Hacker News Reader

Comment by bell-cot | Hacker News Reader

Security-wise, Wi-Fi has always been a steaming heap. And probably always will be.

Wi-Fi has the same challenges as if someone just tapped an Ethernet cable. (Except the Ethernet line can't be sniffed from the parking lot.) The amount of unsecure traffic on a basic Ethernet network makes Wi-Fi security slightly better.

I don't think that's exactly true. Ethernet is a pretty simple physical-layer protocol only made for 1:1 connections, and you can't generally inject packets from a simple tap mid-cable. You would have to undetectably insert an active MITM device into the cable to get on the network, which is a lot more tricky to do than an undetectable tap.

An old hub (not switch) does exactly that: all traffic forwarded down each port and I can see what everyone was doing. Even with a switch, a misbehaving device can cause all sorts of havoc on an Ethernet network. 802.1X is supposed to provide port security but isn't used often. Anyone could plug into a wall port and get access to a corporate network.

A hub and an accessible wall port are not common parts of Ethernet networks today. The former hasn't generally been used since the 90's (putting it generously) and the latter is usually locked up. GP referred to a cable tap, which is just not going to give you access on an Ethernet network that you will find in any building today.

Old, old Ethernet specs used to include multi-drop buses and a "hub" model. That hasn't been true for a very long time.

Except there is a trick: In a switch, a port can only associate with limited number of hardware addresses. If you spam it with generated hw address, some switches put that port into open mode, some switch shutdown that port, the other just misbehaves. Almost none of them keep a LRU list correctly

I think you're missing the point. Electrically, you can't "spam" anything on a tapped cable. It will just go down at the physical layer when you try to transmit unless you cut it and insert yourself between its endpoints (as a switch, essentially).

Ethernet includes address and source identifiers so that multiple sources and destinations can be used on the same wire. As the sibling comment mentioned, hubs (not switches) simply broadcasted every frame to every connection, and the NICs at each end would have to determine if they were the intended destination. Some of them didn't even require power because they were essentially joining the wires together. Switches require power because they learn which destination the ports respond to and can route more efficiently based on that knowledge.

> Ethernet is a pretty simple physical-layer protocol only made for 1:1 connections, and you can't generally inject packets from a simple tap mid-cable.

This is complete nonsense. Ethernet is a shared-medium protocol. The fact that it doesn't need any special handling of particular endpoints is one of the things that distinguishes it from e.g. Token Ring. How do you think it's possible to link two switches with a standard cable on standard ports? What on Earth are you basing your claims on?

Ethernet as used in almost every facility has not practically been a shared-medium protocol for decades. The citation of "token ring" sort of dates your notion of "Ethernet."

The Ethernet spec is over 5,200 pages, including the old multi-drop buses, but the parts of the standard that specify the physical layer and actually get used, including 10/100/1GBASE-T and the fiber Ethernets, cannot support more than one endpoint on a wire.

Well, that is totally wrong. And I deduct that you're rather young.

You think Ethernet is 10BaseT, 100BaseT and similar, i.E. Twisted Pair. But original Ethernet was designed for Coax cable, for 1:many connections.

Basically you had one coax cable and run it from computer to computer. At both ends you had a terminator resistor of 50 Ohm. And at the computers you originally had vampire clamps, later T connectors. That was used until for two or maybe even three decades. First only in research, military and university (e.g. where also TCP/IP was originally was used). But later also e.g. for Novell Netware. The Terminator/RG58 cable/Network card with NE2000-clones or 3C359 cards was relatively cheap, so a lot of offices used that with some Novell Netware file server.

Ethernet was designed for many clients, the CD in CSMA/CD means collision detection. With only two clients, you could do some handshake, like with RS485. But with many clients, this can become cumbersome or impossible. So Ethernet decided to detect this, and to let the senders re-send the packets after a random back-off time.

On the https://en.wikipedia.org/wiki/Ethernet after "Shared Medium" you can see a picture of this entirely not 1:1 equipment :-)

I have actually read the Ethernet standard almost cover-to-cover, but GP was referring to Ethernet in the common use, not the technically-available options that can be tapped if your building happens to be from the 80's (or is a car). Also, at this point, a lot less of the available "Ethernets" can be tapped than you may be thinking.

Maybe "Wired Equivalent Privacy" was a good choice of name, lol

Of course, the network isn’t trustworthy; giving it encryption related tasks was a bad idea.

What are better alternatives for wireless connectivity?

Alternative is the wrong question, I think.

You should* assume the wireless connection itself is compromised and use an extra layer, like wireguard.

*Assuming this makes sense within your threat model. It's not something I think I should care about much, personally. Everything important I do goes over https anyway.

But that shouldn't be necessary. WiFi itself should be doing whatever wireguard adds to this setup.

It shouldn't be necessary, yet WiFi continues to show that it is.

Not to claim that 99% of users would show any preference for a better standard...but that's pretty much the problem.

[Edit: Retr0id is perfectly correct...but even thinking in terms of a threat model has already excluded the 99%, if not more.]

Reply on news.ycombinator.com