[dead]
WPA3 Enterprise 192-bit mode at home
51–60 of 201 posts
Re: WPA3 Enterprise 192-bit mode at home
#52I know the article is just "here's how", but I don't trust my wifi because of the hardware and software on it, so for me the protocol is irrelevant.
Re: WPA3 Enterprise 192-bit mode at home
#53Earlier quoted context omitted.
Is there any obstacle to having a centralized server these APs talk to, which manages authentication? I'm not seeing a hard obstacle, just another piece of network kit and it's cheaper to keep a clunky UX
In theory I suppose. But you have to take into account that these APs can potentially be on different subnets, physical networks, talking across ipsec tunnels, dealing with multiple VLANs etc. There's just more overhead. It's easier to push out the info to the APs than to pull from who knows where. Edit: For example: Say you have two buildings connected via an ipsec tunnel/static route. You have 4 wifi networks on 4…
[deleted]
Re: WPA3 Enterprise 192-bit mode at home
#54I want to know why WPA3 doesn't have a mode where a password is used for the initial connection , but then the client and AP generate a keypair and each store their half and use that for all future connections. For all future connections, the AP can validate every client, and the client can validate that it is connecting to the same AP. The AP could have an interface to 'revoke' access to any single client if necessa…
Because industrial grade encryption isn't for us plebs, comrade, but for the various ~government bureaus~ megacorps who deserve security.
But not you.
Re: WPA3 Enterprise 192-bit mode at home
#55> In the “When using this certificate” dropdown, select “Always Trust.” Shouldn't it be possible to only enable “Always Trust.” in the "X.509 Basic Policy" setting, instead of allowing the certificate to be used for everything(including SSL)?
I work at smallstep.
Not sure about the RADIUS server, but connections to the CA use TLS for SCEP and/or ACME DA so the CA root cert needs to be trusted for TLS. There may be some way to configure more narrow trust for just this one interaction, but I'm not aware of any such mechanism in the current releases of macOS/iOS/iPadOS/tvOS.
Re: WPA3 Enterprise 192-bit mode at home
#56EAP-TLS is generally a great practice, as EAP-PEAP is vulnerable to MITM issues (fix proposed in https://www.ietf.org/archive/id/draft-josefsson-pppext-eap-t... but never adopted). For the use case cited -- blocking MAC spoofing, EAP-TLS doesn't quite solve it, it mainly only solves authentication. The outer layer is not wrapped with TLS and is instead based on an ephemeral session key. Additional work is needed to s…
> For the use case cited -- blocking MAC spoofing, EAP-TLS doesn't quite solve it The idea would be to rely on the client certificate authentication and not use MAC filtering at all. For example, you could have an EAP-TLS network that's unrestricted and not let Mallory on it. Or you could use RADIUS reply attributes to put Mallory on a restricted vlan.
Why not just set up multiple SSIDs then? The devices connected to different SSIDs belong to different VLANs. Then you don't have to consider MAC spoofing or even deploy EAP-TLS: just give different devices a different password.
I'm sure there are simpler ways to deal with the use case in mind, but I think this article just wants to have fun with NSA-grade WiFi.
Re: WPA3 Enterprise 192-bit mode at home
#57I want to know why WPA3 doesn't have a mode where a password is used for the initial connection , but then the client and AP generate a keypair and each store their half and use that for all future connections. For all future connections, the AP can validate every client, and the client can validate that it is connecting to the same AP. The AP could have an interface to 'revoke' access to any single client if necessa…
It's not unusual to run multiple APs on a single SSID. Your scheme doesn't work for that without coordination between the APs. Also, it means replacing an AP would require reconfiguring all the clients.
Isn't coordination between APs something that Ubiquiti APs already do?
Re: WPA3 Enterprise 192-bit mode at home
#58> Toggle the switch on the Smallstep RADIUS Root CA to enable Full Trust. The Smallstep RADIUS Root CA is now trusted. What could possibly go wrong? How do you do this without trusting some external CA?
The article borders on irresponsible by not explaining the full implications and risk of trusting a root CA, even if you're its sole private key custodian.
I work at Smallstep.
In this case you're getting an industrial-grade CA with a properly managed private key, etc. Still, fair. We usually include warnings about this, but looks like we forgot this time. Curse of knowledge. I'll see about getting a warning on there asap.
Re: WPA3 Enterprise 192-bit mode at home
#59TS information over wifi? Ok. Have fun with that. Im sure it is legally possible somehow, but it just creates a ridiculously large attack surface. And the internal hassles, making sure connected machines are inside defined perimeters ... just run some wires. It isnt like people need to be reading classified stuff on the treadmill.
Does the NSA use WiFi at all other than for clandestine collection systems in the field?
WiFi and other wireless protocols seem like an elaborate, yet wildly successful, plot to make consumer comms as insecure as possible.
Re: WPA3 Enterprise 192-bit mode at home
#60> Toggle the switch on the Smallstep RADIUS Root CA to enable Full Trust. The Smallstep RADIUS Root CA is now trusted. What could possibly go wrong? How do you do this without trusting some external CA?
Yeah, this isn't really "running at home" - which is a bit disappointing as smallstep does good work on the foss/self-host side of things (I guess this shows their seller side). FreeRadius can help: https://wiki.alpinelinux.org/wiki/FreeRadius_EAP-TLS_configu...
I work at smallstep. Yes. This also works with FreeRadius! We decided to integrate RADIUS into our product since setting up FreeRadius is complicated and, if you're just doing EAP-TLS for Wifi, you don't need all of the features. You don't need to use our hosted RADIUS though.