Newsvine
  • Welcome
  • Help
  • Report Bug
  • Conversation Tracker
  • Your Column
  • Replies
  • Friends
Type Comments Since You Last CheckedArticle Source Last Checked Stop Tracking All Clear Tracking All
Advertise | AdChoices
Log In | Register
Close the Login Panel
Existing users log in below. New users please register for a free account.

New Users:

Existing Users:

E-Mail:
Password:
Forgot Password?
Please enter the e-mail address or domain name you registered with:
E-Mail/Domain:
Back to Login
Log Out
  • Top News
  • Local News
  • World
  • U.S.
  • Sports
  • Politics
  • Tech
  • Entertainment
  • Science
  • Business
  • Health
  • Odd News
  • More
    • Arts
    • Education
    • Environment
    • Fashion
    • History
    • Home & Garden
    • Not News
    • Religion
    • Travel
Visit Dennis M Wright's column >>

DENNIS M WRIGHT

Home Page
Incertum ex Certis
Articles Posted: 137  Links Seeded: 798
Member Since: 1/2006  Last Seen: 5/17/2012

What is Newsvine?

Updated continuously by citizens like you, Newsvine is an instant reflection of what the world is talking about at any given moment.

Get a Free Account
Help
Fun Stuff
  • Your Clippings
  • Leaderboard
  • E-Mail Alerts
  • Top of the Vine
  • Newsvine Live
  • Newsvine Archives
  • The Greenhouse
  • Recommended Articles
  • Wall of Vineness
Put a Seed Newsvine link on your own site

Why oh wifi?

Mon Sep 17, 2007 8:44 AM EDT
technology, security, internet, computers, wifi, wpa, mcafee, wireless-networks, wep, wpa-psk
By Dennis M Wright
Advertise | AdChoices

If you have your home wifi properly secured, what do you do if Uncle Brian turns up for a flying visit, just happens to have his laptop with him and asks to use the Internet?

I had the choice of getting his laptop authorised to use the wifi with all the security still on, turn all the security off briefly or lend him one of my laptops. He really wanted to use his so it was one of the first two.

What a choice! Why don't router manufacturers build in some easy system to add a guest temporarily?

I didn't really want to pass out my WPA pre-shared key to Uncle Brian. It's not that I don't trust him, but I just don't feel comfortable with adding it to PCs which are not under my control. I could have changed the key later but that would have meant updating 5 separate machines, a pain in itself.

In the end I switched off security and disabled MAC address filtering, chose a new SSID and turned SSID-broadcasting on, so for a while my wifi was wide open. I didn't worry too much; I can't imagine a team of spies armed with packet sniffers had been encamped in the garden for months waiting for me to drop my guard so they could steal the family photos off the hard drive.

Speaking of hard drives, I suddenly had a panic. In principle Uncle Brian could now access the shared drives on my network; so I turned sharing off temporarily.

Brian was able to access his email and whatever else on the Internet. Meantime the security changes broke my son's wifi connection - he was less than gruntled.

The worst part was having to reverse all the changes after Uncle Brian and his partner bid their farewell, particularly reactivating sharing on the hard disks of some of the PCs. I made mistakes with the share names so some programs which I use over the network were broken and I had to check the pathnames and rename the shares. It took a while to get everything working and settled back down as it had been before. A disproportionate amount of hassle to let a random visitor check emails for a while.

I really do think router manufacturers should build in temporary guest features, or there should be a provision for this in the wifi standard.

I had a look on the Internet to see whether anyone provides such a facility. I did come across McAfee's Wireless Protection system which makes it easy to add new PCs to the wifi while maintaining security, and it keeps changing the key so I could just have disabled Uncle Brian's access rights and the old key would be no good to him. It might be an option for the future. The main drawback for me is that I use my PDA with the wifi and the McAfee client software would not install on that.

I gather some routers support multiple virtual networks (different SSIDs with different security and different access rights) using a single router.

Or I might just plug in an old access point ...

Any better ideas out there?

  • Enjoy this article? Help vote it up the 'Vine.

Back To Top | Front Page

Published to:

  • Dennis M Wright's Column, All of Newsvine
  • Groups: Newsvine Computer Society, Newsvine Technology
  • Regions: none
  • Public Discussion (13)
FDBryant3

Well you could set up a dual-router configuration. Personally though - I'd of just put the key on the system. I might insist on doing it myself, probably with a USB key so I could cut and paste to avoid the possibility of keylogger. I might even go so far to insist I be allowed to remove it before they leave.

On the other hand I might also just figure that the odds of someone extracting the key then tracking it back to my personal network are so remote as to not be worth worrying about. We are talking about someone getting access to the laptop, extracting the passkey, figuring out it goes to your network, going to where you are (since I'm presuming Uncle Brian doesn't live close by) and sitting outside your home to maybe get a strong enough signal to allow them to browse around and maybe find something potentially useful. It isn't an impossible scenario, but a bit of an improbable one I think.

