Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WPA3 Enterprise 192-bit mode at home

smallstep.com

Post reply on HN
Print view View original

161–170 of 201 posts

Re: WPA3 Enterprise 192-bit mode at home

#161

Post by DateThing »

bArray wrote: post #156

"NSA grade" irks me - to think these guys have your best interest at heart. In the 1970's they weakened DES [1]. In 2015 the NSA created a backdoor and pressured companies into installing it [2]. In 2016 you had the leaked tools stolen and used by the Shadow Brokers / Equation Group [3]. More recently the NSA made arguments against double encryption to combat weaknesses in potential quantum-safe encryption algorithms…

On your first point, I’m not aware of NSA weakening of DES. Only in-fact strengthening it against differential crypto analysis. Your link seems to echo that. Were you thinking of something else?

Of course, the fact the NSA was aware of differential crypto analysis some years before the rest of us is another thing…

Re: WPA3 Enterprise 192-bit mode at home

#162

Post by bArray »

DateThing wrote: post #161
bArray wrote: post #156

"NSA grade" irks me - to think these guys have your best interest at heart. In the 1970's they weakened DES [1]. In 2015 the NSA created a backdoor and pressured companies into installing it [2]. In 2016 you had the leaked tools stolen and used by the Shadow Brokers / Equation Group [3]. More recently the NSA made arguments against double encryption to combat weaknesses in potential quantum-safe encryption algorithms…

On your first point, I’m not aware of NSA weakening of DES. Only in-fact strengthening it against differential crypto analysis. Your link seems to echo that. Were you thinking of something else? Of course, the fact the NSA was aware of differential crypto analysis some years before the rest of us is another thing…

> Of course, the fact the NSA was aware of differential crypto analysis some years before the rest of us is another thing…

It is more a case that somebody else discovered it and they were forced to get in-front of it.

Re: WPA3 Enterprise 192-bit mode at home

#163

Post by neilalexander »

wkat4242 wrote: post #154
soraminazuki wrote: post #72

Earlier quoted context omitted.

It seems that feature has been added in a recent update. https://community.ui.com/releases/UniFi-Network-Application-...

I did not know that. Wow nice. Having so many SSIDs is drawing attention to all the equipment in my flat. However I guess this feature is WPA3 only which means I'll still need the SSIDs for years to come :'(

The opposite in fact. It only works with WPA2 which means that you cannot combine it with Wi-Fi 6E or use it on any WPA3-enabled SSID.

Re: WPA3 Enterprise 192-bit mode at home

#164

Post by cm2187 »

callalex wrote: post #112
xoa wrote: post #64

Personally I've essentially given up on depending on WiFi auth for anything important. For general access, segmenting various users, IOT etc for performance, monitoring and light privacy WPA-EAP and PPSKs with VLANs does some work as an initial first layer fine and in a simple reliable way that works with everything. It's a low pass filter. But for all sensitive access I use internal Wireguard now. WiFi auth gets a c…

What is your threat model to warrant this effort at home? Are your work-related machines not networking through an encrypted tunnel in some other way (that would be a serious oversight!)? What government are you living under that is routinely compromising WPA3 from mobile vans? Are friends/guests so untrustworthy that you can allow them into your home but can’t trust the VLAN implementation of your network equipment…

Thanks god for shitty wifi ranges!

Re: WPA3 Enterprise 192-bit mode at home

#165

Post by batch12 »

ransom1538 wrote: post #159
bArray wrote: post #156

"NSA grade" irks me - to think these guys have your best interest at heart. In the 1970's they weakened DES [1]. In 2015 the NSA created a backdoor and pressured companies into installing it [2]. In 2016 you had the leaked tools stolen and used by the Shadow Brokers / Equation Group [3]. More recently the NSA made arguments against double encryption to combat weaknesses in potential quantum-safe encryption algorithms…

NSA. Is that the organization of unemployed mathematicians that thinks it is 1989? The group that can't crack the super secret algorithm of "https". Yeah, that is the one, the group that is puzzled by large prime numbers.

I know I shouldn't, but... https isn't an algorithm.

Re: WPA3 Enterprise 192-bit mode at home

#166

Post by 1letterunixname »

Just run FreeRADIUS yourself. If you need your own PKI to generate certs in a manageable way, there is OPNsense [0] or smallstep's FOSS step-ca [1].

