Hacker News Reader

Comment by dsr_ | Hacker News Reader

The author claims to be a computer security engineer, yet is deliberately setting up a tool to defeat security -- not an abstract tool, useful in surveying and thus improving your own security and incidentally capable of being used for mischief, but nothing more than a list of identifiers and passwords. The only indicator you can gain from this is that someone betrayed your trust.

If this profession had a board of ethics, this is the sort of thing that it would take action against.

If people want you to use their networks, they will offer you access via any one of several convenient mechanisms, including

not using encryption

putting a sign on the wall with a password

handing you a card with credentials

telling you a password

View on HN

A password that has already been handed out to thousands or tens of thousands of customers isn't "security".

At that point it is public information, and sharing it more widely is just journalism or publishing.

I would find something like this to be helpful. As a frequent traveler often you don’t have any sort of cell service when you land. Being able to quickly hop on WiFi is often a godsend for quick communication and navigation to final destinations in foreign countries.

As an example, in Copenhagen airport there is free WiFi but you have to go to wifi.cphairport.com to access it and if you don’t see one of the signs around the airport you won’t figure it out. Some handy guide that has URL, ID of the WiFi and password is super helpful in situations like this.

Typing 1.1.1.1 or any other IP address usually helps, it automatically redirects to the main login page. If you type a name, your DNS query fails.

Funny you picked that particular IP -- out of all four billion, 1.1.1.1 is the only one (that I know of) that uses HTTPS!

Sometimes the resason that you don't get redirected to the wifi network's captive portal is that your browser is trying to access a page using HTTPS. Trying to connect to a HTTP-only site (like http://neverssl.com/) can solve this.

Yeah. And this is a complete shitshow as everyone on earth pushes https as hard as possible. How do people who haven't heard of neverssl manage to connect to these captive portals? Sooner or later, the drive toward secure http is just going to kill off anything with a captive portal for most internet users.

Just use example.com

> I would find something like this to be helpful

I would find a scheme where I am simply allowed to help myself to any goods or services I wish to consume, for free and without permission, helpful, too.

There are a lot of city and town public records. But once they are online and searchable and cross reference able with databases and APIs they become a new kind of public. There’s a lot of data showing this. So maybe it’s public, but not everything that is public needs to be in machine readable format on the internet.

I didn’t explain that well, but maybe you get the point. There’s a balance to be struck.

In the physical world social convention is used all the time instead of real security.

If my boss needs some peace and quiet he closes his door. It is not locked, but people know not to enter. If it is open I can walk in and have a chat.

A WIFI password is a social convention asking you to not share. Everyone knows that it is not secure. But it is much easier than having a captive portal login system. By respecting the social convention we make life easier for everyone. Respecting a social convention is far less onerous than over zealous security mechanisms that annoy the customer.

Door is closed but not locked. In terms of security it is more of theater, than actual security

he literally said instead of real security

I think I understand the ethos behind pushing for traditional social norms to not be discarded in the digital age, to resist stratification of security and convention between us all.

Conversely, I also think I understand the rationale for distilling the digital network security flaws and laying them open with the goal of changing and updating the social conventions which can now be completely bypassed and still accomplish a successful intrusion.

There is no social convention on the Internet. If you live in a quiet safe neighborhood you can often get away with leaving your door unlocked at night. But when parking in a city of millions of strangers you always lock your door. On the Internet of billions of people, lock your doors.

I rotate my home WiFi passwords regularly. A business with revenue can’t afford to do this?

> Everyone knows that it is not secure.

This is the crucial part you're wrong about. Most people assume Wi-Fi with password is secure, only us nerds know better.

That doesn't make it right to hand it out.

If a hotel room uses old fashioned keys, can one customer make a copy of the key and start handing it out on the street to anyone who wants to go into the room? Just because many other people have paid to use it before?

People pay for access to the lounge, at least in part, for the better, less congested, more reliable wifi.

I agree; I don't think it's right either.

To take your hotel analogy, I agree it's not right for customers to make copies of room keys. But if it were as easy to copy a hotel room key as it is to copy a wifi password, the hotel would not be in a position to describe those keys as adequate security.

Though the analogy is poor because a hotel room is intended to be a private and secure area where I can store valuable item, whereas wifi access is more like the soda dispenser at an American restaurant—other customers are equally inconvenienced whether you paid or not.

I'm less concerned with the security issues - WiFi you don't control should always be treated as possibly being compromised.

What is a problem is that the networks are password protected and not meant for use by the general public. Airline lounges are providing WiFi for customers who have paid for access (either through the type of ticket or by spending enough to have status to access the lounges). Depending on the location, unauthorized access to the networks can either be categorized as theft of service or unauthorized access to a network.

A "security engineer" who is promoting illegal activity isn't actually concerned with security.

> What is a problem is that the networks are password protected and not meant for use by the general public.

I agree but wanted to point out that what you are saying is exactly what parent commenter is saying too.

It is controversial but there is something in publicly posting already compromised long-living static credentials.

I do not approve nor disapprove of this. It could be unethical, could be even illegal but still - it also may force to not rely on this security-through-obscurity approach and maybe actually start doing things right. Sadly, many people don't learn from theoretical implications - they just ignore those and don't implement any security. They only start reacting when their passwords are posted in the open.

