WiFi-WPA2 security issue. Kinda important.

[frater secessus]

Maybe it's changed but computers used to put out rf that could be used to see every keystroke you made without being physically attached to you network.

Tempest.

 

[sreesekelley]

Tempest.

thanks, I couldn't recall off the top of my head and was too lazy to go look it up.

 

[SoulRaven]

I definitely need some Education on this sreesekelly. What time will class be @ RTR? Should I bring breakfast or lunch?

Bring dinner,  I'll bring breakfast. We HAVE been warned. ...

 

[SoulRaven]

ask me about computer security at the rtr.  I'll tell you every lie I know

This might surprise you, but one or two of us have had 30+ year careers in the computer industry.   We might know a little more than you seem to realize. 
And, I retired because I was SICK of the BS... primarily all the little " cults of personality".   So me asking ANYONE about computer security (or any other topic) is highly unlikely. 

But,  gee whiz, thanks for the offer. 

Pat

 

[frater secessus]

With our mobile hotspots this is a bigger issue.

This vulnerability does not grant access to the network. It is not related to unauthorized use of the network.

This is when the devices send info back and forth to verify who it is.  I have not gotten up to date on current devices, but it seems that these handshakes are not encrypted in most instances?  So all someone has to do is monitor this traffice between devices, grab the pw, and they can jump on your local network.

If you intercept a handshake packet on WPA-based systems you can start attacking that system's password. Dictionary attacks, default passes, brute force, whatever. It's definitely not transmitted in the clear. A WPA-based system with a good password is extremely time-consuming and resource-intensive to break into.

WEP is trivial to break into, but even that doesn't transmit the wifi pass in the clear so packet sniffing is insufficient.

Note: If anyone wants to see this in operation at RTR I'll bring an extra router and demonstrate attacks on it.

 

[sreesekelley]

This might surprise you, but one or two of us have had 30+ year careers in the computer industry.   We might know a little more than you seem to realize. 
And, I retired because I was SICK of the BS... primarily all the little " cults of personality".   So me asking ANYONE about computer security (or any other topic) is highly unlikely. 

But,  gee whiz, thanks for the offer. 

Pat

I never meant to imply that anyone didn't know something.  sorry if you felt I was demeaning in anyway.  it was not my intention.  I only hoped I was helping.  I'll stop now.

 

[tx2sturgis]

This might surprise you, but one or two of us have had 30+ year careers in the computer industry.   We might know a little more than you seem to realize.

Note:  If anyone wants to see this in operation at RTR I'll bring an extra router and demonstrate attacks on it.

Do you guys remember (back in the 'day') when they used to call this 'war-driving' and you actually had to travel somewhere to find a wi-fi network other than your own? Wireless routers back then had no default password, they were usually open networks named 'Linksys' or whatever. Security? We dont need no stinkin SECURITY!


I still have a little portable keyfob style wi-fi 'sniffer' from the early days of wi-fi before phones even had wi-fi or cellular data....and whipping out a laptop just to 'sniff' wi-fi was a pain waiting for boot-up in the pre-SSD days.

 

[frater secessus]

Huh? Okay. So I'm a dumb
http://www.donkeyheaven.org/uploads/images/Gallery/donkeys/clive.jpg
Can you give me simple english? Shirely, I'm not the only one. So beware of using Mickey D's and other places for wi-fi? Home Depot even?

You're not dumb.  


Summary

• connecting to secured websites (https, padlock icon) is fine, even over open wifi like McDonalds or Home Depot.  Luckily, financial/health/etc sites are secured.
• connecting to unsecured websites (http, no padlock icon) can be a problem if you are sending sensitive data.

So for practical security:

1. send sensitive data only to secure websites as described above
2. use separate passwords for each site/service and change them every once in a while
3. use sites rather than apps for sending sensitive data, unless you know for sure the app encrypts or you have a workaround

The separated/changed passwords thing helps limit the exposure if one of your accounts does get compromised.

 

[shadowmoss]

Many of us have backgrounds in computer and computer security, myself included. However, all of us know more than any one of us. Techie butt sniffing to find the alpha can be fun in some instances, but we need to remember that things move fast in the techie world, and someone else may have insight we ourselves haven't been exposed to yet.

