Coffee shop WiFi for dummies

http://www.securityfocus.com/columnists/385

by gphil • 16 years ago

15 20 16 years ago

securityfocus.com

gphil• 16 years ago

This is a little bit out of date, but it is a good reminder to be careful.

valverde• 16 years ago

This brings up a more interesting question: how would you provide encrypted free Internet access in a coffee shop?

Giving out passwords to customers is the most common approach, but there must be a way to provide encrypted access without a shared key.

rcoder• 16 years ago

Encryption requires a secret to work; anything else is just obfuscation, and wide open to anyone who knows the algorithm being used. You don't have to exchange long-lived shared keys, but alternatives (RSA, OTP, etc.) tend to require a preexisting trust relationship and/or secure channel.

Furthermore, the only way in which WEP or WPA improve real security is by keeping folks who don't know the key off the local network. Since most shops freely give away their network keys to anyone with enough cash for a cup of coffee, and seldom if ever rotate keys, it's an awfully weak level of protection.

If you assume that other network users are potentially hostile, and/or that the coffee shop owner (or its ISP, or someone who "hacked" their Linksys router via an unchanged admin password) can't be trusted, your only real option is routing your traffic over VPN to a trusted host elsewhere on the 'net.

gojomo• 16 years ago

My understanding of WPA2 is that each client negotiates its own key — so it's slightly better than having your traffic trivially transparent to all others on the same wifi. (I'm not sure if passive eavesdropping on the initial negotiation is enough to determine someone else's key, or if active MITM interference would be necessary — does anyone know for sure?)

Someone2• 16 years ago

must? I would be surprised if there were. For any protocol, a machine already on the network could 100% mimic the secure gateway. That would make it impossible for you to know which machine to trust, just like with BOOTP and DHCP.

alanh2• 16 years ago

A standard public-key encryption strategy would work if the key was generated on each client (instead of being handed over the air from the router in plaintext as you assume). This is exactly how HTTPS works — otherwise HTTPS would be completely susceptible to a man-in-the-middle attack

jschuur2• 16 years ago

I don't really know enough about this stuff, but couldn't you just generate some kind of temporary encryption credentials upon the initial wifi connection handshake and use that for the duration of the session?

I've always assumed that the reason it's not done is that the CPU resources needed to handle decryption of a reasonably strength was too much for a bunch of simultaneous connections on affordable hardware.

cma• 16 years ago

Nope, a man-in-the-middle attack would defeat that.

jschuur2• 16 years ago

@cma: you mean I couldn't verify the identity of the router upfront and might handshake with someone pretending to be it? I figured you could tell by the SSID of who you're connected too if it's the right one, assuming the official one isn't offline.

See, I knew that I didn't know enough about this to lead a decent conversation ;)

shiftpgdn• 16 years ago

"If your company provides you with VPN access on your laptop, use it. That's a sure fire way to ensure that everything you send and receive is encrypted, and it makes your surfing much safer."

This should have been the first, and most important line of the entire article. Wireless encryption, IM client, and internet browser simply don't matter as someone who is out to grab your information is going to be doing so by viewing the packets sent between your computer and router.

tallanvor• 16 years ago

Agreed. Anytime I'm using one of my laptops - be it a personal or business one - outside of home or work, the first thing I do is start my VPN connection.

nlawalker• 16 years ago

It should have been the only line in the entire article. The only way that proper precautions such as this will be taken up by people who really don't care is if they are simple and succinct.

phunel• 16 years ago

Anyone feel like writing a quick "VPN for dummies" then? Would love to see it.

trotsky• 16 years ago

2006-02-09

Amusing to see a blog on security focus implying that a WEP key when given to everyone was somehow better than nothing, even if it was from 5 years ago.

10smom• 16 years ago

I like to think of myself as a newbie traveling entrepreneur. I have a travel trailer that I used to travel the south west this fall I did a lot of non camp ground camping in the big cities and took advantage of all the coffee shops I could find to take care of business. It was a blast and a great way to do business while traveling. I am investing in a small motorhome to travel to tech conference throughout the year. I plan on spending lots of time in coffee shops if not staying camp grounds. I like the idea of having a "traveling home" that I can just jump into in a parking lot of a major event etc...

  I also got to the local shop  in beautiful Park City utah, just to get out of the house  and have change of atmosphere while working.

ankimal• 16 years ago

Gmail dint use https by default for the longest time. I remember getting an email from our department while at school about this too. Its default now and can be toggled from Settings -> Browser Connection.

alanh2• 16 years ago

[2006]

Coffee shop WiFi for dummies

Related Stories