Re: [saag] Would love some feedback on Opportunistic Wireless Encryption

[Stefan Winter <[e-mail]>]

Hi,

> You are right that there will be some initial legacy issues -- but if
> we can convince Windows 10 Mobile, Apple iOS, and Android willing to
> include support (which seems likely, "support" is trivial - basically
> 1: try the SSID as the passphrase and 2: don't bother showing a lock
> icon)

Or, for wireless sniffing kit of your choice:

1) try to decrypt with the SSID as the password
2) win!

Seriously, this way of encrypting traffic stops only one attacker group:
people with a Wi-Fi card in promiscuous mode who use Wireshark to look
at packets ("us" :-) ).

Everyone with only a /slightly/ serious attitude just continues to do
what they do with their upgraded sniffing gear.

I don't see how this improves security in a significant enough way. And
the cost for it *is* high - convince all OS manufacturers to do
something && convince AP admins to do something.

> we could get the *huge* majority of devices doing this before
> the document is published, and way before CPE starts including the
> button.
> Even for devices that don't get support added -- after I've asked at 3
> coffeeshops what the password is, and they all say "It's the same as
> the network name..." I'm likely to start trying the network name if
> the SSID name sounds like it may be open (e.g is the name of the
> establishment, contains -guest, -public, or better yet, -owe).

Funny: right now, an attacker would need to go to the shop to get that
same information. In your future deployment, the binding of SSID to
passphrase comes automatically.

(Besides, my guess is that sniffing gear today probably tries the SSID
as a passphrase anyway - simply because it is rather common).

So, what exactly are we winning with this approach?

Greetings,

Stefan Winter

-- 
Stefan WINTER
Ingenieur de Recherche
Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et
de la Recherche
6, rue Richard Coudenhove-Kalergi
L-1359 Luxembourg

Tel: [phone]
Fax: [phone]

PGP key updated to 4096 Bit RSA - I will encrypt all mails if the
recipient's key is known to me

http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66