Friends don't let friends delegate AAA to an external provider like Smallstep or SSO to Okta. While outsourcing to a third party is fine for a limited test, it's not fine for anything enduring.

Once upon a time, when open, spoofable WiFi was the norm, there was a collective WiFi sharing app that took control of retail WiFi routers with WPA1 enterprise RADIUS support called Radiuz. [2]

0. https://opnsense.org

1. https://github.com/smallstep/certificates

2. https://web.archive.org/web/20040617153148/http://radiuz.net...

Re: WPA3 Enterprise 192-bit mode at home

#167

Post by andrewaylett »

scottyah wrote: post #65
tylerflick wrote: post #3

Earlier quoted context omitted.

This is exactly what I do. IoT stuff sits on its own AP attached to a jailed LAN.

So do you have to switch the wifi on your phone to access the IoT stuff?

No -- not the GP, but I have a separate IoT SSID and VLAN with a distinct subnet.

I run an mDNS repeater (or rather, my Unifi controller runs it for me) to allow discoverability across subnets. The benefit, such as it might be, is in the ability to use a stateful firewall between the subnets and that I can have a relatively secure PSK that I don't need to rotate when I rotate any of my other SSID PSKs.

Relevant to the article, I also have a WPA-3 Enterprise SSID, a WPA-3 PSK SSID and a WPA-2/3 PSK guest/children's SSID. The different subnets have different sets of rules for what they may access and which DNS settings are applied by default.

Re: WPA3 Enterprise 192-bit mode at home

#168

Post by batch12 »

whatindaheck wrote: post #142
fragmede wrote: post #134

Earlier quoted context omitted.

Tailscale. It's Wireguard under the hood but with a company doing got UX on top.

I’m familiar with Tailscale but could you provide more detail on how to use it as an authentication method? The two ways I see: On my home server, only allow incoming connections from the Tailnet. However, this seems lockout prone. Or I could create a VLAN and put all hardwired devices in it. All running Tailscale. But this wouldn’t cover securing my laptop (has to be on WiFi in my situation). This still seems lockou…

Maybe they expose the wiregard port through the firewall and VPN into a flat management network

Re: WPA3 Enterprise 192-bit mode at home

#169

Post by andrewaylett »

fiddlerwoaroof wrote: post #88

Do these enterprise modes have any advantages when it comes to connection reliability?

Absent 802.11r, they might improve hand-off between APs.

The disadvantage of WPA Enterprise though, especially with a hosted RADIUS server, is that it's somewhat more difficult to gain access to the network to fix things if they're broken -- if your internet connection is down then you can't authenticate, and if you can't authenticate then you can't fix whatever broke to bring the connection back up. I suspect you can guess how I discovered that problem :).

So overall: no. There might be a small increase in reliability in regular use (although I've not been able to tell the difference), but the reliance on an extra service makes for less reliable connections overall.

Re: WPA3 Enterprise 192-bit mode at home

#170

Post by simoncion »

wkat4242 wrote: post #81

> Because you need certificates, your Smart Home devices won’t support WPA3 Enterprise. Home printers won’t support it. A lot of things won't support it. In fact, it’s a miracle that some consumer-grade routers and access points support it at all. It's not really a miracle. It's just much easier to do from the access point side because the whole authentication process is basically offloaded to the radius server. It d…

> On client devices however it's a huge pita building a mechanism to manage client certificates...

Yep.

This is why "replacing" PSK-protected WiFi with EAP-PEAP, and open WiFi with EAP-TLS was absolutely THE way for the WiFi people to go. (With EAP-PEAP you have the option of setting (and revoking) per-device credentials. With EAP-TLS, you get an open-to-anyone network with data encrypted over the air.)

Despite what the nerds at Google would have you believe, using either EAP mechanism without verifying the cert of the RADIUS server is totally, completely supported by the spec. It's nuts that Google didn't (and maybe still doesn't?) let you operate in the "don't bother verifying the RADIUS server cert" mode, because in the EAP-PEAP mode it's no worse than standard PSK, and in the EAP-TLS mode it's strictly better than Open WiFi.

Post reply on HN