Hacker News Reader

Comment by loxias | Hacker News Reader

What's WPA3 for? I don't think WPA2 was cracked...

More useful would be knowing what combination of kit (linux router/AP as well as device) gets me robust high speed.

WPA3 provides among other things perfect forward secrecy. If your WPA2 password becomes available to a passive attacker that has listened in for the entire communication including the handshake, they will now be able to decrypt. Or in other words, any person who gets your wifi password can (passively) listen on traffic in your network. WPA3 requires attacks to be active with a proper man in the middle (less easy to do that in a wireless setting and also only applies to the future).

Ah, PFS. PFS is good :) Thanks for your response.

(I was feigning a bit of ignorance, I'm a bit of a minor crypto nerd.)

OK, cool, so WPA3 has PFS.

But so does wireguard.

When I opine "what's really the _point_ of WPA3? (and wpa2!) I'm mentally comparing it to _no_ encryption at layer 1 (aka open network), but with performant (and arguably more secure) encryption at layer 3.

Not all people are (self proclaimed) "crypto nerds" who have Wireguard-based VPN running on all their wireless devices at all times. I would venture a guess that absolute majority of people don't.

I sencond this, better to implement encryption at the lower layers, so that people get protected regardless of how the upper layers are built/configured.

WPA3 is definitely not as secure as wireguard, but it's a pretty good improvement compared to WPA2. 99% of people just use the defaults of their WiFi deployment, and then have stuff like network printers or NAS on there, with varying levels of encryption. Thankfully due to https being so widespread, most of the traffic to the public net is encrypted now. But even now you can find out which websites someone visited by looking at DNS and also the ip addresses of the packet headers.

https://www.krackattacks.com/

It also averts wifi deauth attacks (disconnecting the client up to a point of making the wifi unusable).

E.g. https://github.com/SpacehuhnTech/esp8266_deauther

Reply on news.ycombinator.com