Comment by sandworm101 | Hacker News Reader

Comment by sandworm101 | Hacker News Reader

Parent Full thread

It is allowing any device already on the network to vouch for new devices. What could possibly go wrong? WPS had flaws in its implementation, but was reasonable on a theoretical level. This seems foolhardy at best.

WPA2, when properly implemented, is very secure. I'm not sure of WPA3's real purpose. Is strong encryption of wifi signals of any benefit? The days of banking passwords being send in html gets should be behind us. Anything important will be protected by other encryption layers than wifi. Is WPA3 meant to protect unauthorized network access? WPA2 isn't exactly easy to crack. Do we really need a new scheme, and the inevitable new flaws that come with it? Or is this really about streamlining the user experience, about making wifi that little bit less complicated, so that people can attached their smart toasters to the home network without having to actually remember the password.

To clarify for those who obviously do not understand the difference between protocol and concept implementation: Errors in the protocol would have been inconsequential if WPS was implemented properly. Had it not been left on 24/7, the temporary use of shorter keys would have been a good thing. It would have allowed home networks to adopt much more complex keys without having to type them into every new device (a big deal on things like printers which didn't have keyboards). WPS could have contributed to greater WPA2 security. But instead the concept was improperly implemented, allowing the inevitable errors discovered in the adopted protocol to be leveraged.

It doesn't say _any_ device. On the contrary, it sounds like the network admin has to explicitly delegate that authority to the configurator device:

> With Wi-Fi Easy Connect, a network owner chooses one device as the central point of configuration.

https://www.wi-fi.org/discover-wi-fi/wi-fi-easy-connect

Though with WPA2 (personal, at least), isn't it already possible for "any permitted device" to "vouch for new devices" by simply giving those new devices the Wi-Fi password?

Yes, Apple devices offer to do this for eachother if you are in the person's contacts.

Works between your own devices too, requires bluetooth but no pairing.

Best thing ever when traveling and your colleague just got the wifi password for the coffee shop you are in and you don't feel like typing it out.

No, that's factually wrong. KRACK showed the protocol itself is vulnerable, not the implementations, and it affects all devices.

https://www.krackattacks.com/

This is really why they went with WPA3, but I've noticed the Wi-Fi Alliance goes to great lengths to avoid any mentions of KRACK. So now, many, like you, are scratching their heads wondering what's the point of WPA3.

You are right, the protocol is broken. But that is only because it was accepted with a flaw that should be fixable.

While re-starting routers it was possible for an attacker to re-use nuonces (number used once). Because of a "SHOULD" clause in the RFC, the fix was optional and made it vulnerable.

Had that been a "MUST" (required) We would not be hearing even the a trace of WPA3.

An excerpt from the same website you sourced :

"When the victim reinstalls the key, associated parameters such as the incremental transmit packet number (i.e. nonce) and receive packet number (i.e. replay counter) are reset to their initial value. Essentially, to guarantee security, a key should only be installed and used once. Unfortunately, we found this is not guaranteed by the WPA2 protocol."

> WPS had flaws in its implementation, but was reasonable on a theoretical level.

Not sure about that since it has a key space of 10,000.

Implementations without a timeout were super-easy to crack while those with a timeout just took time to figure out how long the timeout was and to not exceed it. I have a Netgear wifi bridge that doesn't turn of WPS (even if you click the button) with no timeout and is trivial to get the password out of while another case it took a couple weeks once I determined the timeout.

*of course I only tested on my own devices and never engaged in wifi thievery from my neighbors

To be compliant you must not be able to turn off WPS at all (assuming because that wouldn't be "user-friendly" which is the whole point of WPS).

That is, any WPS compliant router is cancer.

> WPA2, when properly implemented, is very secure

Not really:

https://github.com/d33tah/call-for-wpa3/

>Anyone can disconnect you

so can someone with a jammer. I'm not sure how a protocol upgrade would protect against that.

>The password can be cracked offline

true, but the solutions presented don't really address the issue. they're variants of key stretching (using a better kdf, mandating stronger passwords, etc.). at the end he mentions "Contemporary cryptography provides tools that could solve this problem.", but that's hand wavy at best. i'm not quite sure it's even possible to implement such a feature in a PSK setting.

>Once you know the password, you can sniff traffic and spoof anyone

>This problem could be solved by using Diffie–Hellman key exchange (DH).

Doubt it. DHE does not offer protection against MITM attacks, which an active attacker can certainly do with a powerful enough antenna.

>From the user's perspective, unless you really know what you're doing, I advise you not to browse any sensitive websites (especially banking) over wireless

this is fearmongering. most "sensitive" websites already use https, which makes this an non-issue.

>It won't let you secure a passwordless network

>How could this be solved? The new WPA security standard could support the "passwordless" mode that requires no authentication, but keeps an encrypted channel of communication so that the anonymous user can identify himself and make traffic only readable by the access point.

how does this protect against MITM? that is, a rogue router pretending to be an hotspot?

