Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WPA3 Enterprise 192-bit mode at home

smallstep.com

Post reply on HN
Print view View original

191–200 of 201 posts

Re: WPA3 Enterprise 192-bit mode at home

#191

Post by soraminazuki »

callalex wrote: post #188
soraminazuki wrote: post #148

Earlier quoted context omitted.

That's the wrong question to ask. Instead, we should be asking ourselves, why is it after all these years that we still don't have secure and easy to use multi-account WiFi networks with per-account configurable security policies in our homes? It's the current state of things that's unhealthy, not the people demanding better. Security measures should be evaluated based on their own merits, not by appealing to friends…

> we should be asking ourselves, why is it after all these years that we still don't have secure and easy to use multi-account WiFi network But that’s exactly what we do have! Any old router/AP combo you buy at the store or get from your ISP will let you set up a normal network and an isolated Guest network. All with a nice UI/UX that involves checking one box and choosing a password. Considering WPA3 to be insecure…

When I wrote "multi-account WiFi networks with per-account configurable security policies," I meant WPA Enterprise style networks. Having 2 SSIDs and 2 passwords is a horribly insufficient setup which doesn't fit my description. That feels just as secure as running a Tor exit node right in my home, since there's no separation in the primary network and the password is bound to leak the more you share it to people.

Re: WPA3 Enterprise 192-bit mode at home

#192

Post by oynqr »

simoncion wrote: post #170
wkat4242 wrote: post #81

> Because you need certificates, your Smart Home devices won’t support WPA3 Enterprise. Home printers won’t support it. A lot of things won't support it. In fact, it’s a miracle that some consumer-grade routers and access points support it at all. It's not really a miracle. It's just much easier to do from the access point side because the whole authentication process is basically offloaded to the radius server. It d…

> On client devices however it's a huge pita building a mechanism to manage client certificates... Yep. This is why "replacing" PSK-protected WiFi with EAP-PEAP, and open WiFi with EAP-TLS was absolutely THE way for the WiFi people to go. (With EAP-PEAP you have the option of setting (and revoking) per-device credentials. With EAP-TLS, you get an open-to-anyone network with data encrypted over the air.) Despite what…

EAP-PEAP without certificate verification is a surefire way to leak incredibly weak hashes of used passwords.

Re: WPA3 Enterprise 192-bit mode at home

#193

Post by JohnFen »

lolinder wrote: post #14
outworlder wrote: post #6

Earlier quoted context omitted.

And in this case the coverage would be even worse unless they duplicated all APs for both networks. It's probably much more cost effective to do what you suggest, and that's exactly what I do. Multiple SSIDs (one for the household, another for IOT stuff, another for work and another for guests) and control access via VLANs.

Is there a reason you split IoT stuff off of the guest network? On my network we just have a guest network which denies LAN access to anything connected to it, but I'm wondering if there's a good reason to split IoT off entirely.

> Is there a reason you split IoT stuff off of the guest network?

I'd do it so that I could more easily prevent the IoT stuff from phoning home.

Re: WPA3 Enterprise 192-bit mode at home

#194

Post by mmalone »

andrewaylett wrote: post #172
mmalone wrote: post #76

Earlier quoted context omitted.

I work at smallstep. For home wifi this is totally overkill. Better security is always nice but, in this case, there's a significant usability & interop tradeoff for home use (though that may change over time... we'll see). For business / enterprise settings, this has real value. Distributing a password to everyone doesn't scale and alternative EAP methods have huge security problems. For managed devices, certs can b…

PEAP can still require a trusted server certificate -- getting set up with MDM is a pain, and scaling by hand is also a pain, but you can (and I do) set up my devices to require a specific valid SAN on the RADIUS connection. No extra certificate trust required, if the RADIUS server has a certificate that chains up to the default trust store. I remain disappointed that there's no standard mechanism for mapping between…

Just to clarify, are you describing EAP-PEAP or EAP-TTLS wrapping PEAP? I'm still learning a lot of this stuff... but, my understanding is that PEAP doesn't do TLS but TTLS + PEAP does. Right?

Fact remains, though, that users will probably bypass any certificate warnings (if allowed) and send their passwords to rogue APs. EAP-TLS mitigates this. Definitely pros & cons, but that's a clear win for EAP-TLS.

There are a lot of things that'd be nice to see in Wifi. Binding the SSID is an interesting one, though I suspect the folks working on this stuff were reluctant to rely on (and trust) the Web PKI CAs. If you're gonna push your own root cert, you might as well push a RADIUS SAN along with it, I guess.

Re: WPA3 Enterprise 192-bit mode at home

#195

Post by etskinner »

forward1 wrote: post #83
Terr_ wrote: post #75

Earlier quoted context omitted.

It's only equivalent if "the password" is fixed and can be used for an indefinite series of "first" connections. In contrast, imagine that the thing the guest enters into their laptop is a freshly-generated random code which expires within X minutes and can only be used once.

That would be an improvement, but authentication would still be based on a phishable credential vs a cryptographic assertion, and ultimately exploited in the enterprise environment it was designed for.

