Hacker News Reader

Comment by espeed | Hacker News Reader

WeWork remains woefully insecure [1] -- IP is likely leaking out of it like a sieve -- and with a real-estate structure that's positioned as a too-big-too-fail [2], what could possibly go wrong...

[1] The Cyber-Insecurity of WeWork – Shared Offices and Cracking WiFi with Weak WPA2 Passwords

https://www.digitaloperatives.com/2018/10/10/the-cyber-insec...

[2] The CBINSIGHTS research report (WeWork strategy teardown)...

"WeWork’s $47 Billion Dream: The Lavishly Funded Startup That Could Disrupt Commercial Real Estate"

https://www.cbinsights.com/research/report/wework-strategy-t...

View on HN

Re: The Cyber-Insecurity of WeWork – Shared Offices and Cracking WiFi with Weak WPA2 Passwords

Sorry, but the password complaint is just ridiculous. What's exactly the point of a strong password if it's still shared with a million (or whatever) WeWork members across the globe, and could easily be figured out by simply asking just about anyone (of course, noone actually remembers it, as you only enter it once), or by taking advantage of one of the many ways to get a sample of the offering?

They list https://www.xkcd.com/936/, which is indeed a great one, but what WeWork should reply to them is this, https://xkcd.com/538/, which is the truth.

Both practices are bad. Sharing passwords and weak passwords is doubly bad. Don't do that. A $47 billion company like WeWork should know better.

Yep. If WeWork is pushing free WiFi and framing themselves as a "psuedo-tech company", they should also be heavily advocating VPN usage their "members". Not doing so means they are probably eavesdropping.

What you say makes no sense — why would they advocate for you to use a VPN such that a third-party could eavesdrop on your communication, when they already provide a business-quality connection through a business carrier?

I am not aware of any issues using a VPN at WeWork; it works great; I'm sure lots of businesses use it, too. It especially works great because there are no stupid captive or landing pages like you get at so many other places, and the password just works, too.

I'm a WeWork member, I do security, and I'm 100% OK with the existing WiFi setup.

What exact alternative do you suggest? Having user-assigned password authentication through 802.1x, so that the company can track exactly how much WiFi each member uses, and at which hours? Thanks, but no thanks.

OTOH, installing their proprietary software for presentation/display access is an entirely different matter, and that one is, indeed, a complete dealbreaker for me, security-wise; I don't understand why anyone would want to do that; just as I don't understand why you'd rather them secure the WiFi for you, instead of doing your own VPN as you see fit.

If you're trusting the network to be "secure", you're doing it wrong.

Reply on news.ycombinator.com