 

[blmkid]

I retired because I was SICK of the BS... primarily all the little " cults of personality".   

Exactly why I retired 4 years earlier than "normal" people. The BS that went with work. All of them "normal" @$%# #$%&ERS can kiss my "un-normal" A@@. Ok. Venting over.

 

[SoulRaven]

Do you guys remember (back in the 'day') when they used to call this 'war-driving' and you actually had to travel somewhere to find a wi-fi network other than your own? Wireless routers back then had no default password, they were usually open networks named 'Linksys' or whatever. Security? We dont need no stinkin SECURITY!


I still have a little portable keyfob style wi-fi 'sniffer' from the early days of wi-fi before phones even had wi-fi or cellular data....and whipping out a laptop just to 'sniff' wi-fi was a pain waiting for boot-up in the pre-SSD days.

It wasn't that long ago that I would drive over (or walk) to the local library at night and jump on their wifi,  because no one told them to  turn it off. 



Before I met jimindenver.

 

[SoulRaven]

I don't know,  shadowmoss.   I think I've had enough " techie butt-sniffing " to last a lifetime. .. and it's always been an acquired taste,   one i never acquired. 

 Pat 

PS. why the heck does this font size keep changing on me????

 

[SoulRaven]

Exactly why I retired 4 years earlier than "normal" people. The BS that went with work. All of them "normal" @$%# #$%&ERS can kiss my "un-normal" A@@. Ok. Venting over.

Anytime you want to vent, put on "Ball and Chain " by JJ, and sing along. 
And I  definitely want to hear it! 



Pat

 

[SoulRaven]

I never meant to imply that anyone didn't know something.  sorry if you felt I was demeaning in anyway.  it was not my intention.  I only hoped I was helping.  I'll stop now.

No need.   And I was probably being a DH.  I think that might be in the acronym dictionary.   If not,  it shouldn't be too hard to figure out! 



Pat

UPDATE :
After some serious soul searching,  Ive concluded I was definitely being  a  DH. 
I'm sorry.

 

[sreesekelley]

No need.   And I was probably being a DH.  I think that might be in the acronym dictionary.   If not,  it shouldn't be too hard to figure out! 



Pat

Well, if I insulted anyone it was unintended.  You would be surprised at the number of meanings of DH.  I'm fairly sure I know the one you mean.  Designated Hitter, it's a baseball term. Also, your private apology was sent to the wrong person.  It was long and heartfelt.

 

[SoulRaven]

Well, if I insulted anyone it was unintended.  You would be surprised at the number of meanings of DH.  I'm fairly sure I know the one you mean.  Designated Hitter, it's a baseball term. Also, your private apology was sent to the wrong person.  It was long and heartfelt.

That's incredible! Because I figured since I had been a Dunder Head in public, 
I would apologize in public. 

So if I sent someone a long and heartfelt apology,  Im going to have to do an Oliver North and have no recollection of it. 


Pat 

Must be nappy time.

 

[tx2sturgis]

Group Hug!

 


Anyway.


Back to reality....

 

[sreesekelley]

That's incredible! Because I figured since I had been a Dunder Head in public, 
I would apologize in public. 

Google did not list dunder head

 

[blmkid]

You're not dumb.  
Summary

• connecting to secured websites (https, padlock icon) is fine, even over open wifi like McDonalds or Home Depot.  Luckily, financial/health/etc sites are secured.
• connecting to unsecured websites (http, no padlock icon) can be a problem if you are sending sensitive data.

So for practical security:

1. send sensitive data only to secure websites as described above
2. use separate passwords for each site/service and change them every once in a while
3. use sites rather than apps for sending sensitive data, unless you know for sure the app encrypts or you have a workaround

The separated/changed passwords thing helps limit the exposure if one of your accounts does get compromised.

I was in Lowe's a couple days ago and needed to make a transfer to checking from savings, inside the store. Thank You for the info. I like only doing the "padlock" type web sites, which of course my bank is. Thanks.