Hacker News Reader

Comment by sjwright | Hacker News Reader

A password that has already been handed out to thousands or tens of thousands of customers isn't "security".

In the physical world social convention is used all the time instead of real security.

If my boss needs some peace and quiet he closes his door. It is not locked, but people know not to enter. If it is open I can walk in and have a chat.

A WIFI password is a social convention asking you to not share. Everyone knows that it is not secure. But it is much easier than having a captive portal login system. By respecting the social convention we make life easier for everyone. Respecting a social convention is far less onerous than over zealous security mechanisms that annoy the customer.

Door is closed but not locked. In terms of security it is more of theater, than actual security

he literally said instead of real security

I think I understand the ethos behind pushing for traditional social norms to not be discarded in the digital age, to resist stratification of security and convention between us all.

Conversely, I also think I understand the rationale for distilling the digital network security flaws and laying them open with the goal of changing and updating the social conventions which can now be completely bypassed and still accomplish a successful intrusion.

There is no social convention on the Internet. If you live in a quiet safe neighborhood you can often get away with leaving your door unlocked at night. But when parking in a city of millions of strangers you always lock your door. On the Internet of billions of people, lock your doors.

I rotate my home WiFi passwords regularly. A business with revenue can’t afford to do this?

> Everyone knows that it is not secure.

This is the crucial part you're wrong about. Most people assume Wi-Fi with password is secure, only us nerds know better.

At that point it is public information, and sharing it more widely is just journalism or publishing.

I would find something like this to be helpful. As a frequent traveler often you don’t have any sort of cell service when you land. Being able to quickly hop on WiFi is often a godsend for quick communication and navigation to final destinations in foreign countries.

As an example, in Copenhagen airport there is free WiFi but you have to go to wifi.cphairport.com to access it and if you don’t see one of the signs around the airport you won’t figure it out. Some handy guide that has URL, ID of the WiFi and password is super helpful in situations like this.

Typing 1.1.1.1 or any other IP address usually helps, it automatically redirects to the main login page. If you type a name, your DNS query fails.

Funny you picked that particular IP -- out of all four billion, 1.1.1.1 is the only one (that I know of) that uses HTTPS!

Sometimes the resason that you don't get redirected to the wifi network's captive portal is that your browser is trying to access a page using HTTPS. Trying to connect to a HTTP-only site (like http://neverssl.com/) can solve this.

Yeah. And this is a complete shitshow as everyone on earth pushes https as hard as possible. How do people who haven't heard of neverssl manage to connect to these captive portals? Sooner or later, the drive toward secure http is just going to kill off anything with a captive portal for most internet users.

Just use example.com

> I would find something like this to be helpful

I would find a scheme where I am simply allowed to help myself to any goods or services I wish to consume, for free and without permission, helpful, too.

There are a lot of city and town public records. But once they are online and searchable and cross reference able with databases and APIs they become a new kind of public. There’s a lot of data showing this. So maybe it’s public, but not everything that is public needs to be in machine readable format on the internet.

I didn’t explain that well, but maybe you get the point. There’s a balance to be struck.

That doesn't make it right to hand it out.

If a hotel room uses old fashioned keys, can one customer make a copy of the key and start handing it out on the street to anyone who wants to go into the room? Just because many other people have paid to use it before?

People pay for access to the lounge, at least in part, for the better, less congested, more reliable wifi.

I agree; I don't think it's right either.

To take your hotel analogy, I agree it's not right for customers to make copies of room keys. But if it were as easy to copy a hotel room key as it is to copy a wifi password, the hotel would not be in a position to describe those keys as adequate security.

Though the analogy is poor because a hotel room is intended to be a private and secure area where I can store valuable item, whereas wifi access is more like the soda dispenser at an American restaurant—other customers are equally inconvenienced whether you paid or not.

Reply on news.ycombinator.com