Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google knows nearly every Wi-Fi password in the world

blogs.computerworld.com

Post reply on HN
Print view View original

261–270 of 312 posts

Re: Google knows nearly every Wi-Fi password in the world

#261

Post by eric_the_read »

ihateaccount wrote: post #247
eric_the_read wrote: post #240

Earlier quoted context omitted.

If we're getting cranky about spelling, it's "spelled". Spelt is an ancient variety of wheat. "Gubment" is pretty silly, though.

Spelt is the correct spelling in British English (and most of the commonwealth). There is a vast world outside the US too. http://books.google.com/ngrams/graph?content=SPELT%2BSpelt%2...

I was partially taught by British teachers (I still can't spell 'neighbour' without a 'u' and my 'colour' waffles fairly evenly with and without it). I just can't keep track of every variation, sorry.

Re: Google knows nearly every Wi-Fi password in the world

#263

Post by yesbabyyes »

CatMtKing wrote: post #215
mistercow wrote: post #199

Earlier quoted context omitted.

That depends on the router and configuration. There's a flaw in WPS that makes it possible to quickly crack a router that has it enabled, even if it's using WPA/WPA2.

Wow. I was curious what flaw you were talking about... It seriously verifies the first 4 digits? That deserves a face palm.

That's almost like in the movies, where the system always seems to verify each digit individually, thus making any code trivial to crack.

Re: Google knows nearly every Wi-Fi password in the world

#264

Post by Retric »

rayiner wrote: post #222
dominotw wrote: post #188

Earlier quoted context omitted.

I dont really see your logic, Gubment can put you in prison, take your rights away, companies targeting ads can't. It makes sense that one would be outraged at the former.

Sure, but the government is subject to popular pressures. They can't imprison or otherwise hassle even a substantial fraction of the population in any meaningful way. Corporations are not subject to popular pressure. They can hassle millions of Americans and get away with it. As a practical matter, you have a lot more to fear from corporations misusing your private data to deny you jobs, mess up your credit, etc, tha…

I think the TSA and no fly list counts as rather large scale hassling. IMO the real problem is it's much harder to fight the government than corporations.

Re: Google knows nearly every Wi-Fi password in the world

#265

Post by sentenza »

LaGrange wrote: post #151
guelo wrote: post #134

Your WiFi password is only useful for someone who is within 100 feet of your house. If you have federal agents surveilling you from 100 feet away you have way bigger problems than your WiFi password.

While I don't like at all the idea of government surveillance without court order, I find the idea of corporate surveillance even more horrifying. Actually, this is what amuses me in the whole privacy affair. So a bunch of companies were using and abusing your data to target ads at you and shape your news stream so that it's more addictive, and people were cheering. A government (still mostly democratic, though not f…

Interestingly, here in Germany, the "average person" was much more concerned about data collection by Facebook and Google than by governments. (We even had a heated debate about Google Streetview in the mainstream press.)

Then the NSA/GCHQ/BND scandal hit and (at least as far as I can tell) now completely overshadows that former concern.

Re: Google knows nearly every Wi-Fi password in the world

#266

Post by legitsource »

cavilling_elite wrote: post #221
LaGrange wrote: post #151

Earlier quoted context omitted.

While I don't like at all the idea of government surveillance without court order, I find the idea of corporate surveillance even more horrifying. Actually, this is what amuses me in the whole privacy affair. So a bunch of companies were using and abusing your data to target ads at you and shape your news stream so that it's more addictive, and people were cheering. A government (still mostly democratic, though not f…

I think most of your repliers are forgetting about Blackwater. (/tinfoil-hat)

Who is paying them and giving out assignments?

Re: Google knows nearly every Wi-Fi password in the world

#267

Post by joe_the_user »

phaer wrote: post #86
siddhartpai wrote: post #59

Earlier quoted context omitted.

It could be like leaving your bank account password in the open. Your bank account password could be sniffed probably very easily by someone who is connected to your network. Now imagine somebody exposes some way to get the password of your home network from the google servers.

If a random attacker in your local network can do that easily you should talk to your bank about SSL or change to one that actually knows basic internet technology. SSL should be assumed as broken for defence against government surveillance but it still keeps the most common attackers out.

SSL depends on dns and so is broken when someone has compromised your local router. Yeah, that's a pretty bad weakness but it's just sitting there and indeed that's what the NSA supposedly used against Petrobras.

Re: Google knows nearly every Wi-Fi password in the world

#269

Post by drdaeman »

lightcatcher wrote: post #212
drdaeman wrote: post #119

Earlier quoted context omitted.

I'm unsure, but doesn't WPA2 password knowledge allows to decrypt your traffic? (Possibly with an active attack to re-initiate handshake?) I.e. someone who knows your password could drive by your home, listen to the air and see what you're doing online.

This isn't the case. The WPA2 handshake involves the computation of a session key for each client, so clients on the network can't read the plaintext of each other's traffic. The session key is established with a nonce generated by the access point as well as the MAC addresses of the access point and client.

Thanks for clarifications.

What I had in mind was the following case: if you disrupt someone's connectivity (jam the channel for some time) and force them to reconnect, having listened to nonces and knowing pre-shared secret, you can calculate PMK (and GTK), or I'm wrong?

(I haven't re-checked the specs, but believe 802.11 headers are unencrypted - only payload is - so MACs are not secret.)

Re: Google knows nearly every Wi-Fi password in the world

#270

Post by giovannibajo1 »

srollyson wrote: post #250
Fixnum wrote: post #162

Earlier quoted context omitted.

The point is you're supposed to use truly random word combinations since those are at least memorable. $ wc -l /usr/share/dict/words 119095 $ python -c 'print(119095 ** 4)' 201175048646341950625 $ python -c 'print(85 ** 10)' 19687440434072265625 So, even if your target is known to be using this scheme in pure form, this has more entropy than a completely random 10-digit password (assuming ~85 characters) -- and who w…

Can never turn down an opportunity for a one-liner. $ perl -E 'open(my $fh, " ; close $fh; say join " ", map {$words[int rand @words]} 1..4' menu chemists administrative seeps Might have to run it a couple of times before you get something that you can memorize.

You shouldn't use a non-cryptographically secure random number generator (perl's rand) in the context of password generation. It's too risky.
Post reply on HN