The enterprise environment would run the more secure version of it, and the prosumer people would run the less secure version. Doesn't mean the secure version is any less secure

Re: WPA3 Enterprise 192-bit mode at home

#196

Post by xyst »

hunter2_ wrote: post #100
xyst wrote: post #94

I would like to see something like this for “home” setups but it would have a much better user experience: 1) user attempts to connect to “home-wifi” 2) owner of “home-wifi” gets notification to confirm or deny access request 3) owner can optionally verify further 4) if approved, then between AP and client device it will create the client certificates with short expiration dates 5) if denied, then no access granted.…

Wardrivers with sufficient randomization to avoid any denylist you implement will get very annoying if you let those notifications interrupt you. Maybe only receive such requests while you expect guests.

Annoying yes! And I do like your solution (only get notification when expecting guests). But also would be nice to keep a log of those requests.

APs only have so much range (and I think you can configure it to cover a specific area). So can very easily find out who or what is trying to get in.

Re: WPA3 Enterprise 192-bit mode at home

#197

Post by xyst »

callalex wrote: post #108
xyst wrote: post #94

I would like to see something like this for “home” setups but it would have a much better user experience: 1) user attempts to connect to “home-wifi” 2) owner of “home-wifi” gets notification to confirm or deny access request 3) owner can optionally verify further 4) if approved, then between AP and client device it will create the client certificates with short expiration dates 5) if denied, then no access granted.…

It’s a crying shame that WPS was fumbled so hard. It was a consumer friendly idea.

That was the “touch a button on the router” to connect, right?

Idea was great in theory but in practice routers were often placed in the most inaccessible parts of a house (closet, ceilings, or walls)

Re: WPA3 Enterprise 192-bit mode at home

#198

Post by lolinder »

JohnFen wrote: post #193
lolinder wrote: post #14

Earlier quoted context omitted.

Is there a reason you split IoT stuff off of the guest network? On my network we just have a guest network which denies LAN access to anything connected to it, but I'm wondering if there's a good reason to split IoT off entirely.

> Is there a reason you split IoT stuff off of the guest network? I'd do it so that I could more easily prevent the IoT stuff from phoning home.

That makes sense. In my case, I don't have a lot of IoT, but what I do have is entirely cloud based—if there's no phoning home then there's no point to having the device.

Re: WPA3 Enterprise 192-bit mode at home

#199

Post by andrewaylett »

mmalone wrote: post #194
andrewaylett wrote: post #172

Earlier quoted context omitted.

PEAP can still require a trusted server certificate -- getting set up with MDM is a pain, and scaling by hand is also a pain, but you can (and I do) set up my devices to require a specific valid SAN on the RADIUS connection. No extra certificate trust required, if the RADIUS server has a certificate that chains up to the default trust store. I remain disappointed that there's no standard mechanism for mapping between…

Just to clarify, are you describing EAP-PEAP or EAP-TTLS wrapping PEAP? I'm still learning a lot of this stuff... but, my understanding is that PEAP doesn't do TLS but TTLS + PEAP does. Right? Fact remains, though, that users will probably bypass any certificate warnings (if allowed) and send their passwords to rogue APs. EAP-TLS mitigates this. Definitely pros & cons, but that's a clear win for EAP-TLS. There are a…

I have EAP-PEAP wrapping MSCHAPv2[1]. You might still be learning, but I suspect you already know more than I do about this stuff because I pretty much just stuck the right settings into the Unifi controller and poked at it until it started working :).

On Android, I set "use system certificates" and "Domain: radius.jumpcloud.com"[0]. On Mac, I'm given the option to verify the certificate and I can see that it chains up to their publicly-trusted CA. The vendor seems to assume that I'll be hard-coding their certificate in my MDM, but I've not needed to. The Mac wasn't happy when the certificate was rotated, but the Android and Linux devices I have were perfectly content.

My AP controller also has a valid certificate, but it's not in play. As a user, I need a username and password for MSCHAPv2, and to convince the client that the certificate is OK -- which is easy, when the client is willing to use the system trust store :). I'm not provisioning client certificates, so I don't need to generate a root for that purpose. And it's for home, so I only need to worry about provisioning for two people.

I really don't like setting trust bits on root certificates, even ones that I generated myself. Been there, would prefer a bit more certainty that I'm not being spoofed by my own leaked root certificate. I'm much happier trusting Web PKI than I am trusting anything of my own that's sufficiently accessible as to be usable for this kind of thing.

[0]: Yep, I'm using a hosted provider that's not your employer, sorry :P.

[1]: WPA-3 SAE is nice, and it would be really nice if we could use something including that for the EAP. SAE solves the spoofing issue for non-Enterprise use-cases, unless someone trusted with the key goes rogue. Per-user SAE could mean that the rogue user can only spoof themselves, I think?

Re: WPA3 Enterprise 192-bit mode at home

#200

Post by wahnfrieden »

wishfish wrote: post #106
hunter2_ wrote: post #100

Earlier quoted context omitted.

Wardrivers with sufficient randomization to avoid any denylist you implement will get very annoying if you let those notifications interrupt you. Maybe only receive such requests while you expect guests.

That would be the best way. Turn on notifications when you're expecting a new device. Turn off notifications and auto-deny the rest of the time.

Hi- Did you release your edtech iOS app (the SwiftUI one you posted about)?
Post reply on HN