wireless increments.
Honestly, wired networking can be less secure, depending on your threat model. Not everyone lives in some kind of a physical fortress; breaking into someone's house is usually a simple matter of some lock picks that you can buy off the Internet, then compromising the wired network just requires installing an interceptor, not to mention stuff like hardware keyloggers. The truly paranoid user needs to check all their w…
The human occupants of homes and businesses may be surprised by IEEE 802.11bf through-wall imaging of human activity by WiFi 7 Sensing, including keystrokes, breathing, motion and location in rooms.
Should the sale of new wireless imaging powers come with vendor responsibility and liability to secure those powers, or should that be delegated to the feelings of customers?
Will an enterprise VPN be sufficient to protect corporate assets which rely on the integrity of devices located in WFH employee homes, with walls transparent to WiFi 7 Sensing?
Re: WPA3 Enterprise 192-bit mode at home
#153TLS 1.2 and not 1.3? Could a swore we moved to 1.3 a while ago Also many I'm just not familiar enough with cryptography but that key size seems kinda small.....am I wrong? Ik RSA uses a different algorithm but RSA it isn't uncommon to see keys 1024 or larger in size. I generated a key of 65,536 and 131,072 bits a few times to see if it would work or break any applications I was using. Also just to I can say "yeah bac…
Re: WPA3 Enterprise 192-bit mode at home
#154Earlier quoted context omitted.
> I wish more consumer devices supported multiple PSKs on the same SSID Could you name any enterprise APs that do this, short of running your own custom AP software? As far as I know (would love to be corrected on this), Unifi APs can't do this, and they're at the very least "prosumer".
It seems that feature has been added in a recent update. https://community.ui.com/releases/UniFi-Network-Application-...
However I guess this feature is WPA3 only which means I'll still need the SSIDs for years to come :'(
Re: WPA3 Enterprise 192-bit mode at home
#155Lots of institutions have Eduroam set so that students (and academics, and everybody else like me) are just authenticating against their Windows domain controllers, so going to "192-bit mode" would mean ripping out a bunch of stuff, replacing it, writing fresh documentation, testing thoroughly and then authorising, but since we're talking about the backend every educational establishment in the world would need to do this before you can ship WPA3 192-bit mode. So, that's not going to happen.
Re: WPA3 Enterprise 192-bit mode at home
#156The point is that "NSA grade" likely means "NSA accessible". The major difference between WPA2 and WPA3 is the individual encryption. My guess would be that there is some backdoor during SAE and they could force a complete reconnect by temporarily jamming/disrupting all users on a network.
[1] https://arstechnica.com/information-technology/2013/09/the-n...
[2] https://twitter.com/matthew_d_green/status/14334701097425182...
Re: WPA3 Enterprise 192-bit mode at home
#157Earlier quoted context omitted.
Saying that it is like WPA3 Enterprise after the initial pairing is somewhat unfair. The trust in the initial pairing is a large part of the draw. The trust on first use model you describe is similar to using a self signed certificate on a website. Sure, after you connect and trust the self signed certificate your connection to the server can use the same algorithms that it would have used with a trusted CA. But for…
SSH does mostly fine with trust-on-first-use.
Re: WPA3 Enterprise 192-bit mode at home
#158Personally I've essentially given up on depending on WiFi auth for anything important. For general access, segmenting various users, IOT etc for performance, monitoring and light privacy WPA-EAP and PPSKs with VLANs does some work as an initial first layer fine and in a simple reliable way that works with everything. It's a low pass filter. But for all sensitive access I use internal Wireguard now. WiFi auth gets a c…
If you feel strongly about it use a vpn. Wireguard is nice for this indeed. And indeed some IOT has pretty shit network security so you might want to care about securing that in your home or office network. But beyond that, your exposure should be pretty minimal even if you don't use a VPN.
And reality check: most people aren't network security experts. I'm certainly not one even though I've been active as a developer for a few decades and kind of know what I'm doing.
So, IMHO WPA3 is a waste of time. I don't care about it. It might be more secure by some unknowable degree. But since it is unknowable (for me), I can't be bothered to care. I'd on principle treat it as just as insecure as WPA 1 & 2. Or no network security at all. Which is good enough for me to run my SSL connections over them. And even if it is super duper secure, I don't necessarily trust the Chinese manufacturers supplying the router chips and firmware to do the right thing. In my experience, the vast majority of routers run years out of date firmware supplied via a very shady chain of suppliers for chips and software that I definitely don't trust.
So, WPA 3 is a security blanket. A false sense of security. If you have reasons to be paranoid, go for it. It probably helps. Just like tin foil hats, Faraday cages, and all the rest. I don't use those either. But for the rest of us who aren't network security experts with operator supplied routers at home and working in office environments as well as on the go with random third parties maybe taking care about network security a little bit in the networks we connect to, I treat all networks equally: 100% untrusted. I don't care about what acronym soup applies to the network or how shit-hot the graybeard that manages it is. I just blindly assume network security is mediocre at best and connect anyway. For me network security is about being able to use my laptop safely in a completely untrusted network. Because that's where I use it all of the time.
Re: WPA3 Enterprise 192-bit mode at home
#159"NSA grade" irks me - to think these guys have your best interest at heart. In the 1970's they weakened DES [1]. In 2015 the NSA created a backdoor and pressured companies into installing it [2]. In 2016 you had the leaked tools stolen and used by the Shadow Brokers / Equation Group [3]. More recently the NSA made arguments against double encryption to combat weaknesses in potential quantum-safe encryption algorithms…
Re: WPA3 Enterprise 192-bit mode at home
#160> However, if you want a home network that’s simple to configure, easy for your guests to borrow, hassle-free, and that all of your Smart Home gadgets can connect to, then you should close this tab now Or do what I do: run multiple APs. I have my primary one, which is very tightly secured and monitored, and only gives access to my local VPN. I have a guest one, which is only as secure as any average AP and gets you i…
You can run multiple SSIDs on the same AP and segment your networks with VLANs. No need to buy multiple APs unless you need the coverage.
And to donate to OpenWRT, of course!