> Silly "terms of service" in your cafe can break your applications and expose you to risk

valid point, but already solved: https://en.wikipedia.org/wiki/Hotspot_(Wi-Fi)#Hotspot_2.0

EDIT: Ignore me I've confused terminology.

> Doubt it. DHE does not offer protection against MITM attacks, which an active attacker can certainly do with a powerful enough antenna.

Huh? That's precisely what Diffie-Hellman is for. It's a protocol for establishing a shared secret over an insecure channel. Have you got an antenna big enough to read the private key? Sure, you can argue that pure DH is weak compared to ECDH or PKCS, but this is exactly what the system does.

No, DH doesn't stop impersonation or spoofing attacks. It doesn't do authentication. That much I agree with you on. You need something like ECDSA for that. But those types of attacks aren't MITM.

DHE protects against eavesdroppers, not middlemen.

Oh, fair enough. Dang, I get those confused far too often for my own good.

You don't think that MITM is a kind of impersonation attack? DHE is a mechanism for agreeing on a secret; it does nothing to authenticate the station you're agreeing on that secret with.

Think of what happens in TLS interception; DHE still takes place with the intercepting device, it's PKI which tells you who you're agreeing with.

Yeah, I had my terminology confused. I was mistaken.

In fact, you were closer to the truth than the person you replied to.

The new standard uses a PAKE (password-authenticated key exchange) protocol. This type of cryptographic construct is similar to an unauthenticated key exchange protocol (such as Diffie-Hellman), but in addition succeeds only if both parties know the same password, without leaking any information about the password to a party if they don’t know it. At least one of the best-known PAKE algorithms, namely SRP, is quite similar to Diffie-Hellman in structure, although it’s not the one being used here (which I don’t know anything about).

If I'm not completely mistaken, only the DoS ("Anyone can disconnect you") is valid for true scotsman WPA2 (aka WPA2-EAP aka WPA2-Enterprise). "Silly "terms of service" in your cafe can break your applications and expose you to risk" is hardly fault of WPA2; while some sort of side-channel for provider-provided messages would be nice, I think at least the ToS case could be handled by e.g. DHCP option.

I think the deauthentication issue was fixed with 802.11w, which is required for vendors to implement to get their 802.11ac license[1]. It was introduced in 2009, so you can be sure there are plenty of vulnerable consumer routers out in the wild.

Of course, WPA3 will also suffer this same issue of adoption.

[1] https://security.stackexchange.com/a/64440

Great, I haven't been tracking the situation that closely. Additionally googling around I did also find that there are standards to replace the typical captive-portal wifi setup, namely "online sign-up" (OSU) and "additional steps required for access" (ASRA).

While I don't know how well they do work in real life, they do demonstrate that the problem is manageable within the WPA2 framework.

That being said, the whole landscape around wifi is ridiculously muddied and complex, so if WPA3 does tackle the issues more natively (which I somewhat doubt), then that would be very welcome.

>It won't let you secure a passwordless network

Yes it does. 802.1x solves this. Just allow any user/password combination. This has been in use successfully. It worries me that the author doesn't mention this.

> WPA2, when properly implemented, is very secure.

Nope, WPA2 has a number of security issues. Let me introduce you to the Wi-Fi deauthentication attack [1].

  [1] https://en.wikipedia.org/wiki/Wi-Fi_deauthentication_attack

That is a matter of reliability, not security. I can also flood the air with white noise. That doesnt mean radio isnt secure.

Denial of service is a security vulnerability.

I know it's part of the "CIA" stuff, but I don't see it as a vulnerability in this specific case. Jamming affects all devices, not just "secure" ones.

Also, there is no countermeasure against it, which makes it even less a security vulnerability.

You could easily be a MITM using the de-authentication message.

Not everyone has access or the funds to get a jammer. Making it more "Vulnerable"

Take a gander at EVIL TWINS: https://rootsh3ll.com/evil-twin-attack/

That is not reliable. Windows for example won't connect to an open AP that previously had encryption enabled. At least not automatically. The next problem you might face is that TLS enabled websites will trigger an error warning.

Your TLS argument is true. That however does not make it any less insecure.

You see, People around the world click 'proceed anyway' on so many of those websites. That is what happens when APs in coffee shops are misconfigured around the world.

It is barely a useful prompt (if at all).

And keep in mind this is a MITM we are talking about. He could simply, replace an instance of a website with his local version using 'http' instead of 'https'. The prompt would not even show up in this case.

It's still a dialog in the OS, not on a website.

You can blame it to users stupidity all you want, but if people click on "continue" it's their fault. They can read. If they can't, they shouldn't use a PC in the first place.

Reply on news.ycombinator.com