Hacker News Reader

Comment by rayiner | Hacker News Reader

I have a friend who is an experienced senior paralegal. (Experienced paralegals are sought after because the best ones often leave the job quickly to go to law school.) She started work at a new boutique law firm founded by prominent litigators. She was to head up the paralegal department within the firm. She quit days later. Key to her decision, she told me, was the fact that their IT plan apparently involved using the building WiFi instead of setting up an internal wired network. She figured that this was such a red flag regarding the firm’s administrative competency that she was going to have a rough time.

View on HN

I recently worked with an architect who was incredulous when I specified structured cabling be added to the plans for the building (a 16,000 sq. ft. building housing 3 separate office suites). The architect assured me it's very uncommon today, in their firm, to see "outdated" technology like wired networking used.

The building is getting structured cabling.

Architects sometimes feel like the Mac users of the engineering world. Maybe it's not fashionable anymore to have headphone jack, but the utility of it is immeasurable and you'll really miss it when you need it.

Architects are just designers that design how the building looks - then engineers need to come and do something from those nice visualisations.

How do they run power to the access points without using "outdated" tech?

The kind of person that considers Ethernet to be "outdated" tech also thinks that a single access point hidden somewhere in a basement is sufficient to cover the entire property, so no need to run Ethernet for PoE either.

I was too shocked to ask. Now that I think about it, though, off-brand mesh APs hanging from wall warts situated on filing cabinets, cube walls, top the the refrigerator in the break room, etc, was probably the "enterprise" strategy they had in mind.

My decade of experience with lawyers is that most of them aren't great with technology. If I had a dollar for every lawyer I knew with an AOL email address I would be writing this sat on the beach.

I've known a lot of people who were amazing at their job, but shitty at running a business. I guess I would have tried to help these lawyers and explain their wrongheaded tech decisions to see what their next move would be. That would give me a better understanding of whether they were an outfit worthy of my time.

Technology is definitely not a core competency for most lawyers. With data breaches recently hitting several prominent law firms, however, clients are increasingly scrutinizing their law firms' data security practices.

That's something she should make sure comes up in her future job interviews, especially if her firm deals in the tech industry...if I had an attorney with those sorts of concerns I'd feel pretty good about my legal council.

On a side note, I have no idea why pgp is not more common in that industry. It's completely insane. In some ways, you'd be better off sending your legal correspondence on a postcard with attorney/client priveledge disclaimer at the bottom.

Your confidential agreememnt along with the nuclear codes is attached to this email in a zip file, password is your year of birth.

Password will be sent under separate cover in an email right after this one. LOL.

> I have no idea why pgp is not more common in ...

Maybe because pgp is still the same pain the butt it was back in the 90's. Nothing significant has been done to improve the user experience.

Meanwhile, roll forward to 2022 and there are now dozens of good quality secure document sharing platforms, all of which have full web, desktop and phone/tablet integration.

Having used some of those secure document sharing services, I don't feel very confident in them. They seem more like a checkbox getting ticked off for the sake of offloading some liability. pgp is a real dinosaur and a nightmare to set up, but for sharing legal docs digitally, I can't think of a better tool.

It hasn’t gone unnoticed but getting stakeholders (not only lawyers, but clients, even clients at tech companies) to give up email is an uphill battle: https://www.wired.com/insights/2014/09/insecure-email-fix-it...

> Case in point: just a few weeks ago Goldman Sachs mistakenly sent a sensitive email with account information to a random Gmail user because someone fumbled some keystrokes and sent to a “gmail.com” account instead of a “gs.com” account. The email contained such sensitive information that the only recourse Goldman had was to get a court order to require Google to retract the message. Just this month, the UK’s Information Commissioner “sounded the alarm” for lawyers in an attempt to get them to realize that unencrypted email is an unacceptable risk for privacy.

It is by far the weakest link in terms of law firm information security these days.

There's nothing wrong with wifi per se. It is simply another type of medium - instead of a wire, you use electromagnetic waves to transmit the signal. That's how your mobile phone works and so does your radio and TV (if you have them and don't just use Netflix - you know what I mean here).

There are long established standards such as 802.1X which involves mutual TLS encryption for wifi. This is generally called "Enterprise WPA" or something like that. This means that all wifi traffic is encrypted to what I would call: a decent standard.

I hope your friend did a proper analysis of the wifi offering and didn't simply discount it out of hand because it is wifi.

