Google Ordered To Teach America How To Put Passwords On Wi-Fi Networks

http://www.forbes.com/sites/kashmirhill/2013/03/13/google-ordered-to-teach-america-how-to-put-passwords-on-wi-fi-networks

by shawnee_ • 13 years ago

24 68 13 years ago

forbes.com

faet• 13 years ago

> Google is going to teach naive people how to put passwords on their Wi-Fi networks.

Good luck with that. Setting up passwords varies between different routers. So what may work in their ad may not work for grandpa down the road. Telling manufacturers to set a wifi password by default would probably do more to secure people.

gcr• 13 years ago

Many newer routers come with a "first setup" page that forces you to pick a wifi password.

http://portforward.com/ exists to help people set up port forwarding, so it is possible to do something similar for passwords.

dmiladinov• 13 years ago

Setting wifi passwords would be a good start, but then you'd still have to address the security flaws in wps[1] and upnp[2][pdf].

[1] http://code.google.com/p/reaver-wps/ [2]: https://community.rapid7.com/servlet/JiveServlet/download/21...

cbhl2• 13 years ago

Well, it doesn't need to be secure _per se_, just secure enough that it mitigates Google's liability. Like the password/PIN rules at the bank.

justincormack• 13 years ago

They are probably hoping Google create a router.

marssaxman3• 13 years ago

> to instruct Americans not to let neighbors free-ride on their Wi-Fi networks

This is such a weirdly negative framing. What's wrong with sharing? I've always left my wifi routers open and unsecured so my neighbors can use the bandwidth if they want.

burntsushi3• 13 years ago

> What's wrong with sharing?

A few things. Some of these things can be mitigated, but I think then we've moved beyond simple sharing.

1. Your neighbor could use too much bandwidth, thereby impacting your usage negatively.

2. Your neighbor could do naughty things on your Internet connection, and you'll be held liable. Practically, this might mean getting a bunch of DMCA notices. For some ISPs, this has a real impact on your account.

3. Many applications by default share their data with whoever is on your network. Maybe this is OK, but maybe it has stuff that you'd rather your neighbors did not see.

To clarify, I think sharing is great if you decide to do it. But I also think that the uninformed should be advised to not share by default because of the issues I mentioned above.

marssaxman3• 13 years ago

Of course those things are possible in theory, but I've been doing this for 14 years and nothing bad has ever happened. I don't believe that it's as big a deal as people make it out to be.

crististm10• 13 years ago

1. This is not necessarily wrong. Maybe I set it up so he can use all the bandwidth that he can get

2. Why is only the penultimate hop responsible for the last hop? Why should he be responsible in the first place? And why shouldn't all the network hops in-between be responsible as well???

3.Yes, it is OK

"Link sharing" is OK regardless of your decision whether to share or not. Don't blame the technology man.

stevenameyer6• 13 years ago

The real danger with leaving you router unsecured is people piggybacking on the connection to perform illegal actions online. I don't have any stats on how prevalent this actually is but being investigated for something like downloading/distributing child pornography because someone in a van was driving around and stumbled upon your unprotected network would not be a fun experience, and if the fact they used your network makes it more difficult to track the person who did perform these action then that is bad for everyone.

To me the issue isn't people sharing their network, it is having the ability to trace an action back to a group of people who have access to a specific network.

crististm10• 13 years ago

Child porn - the ultimate illegal activity. The only reason people would go on the Internet.

ajasmin4• 13 years ago

I can't agree more. But there are real concerns with sharing.

Even though people move around with their phones and laptops all the time, network protocols still want to trust the LAN. Things like rogue DHCP servers, unencrypted HTTP traffic and unsecured devices (like printers) are real problems.

Bandwith caps and accountability are also of concern.

taproot3• 13 years ago

These things were built into the network with good reasons. As were the ways to secure yourself. Just because it is insecure by design doesnt mean laws should be in place to protect those who show no desire to understand or use technology in the way it was designed. Should cars speed be limited based on the speed limit just because a few speed? That is what you are talking about

driverdan• 13 years ago

The problem is that if you don't encrypt your over-the-air signal anyone can monitor your traffic.

taproot3• 13 years ago

I don't have a drinking problem, you have a problem with my drinking, and that is not my problem.

In other words, you're the one with the problem. It is open by design, and there isn't a problem with the design.

baltimore• 13 years ago

Aren't two issues being conflated here? (1) Securing access to your wi-fi with a password so that your neighbor can't free-ride on your ISP and (2) Encrypting your wi-fi traffic so that your neighbor (or Google) can't spy on you.

pdonis5• 13 years ago

Conceptually, yes, these are two different issues. But since wifi security pretty much requires encryption of the traffic (otherwise anyone could just sniff your credentials during the access negotiation), and encryption requires some sort of access control anyway, they always go together in practice.

drzaiusapelord3• 13 years ago

What a bullshit case, judgement, and punishment. Unencrypted wifi should be collectable. Don't broadcast in the plain on a public channel if you want some special level of privacy. This is an incredible case and probably not politically worth the fight for google. All of our rights have been limited by this judgement.

g8oz• 13 years ago

But most unencrypted wifi exists because of tech illiteracy/laziness on the part of users. Its not a conscious choice they made. Commercial collection is exploiting this. Finally your last sentence is unnecessarily hyperbolic.

drzaiusapelord3• 13 years ago

Generally, it isnt the job of the state to protect the ignorant and the lazy. Sorry, but this kind of precedent is going to lead to even more draconian judgements over "computer trespassing" and "hacking." Computer crime laws aren't reasonable as-is and now with this new case law, they're arguably worse.

