WiFi deauthentication attacks and home security

I doubt Ring devices have the local storage to do this.

Do you think $50 the going rate to convince the average person to record their neighbors?

It’s a hard question because of the imprecision of the law. If it’s a potential problem, talk to counsel.

From a security/technology standpoint I do not see any gain in using deauthentication packets against others. Any (half decent) skilled enough attacker will find ways to counteract these (e.g. by enabling PMF/WPA3 or using a stronger signal) or just leaving the property if a movable end device is attacked. A network and end devices are secure by design or they are not. Separation of privileges, different accounts, multi factor authentication, certificates, modern protocols, no single password policy… Making users, superiors or yourself believe that one is “secure” because of using deauthentication packets will actually result in the opposite because it will hide the existing structural security issues in your network/end devices and give a false sense of security.

What remains as argument is the service quality aspect. One wants to deliver the best wireless quality. Either because of own quality needs or because for a production environment. In either case one is using an unlicensed band that still has certain constraints based on the country. The choice of technology might just not be the right one for these needs. How about 5G? I can imagine that one can define certain rules only for a private property though. Radio waves usually do not stop on property fences. One would need to convince a court that it is 100% certain that deauthentication packets can not reach others outside of the property. I guess if the property is big enough that will work or one puts up a Faraday cage around the property or building. Still one can not send with more power as it might have health consequences for employees or visitors. Private property right is solely for how one uses the property and whom is given access to under what conditions. It does not allow a completely new rule set that conflicts with the “surrounding” law (not to mention human rights). One can still not lawfully murder a person on their private property just because the own property rules allow it.

For public universities I do not see any way to implement wireless restrictions in any lawful way. Their properties are usually public for everyone. So making rules for employees and students that can not be enforced on visitors is probably against the principle of equal treatment. Then there is the constitutional Academic Freedom in most democratic countries. Not allowing researchers or teachers to freely choose the technology suited for their needs is probably against the constitutions of these states. Also students can not be denied access to a university because of such a rule set because they have freedom of choice where and what they want to study.

Last but not least we discuss this because of a WPA design flaw that is fixed with PMF/WPA3. If we would not have had this flaw to begin with I guess we would never ever had this discussion as we do not have it for Bluetooth or wireless mice/keyboard combos or other wireless protocols that use the same frequency bands.

And finally I wonder about the mindset of the mentioned network admin’s. I can not agree if one assumes just because an organization might have more people or more important ones or richer ones or has a higher building or … to then assume might is right and enforcing it by using design flaws in network protocols. This will eventually lead to an arms race with no winner at all.

> Absolutely false

Let's first off go back to what I was replying to:

> At that point, the attacker can pose as the router and collect the password hash.

By claiming my correction is "absolutely false" you're asserting that the above statement is "absolutely true." But even your technically unsound correction doesn't actually address the underlying inaccuracy of the original statement or why you seemingly believe it is "absolutely true."

It is also pretty clear from your reply that you're attempting to muddy the waters by conflating the PTK with the PSK or any other "password." The PTK isn't a password. It isn't like a password, and in order to derive it you need additional information which you need to attack (which is easier than attacking the PSK itself, thus WPA3's improvements, but doesn't make the above statement technically sound or true).

Your post reads like you decided to correct before having any corrections to actually make then tried to muddy the topic as much as possible in the hope that others would be fooled. Plus is "collect the password hash" really a hill worth dying on for WiFi Auth? That's obviously an unsound technical claim, that isn't how the protocol works at all (and you seemingly must know that given your knowledge).

> Also what you describe with RADIUS is incorrect as well but there are too many ways to configure 802.1x and RADIUS to cover all of why in a comment.

So it is "incorrect" because I simplified it rather than describing the process in intricate technical detail? And you won't point out why it was "incorrect" because it is too technically difficult..? K.