Hacker News Reader

Comment by stryan | Hacker News Reader

This doesn't seem like it will be too much of a practical problem. As said in the article, YikYak is mostly used on university campuses and odds are if a student is on campus they would be connected to the university wifi. From personal experience most university's use some form of WPA2-Enterprise authentication which which wireshark can't decrypt.

View on HN

That's assuming the attacker would be a fellow student connecting to the wifi network, and not the school, who has full control of the the network beyond the access point.

I'm long out of undergrad so I've never used this app, but I've read that YikYak is at least somewhat known for controversial content regarding schools, school employees/faculty, and fellow students.

Seems like there would've been just as much, if not more, incentive for a university administrator to want to get people's post histories in order to divine who posted a particular piece of content.

> As said in the article, YikYak is mostly used on university campuses

University campuses, where students are constantly using the free WiFi in cafes, are on private WiFi networks shared with friends, etc. Even if the University's own WiFi was magically invulnerable, there will be many associated venues ready for use of this exploit.

1. Setup an open access point in the middle of campus.

2. Give it a default name (e.g. 'linksys').

3. Capture packets.

4. Profit.

There is no profit though, no one uses YikYak for posting anything remotely important.

Ehh, people sometimes post embarassing/hateful things on YikYak, being able to out them would be a problem.

Or to blackmail them so you don't reveal their identity.

An app should not be considered "secure" because it doesn't currently have important data.

Twitter wasn't much of a honeypot, either, until activists and corporations started using it. Did Twitter know the exact moment that happened? No. They should have been secure long before that.

Don't take it so literally. In this case "profit" is just synonym for "goal".

See: http://knowyourmeme.com/memes/profit

There's this thing called a "jasager" that you might also be interested in looking into. Particularly combined with airdrop-ng. I was a bit shocked when I learned how that particular aspect of 802.11 is implemented.

Or set one up called "Free WiFi" in a location with a WiFi blackspot that many students congregate at.

> YikYak is mostly used on university campuses and odds are if a student is on campus they would be connected to the university wifi

Based on some of the vague locations that Yik Yak gives with each post I'd say a little less than half are actually sent from on campus.

What about ARP spoofing? Have all wireless routers ever built somehow gotten this right?

It's my understanding that unless the wireless access point is sufficiently smart, any device on the same network can claim to be the router and your phone won't know the difference. Even if an attacking device can't passively decrypt your radio transmissions, it won't matter because the router will actively decrypt and re-encrypt your packets before forwarding them on to the attacking device.

Actually, yes! *For enterprise-grade APs generally deployed at university campuses...[0] Moreover, such APs usually have methods to prevent communication between peers on the same wireless network.

[0] http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Mo...

Reply on news.ycombinator.com