The ISM band exists within strict FCC control. There is no "don't sniff" provision and if there was, it would make promiscuous mode or applications like inssider illegal.

JagMicker2• 13 years ago

How is this any different than "exploiting" data from Facebook, or mailing lists of people who did not check the box next to the words "I don't want my information to be shared with third-parties"?

How does an unsecured Wi-Fi network, emanating signal out into the street, deserve some sort of "expectation of privacy"? You deserve no expectation of privacy if your blinds are pulled-up and your windows are open. Why should Wi-Fi be any different, just because users can't be bothered to learn to protect their assets?

johnsoft• 13 years ago

I wouldn't call it laziness. Network setup is something most people just pay their ISP to take care of. It's a commodity service. They don't care how the bits get from here to there, they just want to check their email and go on Facebook.

How many people do you know who, say, do their own water softener maintenance? Is that plumbing illiteracy/laziness, or is it a sign that people are willing to pay for service that frees their time and attention for more productive things?

jlarocco• 13 years ago

Remaining tech illiterate is a choice people make.

While I think it's sleazy to spy on people's open WiFi, I don't think it should be illegal.

Making it illegal is a complete waste of resources because it doesn't solve the problem. Google is a giant company and they only got found out more or less by accident. In every other case it's almost trivial to spy on unencrypted WiFi without anybody knowing, which means it would be nearly impossible to enforce a law against it.

zem• 13 years ago

schneier on open wifi networks (he's for them): http://www.schneier.com/blog/archives/2011/04/security_risks...

pdonis5• 13 years ago

I normally agree with Schneier, but I think he's wrong on this one. Basically his argument is that, rather than try to secure your wifi, you should just leave it open and make sure your personal computers are secure enough to be used on an open network. He points out that, if you use your laptop on public networks, you have to secure it anyway, so there's no additional risk to having your home wifi basically be a public network.

All that may be true (though I would argue that, since you use your home connection a lot more than any other, your risk exposure is much greater and therefore it makes sense to have a layered defense there), but it completely misses the point that you are responsible to your ISP for how your internet connection gets used. Starbuck's may be able to say "look, we're a public place, we can't possibly control everything that everybody does on our wifi", and get away with just making people check an "I agree to your terms of use" box when they connect to their wifi. You, as a home user, are not likely to get away with that.

Schneier also says this: "if someone did commit a crime using my network the police might visit, but what better defense is there than the fact that I have an open wireless network? If I enabled wireless security on my network and someone hacked it, I would have a far harder time proving my innocence." This seems backwards to me: if you have enabled wireless security, you know exactly who you have authorized access to--it's whoever you gave your passphrase to. So it's easy to distinguish authorized from unauthorized use. If you leave your wifi open and someone uses it for something nefarious, how can you defend yourself? You're still liable for the use of your internet connection, and you can't say the use was unauthorized because, well, you left your wifi open for anyone to use.

crististm10• 13 years ago

"You, as a home user, are not likely to get away with that."

His point is that you _should_ be able to get away with that. Precisely because there is no difference between an open network and a cracked one!!!

snowwrestler• 13 years ago

I would like to propose that we, as technologically literate people, start to separate the concepts of encrypting your WiFi signal, and sharing your WiFi signal.

Encryption has true security benefits, primarily the prevention of HTTP session hijacks via tools like Firesheep.

You can still share your network by simply putting the password in the SSID. Name your network "Password is 12345" or something. Encryption protects against Firesheep even if everyone knows the password.

MichaelGG• 13 years ago

Are you sure about that? How does that possibly work? If the shared secret is known, how can you possibly prevent people from hijacking the connection?

jessaustin5• 13 years ago

Both the AP and the client station produce nonces, which together with the passphrase and other values are used to calculate "pairwise" keys and eventually session keys. This makes hijacking more difficult. As you intuit, however, it can certainly be done by one who knows the passphrase and is able to sniff the nonces.

ajasmin4• 13 years ago

Unfortunately, there's no widely supported way of encrypting the traffic of individual users on a publicly accessible network.

WiFi is designed to trust everyone on the LAN/subnet. But LANs are not secure. People roam between networks all the time. I have around 20 WiFi networks saved on my smartphone right now.

Sadly, people are trained to password protect their WiFi these days. Other than security issues, bandwidth caps and the risk of being held accountable for your internet connections are of concern to a lot of people.

Google Ordered To Teach America How To Put Passwords On Wi-Fi Networks

Related Stories