Hacker News Reader

Comment by juiceandjuice | Hacker News Reader

Too bad all of these attacks can be carried out even with encrypted public wifi hotspots.

Too bad all of those attacks have nothing to do with 802.11 and, given the necessity and equipment, can be carried out with almost any connection medium. Public WiFi is just more popular and easier target.

Just don't think your colleague (who hates you) or nearest BOFH at the job, technically can't stealthly plug out your cable while you're out, hook up his router performing a MitM attack, and have his fun and profit. Yeah, that's childish, much less probable, and incomparably more risky than just sitting with laptop at cafe, but the point is that every one of said attacks can still be carried out.

Just because the whole world's relying on the obscurity as a primary security measure.

Can they, though?

I was under the impression that sniffing WPA encrypted traffic was difficult even if you know the passphrase.

Unless you're the operator of the access point. Are you really gonna trust each random access point that you find?

Corollary: operate a rogue AP in a bag with the same SSID and password as a public one and get the clients to connect to you instead of the "real" AP. Getting a stronger signal than it should be easy due to closer proximity. OK, it's no longer a passive attack and can easily be detected if you're looking for it, but if you're even aware of the possibility, you'll be using a VPN anyway. If you're after facebook passwords and the like, this will work well enough.

Isn't part of the problem that the current wifi encryption standards require client authentication in order to get encryption, but don't normally provide any authentication of the AP. In other words, in order to get a WPA2 encrypted connection I have to provide at least a passphrase (which is a barrier in a public setting), yet I have no assurance that I'm connected to a trusted access point, as opposed to a rogue AP. Maybe what's needed is something more like HTTPS, where by default the client doesn't need to authenticate, but the certificate provides some assurance that you're connected to the correct site.

WPA(2)-EAP ("WPA enterprise") has supported this for years. It also has other advantages, such as supporting multiple usernames, each with their own password. It also works on most existing client devices (iPhones, etc.) I use it at home; unfortunately, very few APs have a built-in authentication server for it, so you need to run FreeRADIUS on some always-on Linux/BSD device.

If you know the passphrase and you listen in when a client first connects, then you can extract all the data (easy to do in wireshark) However, if you joined/started sniffing for packets after the other client auth'd, than it's harder, at least in wireshark.

It's been a while since I did it, but I do remember you need to listen to the initial negotiation for WPA, but not for WEP.

Reply on news.ycombinator.com