Hacker News Reader

Comment by stefan_ | Hacker News Reader

Actively sending deauths is harmful and malicious interference, and given the intent, probably a felony. There is no circumstance for operating this device in public.

I've flagged this post. This is the kind of irresponsible unethical behavior that causes all sorts of interesting radio hardware to be bonded to signed vendor blobs.

View on HN

Therefore let's flag any content that mentions it on public forums, so only the bad guys keep doing it completely unchecked as they have been for over a decade, and we continue not doing anything about actually fixing it?

Hey let's ban all youtube content about the use of tools like ettercap while we're at it.

In fact let's just make any research or discussion of security and pentesting illegal and bury our heads in the sand.

From the article: "ESP based deauthers, to name one, always existed. Don’t yell at us “OMG they’re deauthing all over the city!!!”. Despite this stuff always existing, nobody bothered updating to technologies that work better and are more secure. That is the people you should be yelling at."

I'm not saying you're wrong, or that they're right. However, it seems to me that there has to be a middle ground between draconian signed blobs (which I'm not convinced will solve much for long, either) and the silliness that is the current state of things. Deauths have been used in so many wifi cracking schemes over the years and the fact we still don't seem to care about them (or treat them as harmful interference and blame the device) is getting silly.

802.11w has existed for a while, consumer routers not supporting it is what we should blame.

That's the point? You are not being a whiz-bang whitehat running around your neighborhood sending deauths. That is not a novel attack or research. Nothing is being learned. You are just a lowlife script kiddy fucking with the devices of your neighbors.

It's like running a GPS jammer from your car battery because "wow, GPS is so insecure and easily jammed at -90dB SNR!".

To be fair, GNSS integrity should be a consumer feature.

Ironically you are trying to censor hacking from hacker news.

If you follow the point logically then surely you feel the same about the entire scope of computer security - "If it can be abused, then it must be flagged and removed", no?

I feel that this is a dangerous attitude that promotes ignorance and forbidden knowledge.

This is not "hacker" news, as in illegal hacking, this is hacker news as in the old-school definition of hacking whereby you'd self-learn and figure things out... the word hacker in this context doesn't condone illegal activities

> whereby you'd self-learn and figure things out

Which the author of this submission did. Fearmongering about the unethical motives one might have about a vulnerability that is now about two decades old seems pretty pointless. I don't particularly enjoy the hackfluencer style of writing of the post or condone what it's supposed to do but it's at least an interesting read. Let's face it, you can get an ESP deauth image in 5 minutes if you have malicious intent, you wouldn't bother to go into the depth the author did here, which makes it interesting and imho relevant to this site.

Aye, has parent read any hacking zines?

There is an option to turn off the deauthing. But I don't believe it is off by default

Maybe that is the point. Perhaps a more well thought out strategy for the long term security profile for router updates should, by default from firmware update, be made do deny deauth deny. However, this fact would also be lost on us if we weren't updated with a warning on the router admin page. Which by the way, anyone can get there. That is, if the router admin Page's IP is known. Otherwise, you'll need to pack a lunch. Because it'll be a while if you have to type in each private IP, or if a 11 digit phrase with some capitalized letters & special characters set for the password.

You are arguing on the knowledge that the rest of us would like to know about. So, you should take your argument to the FCC, or the entity that owns the page you're at & let the class continue.

You know, book burning went out with the digital age?

I believe everyone should get their say. Within reason. Would you have struck down any legalization of your own rights? We'll, now you are, to ours. There are venues to continue this & maybe even have your points be heard.

Thank you.

Reply on news.ycombinator.com