There are a lot of issues here and the wifi vs wired thing is bloody complicated but make sure you understand all of the issues before pontificating about one vs the other ... 8)

(edit: 51 year old commentard here)

I think the person in GP's story objected to the fact that the network connection she was told to use was not even limited internally to that law firm, but was astonishingly just whatever semi-private "building wifi" network happened to exist in the (presumably shared) building. If I were a lawyer and cared about client confidentiality, that would at least give me pause, regardless of whether the physical network was wired or wireless.

"If I were a lawyer"

Then you do your "due diligence" etc. I think we should all understand at a fairly basic level how wifi and wired works and what to do.

Fire up the VPN!

That’s essentially what Google does. The outside-most network is not a security boundary.

Google doesn't use shared building wifi in their corporate campuses

> For both wired and wireless access, Google uses RADIUS servers to assign devices to an appropriate network, based on 802.1x authentication. We use dynamic, rather than static, VLAN assignment. This approach means that rather than relying on the switch/port static configuration, we use the RADIUS servers to inform the switch of the appropriate VLAN assignment for the authenticated device. Managed devices provide their certificate as part of this 802.1x handshake and are assigned to the unprivileged network, while unrecognized and unmanaged devices on the corporate network are assigned to a remediation or guest network. - https://static.googleusercontent.com/media/research.google.c...

Yes BeyondCorp does allow access to corporate resources outside of the intranet, but as part of a managed device + identity + network evaluation.

Wi-Fi is surprisingly bad. Sitting less than 10 feet from my access point (802.11ax) with a clear line of sight, my ping to Google.com varies from 7.4 ms to 88.6 ms. SSH-ed into my router, which is connected directly to Comcast fiber, it varies from 5.74 ms to 5.83 ms (less than 90 microseconds jitter).

Wi-Fi is a shared medium in a crowded and noisy spectrum environment. I can see a dozen networks from my house, and I'm in a (dense) neighborhood of single family homes--it's much worse in a high rise office building. It can have decent bandwidth (almost a gigabit when it gets going) but reliability, latency, and jitter are bad.

I am guessing this point is totally unnecessary based on how overall well-informed your comment was, but in case you weren’t aware, it is frequently helpful to run a wifi analyzer of some sort to figure out which channels are heavily utilized in your area so you can set your router to one with less interference. I used to use the Mac network utility that I think may have been deprecated, but it worked like a charm. I do this for my friends all the time and it dramatically improves their network performance in 90% of cases. The only places I found it was pointless were in the middle of nowhere and my own apartment not too far from MIT’s campus, where I assume I was surrounded by equally (probably much more) knowledgeable nerds so the neighboring networks were surprisingly evenly distributed across the available channels.

Most of the modern APs actually move their channel around, so this helps less!

Thanks, it's appreciated. I'll give it a shot sometime.

Other places where it is useless is when your neighbours move in bringing dodgy out-of-spec 5g and 2.4ghz wireless trash like baby monitors or "Security cams" that smash the entire spectrum.

I've had another neighbour buy a wireless landline from China that was because "sometimes the phone would crackle, and i hated that" meanwhile it would bring every 5ghz wifi network to its knees when she was taking a phone call.

So, there are other cases, maybe this is a bit more prevalent in countries closer to those with lax spectrum laws.

Problem with unlicensed spectrum is that it becomes tragedy of the commons. Much like SF, anyone is free to loiter and shit on the street, shoot up heroin, other kinds of degeneracy and whatnot.

The licensed frequency bands, in contrast, are congestion free and more polite let’s say. I’d be willing to pay a monthly fee for use of one of those frequency bands. But good luck getting permission from the FCC to do that.

You say tragedy of the commons, but IMHO the unlicensed spectrum is by far the most economically productive spectrum allocation ever made.

>wireless landline

You mean a cordless phone?

There's nothing wrong with WiFi technology. The problem is the traffic is passing over someone else's network (the shared building WiFi).

If I were a corporation looking to hire a law firm, this would be a serious down-check for them, as I don't want the details of any cases they're handling for me exposed on a shared network.

This could also be considered weak protection of client-attorney communications, and get the state Bar Association involved.

If stuff is being used from a stationary position it should ideally be wired. I’m sympathetic to the notion that wires look cluttered and nobody resents how thick and ungainly Ethernet cables are more than me, but defaulting to WiFi is just a waste of electricity. You get slower, higher latency internet. Especially in crowded settings where there’s a ton of congestion at those radio frequencies.

Nothing wrong with two cans and a line of string, either.

Reply on news.ycombinator.com