E.g. if you want only paying customers to access your WiFi, generate unique passwords and print them on their receipts (or tickets or whatever) to look up.

There are degrees of everything. In an ideal world, they probably wouldn't have passwords at all and trust everyone who doesn't have explicit permission to just not use AIRLINE_CLUB or whatever. We don't live in that world.

On the other hand, they probably don't want to use some complicated individualized password scheme because that's a headache for everyone.

So they pick a happy medium that keeps out the casual web surfer out on the concourse and, if a few people get it, who cares? But if a static password ceases to be much of a deterrent, then they've got no choice but going to a system that places more burden on everyone.

I'm not sure. Your vision looks oddly alien to me. It is human to make accidental mistakes, be tempted to break rules and similar. Half of our folklore is about praising deception, playing around the rules, outsmarting or outright cheating. I don't mean those are good things (they're generally not), but those are part of the human nature. Please don't take this personally, but the ideal world of your description would be boring and... I think "sterile" is the word. Not like this is inherently good or bad (I can see both aspects I think) - just alien.

We had plaintext Internet once, but as it grew, it started to fail.So, now most of us cheer for TLS everywhere and believe it's a good idea. Don't see how this is any different.

There's been an irritating trend of malware authors and other digital miscreants self-identifying as 'security researchers' lately.

If they just want to hack other people's shit, they should own up to the antipathy that comes with that. Instead they act like extorting companies over undisclosed vulnerabilities, emptying *coin exchange accounts, posting credential dumps on the internet or exfiltrating gigabytes of data are somehow noble or academic endeavors.

If you don't want your semi-public (ie payed for) WPA2 key to be compromised, use 802.1x. Then you can use whatever you want for authentication, including time based tokens.

> not using encryption

Not a viable option, this would allow anyone to intercept traffic.

(To be fair, a lot of wifi routers are broken and will forward you all decrypted traffic from other users anyway on request. Try running WireShark on public wifis.)

The big problem is that Wifi with no password provides no privacy. Ideally we would have a wifi mode that is encrypted, but does not require a password. Just like Https.

Actually WPA with pre-shared key doesn't provide any security if key is publicly known (as someone can setup mitm device).

For wifi without password you should look at WPS.

It's not that someone can set up a MitM device. Wifi with a shared password can be passively captured using a variety of tools and decrypted using WireShark.[1]

The "coffee shop" scenario, where a WPA2 Personal password is written where anyone can see it, is essentially as insecure as non-encrypted wireless.

WPA2 Personal is only secure if the password is very strong[2] and never given to untrusted parties.

The only wireless security I put any real trust in is WPA2 Enterprise with 802.1x certificate-based authentication specifically.[3]

[1] https://wiki.wireshark.org/HowToDecrypt802.11 [2] Otherwise it's possible to mount a hash-cracking attack after capturing the four-way handshake for clients that have the password. [3] WPA2 Enterprise with per-user password-based authentication is vulnerable to an "evil twin attack" unless the password is very strong, which is usually not the case, because organizations typically have it authenticate against Active Directory or another LDAP.

> The only wireless security I put any real trust in is WPA2 Enterprise with 802.1x certificate-based authentication specifically.

802.1x with a certificate for Radius server (TTLS mode, which simply layers the plaintext password via TLS) and plain passwords for users is also good enough.

WiFi passwords aren't about security for the people using the network, they're about blocking people who haven't paid for it. If, as an attacker, one of your targets is using JFK's airport WiFi, getting the password for that WiFi is the least of your problems.

Whether it's ethical to hand out passwords to people who haven't paid for WiFi is another question entirely, but wouldn't it be sweet if businesses just let anyone join their WiFi? Bike repair shops always leave a pump outside for anyone to use, not just customers.

No, because wifi bandwidth is finite and shared.

> wouldn't it be sweet if businesses just let anyone join their WiFi? Bike repair shops always leave a pump outside for anyone to use, not just customers.

That's a flawed analogy. It'd be sweet if I could do any prohibited thing whenever I feel like it.

How frequently is the pump oversubscribed that it causes a queue and blocks the sidewalk? If this happened, the repair shop would soon stop leaving a pump outside.

With a WiFi network in an airport you have regular situations where demand outstrips capacity. This isn't something that is discovered later, it's common sense before you even operate the service. Users attempt to download movies at the last minute for their flights, and in many cases each person will attempt to connect multiple devices to the hotspot. The hotspot provider setup things to support their clientele. They'd have set it up differently if they wanted it available for use by all.

I think this is a red herring. Not using encryption is unacceptable. Sharing public information is not unethical.

Not using encryption to hide your public service is perfectly acceptable. If you come to my house, you can access my wifi network. No password needed. It's my gift to you.

This information is not public. It is a set of shared secrets. And now it has been shared to everyone in the world, rather than those who the owners wanted it to be shared with.

What's the red herring here?

This isn't public info in some cases though. Airline sky clubs charge a fee and one of the benefits is their wifi (note that on the map, these aren't just airports, but airline sky clubs).

That's like you coming to my house, I give you the password to the wifi, and then you go tell all the neighbors about it so they can get "free wifi".

Reply on news.ycombinator.com