Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Trying to deploy WPA3 on my home network

gist.github.com

Post reply on HN
Print view View original

21–29 of 29 posts

Re: Trying to deploy WPA3 on my home network

#21

Post by jtl999 »

arghwhat wrote: post #16
jtl999 wrote: post #8

Earlier quoted context omitted.

I remember the creator of CopperheadOS claiming the "Nexus 5" (which is EOL) is not secure because of hardware (baseband?) vulnerabilities that wouldn't be trivial to fix. Citation: https://twitter.com/DanielMicay/status/1058103333414522880

Basebands are generally terrible black boxes. Even for new devices, they're a major security concern.

Agreed.

Does anyone know anything about the GSMK Cryptophone 500? It's appears to be a modified Galaxy S3 with a heavily custom ROM and can double as an IMSI catcher. I wonder. Did they RE the baseband or replace it with their own?

https://www.cryptophone.de/en/products/mobile/cp500/

Interesting.

Re: Trying to deploy WPA3 on my home network

#22

Post by zokier »

xenithorb wrote: post #20
zokier wrote: post #6

Earlier quoted context omitted.

Or just use WPA2-Enterprise, afaik there are no pressing security needs to upgrade to WPA3 if you are using EAP, and it is widely supported out of the box

The problem with this I found for home use is that IoT devices don't typically support enterprise modes. And without PSK you just flat-out can't use those devices with WiFi

Still, I imagine lot more devices support WPA2-EAP over WPA3-EAP that OP recommended.

Re: Trying to deploy WPA3 on my home network

#23

Post by IshKebab »

chaosite wrote: post #13
maxyme wrote: post #9

Earlier quoted context omitted.

They also support a mode where they will use WPA3 when supported and fall back to WPA2 when there isn't device support.

That's just WPA2 with extra steps.

Not really - if all of your devices use WPA3 the attacker won't be able to brute force your password for example. You might think "if all your devices support WPA3 then why not disable WPA2?". The obvious reason is you might occasionally want to use WPA2 without fiddling around with router settings, e.g. if guests want to use your WiFi without recompiling their phone's kernel.

Then another obvious but naive response is "then your security is no better than WPA2 anyway" but hopefully it's clear why that isn't the case in the real world.

Re: Trying to deploy WPA3 on my home network

#24

Post by voltagex_ »

jtl999 wrote: post #21
arghwhat wrote: post #16

Earlier quoted context omitted.

Basebands are generally terrible black boxes. Even for new devices, they're a major security concern.

Agreed. Does anyone know anything about the GSMK Cryptophone 500? It's appears to be a modified Galaxy S3 with a heavily custom ROM and can double as an IMSI catcher. I wonder. Did they RE the baseband or replace it with their own? https://www.cryptophone.de/en/products/mobile/cp500/ Interesting.

I seem to remember there being relatively complete access to the S3 baseband at one point. Not sure I'd use it as a daily driver though. The S3 had big problems with the eMMC suddenly dying.

Re: Trying to deploy WPA3 on my home network

#25

Post by [deleted] »

xenithorb wrote: post #20
zokier wrote: post #6

Earlier quoted context omitted.

Or just use WPA2-Enterprise, afaik there are no pressing security needs to upgrade to WPA3 if you are using EAP, and it is widely supported out of the box

The problem with this I found for home use is that IoT devices don't typically support enterprise modes. And without PSK you just flat-out can't use those devices with WiFi

[deleted]

Re: Trying to deploy WPA3 on my home network

#26

Post by jtl999 »

voltagex_ wrote: post #24
jtl999 wrote: post #21

Earlier quoted context omitted.

Agreed. Does anyone know anything about the GSMK Cryptophone 500? It's appears to be a modified Galaxy S3 with a heavily custom ROM and can double as an IMSI catcher. I wonder. Did they RE the baseband or replace it with their own? https://www.cryptophone.de/en/products/mobile/cp500/ Interesting.

I seem to remember there being relatively complete access to the S3 baseband at one point. Not sure I'd use it as a daily driver though. The S3 had big problems with the eMMC suddenly dying.

Heh maybe.

I am aware of the eMMC issues. Not to mention a phone from those days is slower then current phones, although I don't know much that matters with the custom ROM they use.

Re: Trying to deploy WPA3 on my home network

#27

Post by voltagex_ »

ech000 wrote: post #11
jtl999 wrote: post #8

Earlier quoted context omitted.

I remember the creator of CopperheadOS claiming the "Nexus 5" (which is EOL) is not secure because of hardware (baseband?) vulnerabilities that wouldn't be trivial to fix. Citation: https://twitter.com/DanielMicay/status/1058103333414522880

Can anyone recommend a post that introduces these kind of issues for Android outsiders? I assumed Android ROMs carry a fully fledged distribution, including the kernel and firmware. Sure, the latter might be out of date. When I tried digging into the question "where does this so-called open source come from", I stumbled upon Kernels that basically have one commit adding the whole blob. Is the ROM merely the applicati…

The ROM is kinda an inaccurate term for the whole "blob" of binaries that gets copied to eMMC (or similar) storage. This can include multiple partitions, firmware updates (including for your baseband) etc.

The device kernel is a fork of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin... or more accurately https://source.android.com/devices/architecture/kernel/andro... at the end of the day. The "whole thing as one commit" is just people not caring enough to maintain source history.

Treble seems to mean that the software can be updated separately from the drivers and the firmware - https://www.androidauthority.com/project-treble-818225/, it could actually make things worse in terms of out of date drivers and firmware.

Re: Trying to deploy WPA3 on my home network

#28

Post by est31 »

voltagex_ wrote: post #3

Worried enough about security to deploy WPA3, but still uses a Galaxy S2? Even with LineageOS, aren't you still using ancient device drivers?

Author here, sorry I only saw this late.

Yes, the drivers are ancient, and probably have a ton of security vulnerabilities. Has the general situation improved in recent years? To me it seems that hardware vendors generally don't care about these issues at all. Which phone would you say has secure drivers?

Re: Trying to deploy WPA3 on my home network

#29

Post by voltagex_ »

est31 wrote: post #28
voltagex_ wrote: post #3

Worried enough about security to deploy WPA3, but still uses a Galaxy S2? Even with LineageOS, aren't you still using ancient device drivers?

Author here, sorry I only saw this late. Yes, the drivers are ancient, and probably have a ton of security vulnerabilities. Has the general situation improved in recent years? To me it seems that hardware vendors generally don't care about these issues at all. Which phone would you say has secure drivers?

Hey, the replies here about CopperheadOS are pretty good for info on this.

It's a tradeoff - new phones are more secure, but they're also secured against you, e.g. if I OEM unlock my Galaxy Note 9, a bit is set permemnantly that could be used to determine whether the phone gets a warranty repair.

To get back on track, you may want to have a look to see if the "board support package" is still supported. You're well out of vendor support and it looks like the last commit to https://github.com/LineageOS/android_kernel_samsung_smdk4210... was 2013.

The gold standard would be a phone that runs a very-close or actually mainline Linux kernel, but I don't think we're there yet.

Nexus devices were fantastic, but they're gone now. Pixel, I guess, but I was scared off after the 5X and 6P hardware issues.

Post reply on HN