I'm all for network security and applaud people who make efforts to harden their home networks. However, I think it important to keep it in balance and relize that for the most part that 1) the odds of someone wanting to hack your wi-fi connection are probably less than winning the lottery 2) their are easier and better vectors of attack than hacking a wi-fi connection, and 3) their are pleanty of unprotected easy targets.

Like I said though, a dual-router configuration is best bet. Maybe also with setting up software firewalls on your personal machines that only allow recognized machines from your network to access them.

  • 3 votes
Reply#1 - Mon Sep 17, 2007 9:45 AM EDT
Dennis M Wright

You're right I know, but it still strikes me someone should have thought about this when creating the wifi standards or designing routers. Lots of people must have exactly the same problem that I did. Products should be designed with customer's needs in mind.

And yes I do appreciate that my hardened wifi is overkill. It's down to too much listening to Steve Gibson's "Security Now!" podcast.

  • 3 votes
#1.1 - Mon Sep 17, 2007 10:28 AM EDT
FDBryant3

Another thought is you could get one of those routers with an one touch security button. You still would have to drop the WPA but after that you just hit a button on the router to get it lower defenses long enough to recognize a new computer (I'm pretty sure they work on mac-address filtering but haven't really researched it) then it puts them back up. Personally I kinda regard them as better than nothing protection but it is easy and gives some security. I do think they promote a false sense of security in that I bet a determined hacker could probably crack it in a few minutes but it should keep drive-bys out.

  • 2 votes
#1.2 - Mon Sep 17, 2007 10:38 AM EDT
FDBryant3

And yes I do appreciate that my hardened wifi is overkill. It's down to too much listening to Steve Gibson's "Security Now!" podcast.

Heh - I thought I detected some of Mr. Gibson's thinking in there. I usually get the same line of thinking after listening to an episode or two.

  • 4 votes
#1.3 - Mon Sep 17, 2007 10:42 AM EDT
FDBryant3

By the way - you oughta right this into Steve, would be interesting to hear how he would respond.

  • 4 votes
#1.4 - Mon Sep 17, 2007 10:44 AM EDT
Dennis M Wright

I did exactly that. He's replied promising to do a whole episode on this! Wow!

  • 2 votes
#1.5 - Wed Sep 19, 2007 11:41 AM EDT
Reply
BlaiseP

Put him on the router with a cable if you want him on temporarily. He can surely put up with that inconvenience.

  • 3 votes
Reply#2 - Mon Sep 17, 2007 10:00 AM EDT
Dennis M Wright

The router is in the study. Too much of a mess to let visitors in at the moment. I really will have to tidy it up!

;-)

  • 2 votes
#2.1 - Mon Sep 17, 2007 10:24 AM EDT
BlaiseP

Well, in the interests of being a good host, I'd have set him up a new wireless connection (presumably he's on Winders) with the WPA shared address key, then when he's ready to leave, tear down that connection. If you need to protect drives, your server wouldn't be on Windows anyway, you have that stuff chmod-ed down to yourself.

This is why I always have a decrepit old box running BSD to act as as a bastion host. Its whole job is to run the firewall and handle the wireless.

  • 1 vote
#2.2 - Mon Sep 17, 2007 11:42 AM EDT
Dennis M Wright

Actually I'm on Windows and he's got a Mac (clever fellow)

  • 2 votes
#2.3 - Mon Sep 17, 2007 12:05 PM EDT
Reply
Kirk Lennon

I didn't really want to pass out my WPA pre-shared key to Uncle Brian. It's not that I don't trust him, but I just don't feel comfortable with adding it to PCs which are not under my control.

I think your easiest solution is just to get over an irrational psychological barrier. Honestly, if you trust a person enough to let him into your home, what's so horrible about giving him your WPA key? What harm could come from that that can't also come by giving him access through an alternative? And why are you concerned about your shared drives? "Uncle Brian, you're not going to prowl around on my shared drives, are you?" "Of course not, Dennis, that would be unbecoming of a guest."

  • 1 vote
Reply#3 - Mon Sep 17, 2007 11:01 AM EDT
ShaunV

Informative topic and thread.

Thanks.

  • 3 votes
Reply#4 - Mon Sep 17, 2007 12:53 PM EDT
Adam Hobson

I'm always amazed by how completely unsecured most people keep their computers and networks, in my apartment complex alone I have access to five open wireless networks. But then instances like this pop up and you realize that keeping a completely secure network/computer is a pain in the ass. Security needs to work with you and for you, not against you.

  • 1 vote
Reply#5 - Mon Sep 17, 2007 12:55 PM EDT
Leave a Comment:
You're in Easy Mode. If you prefer, you can use XHTML Mode instead.
You're in XHTML Mode. If you prefer, you can use Easy Mode instead.
(XHTML tags allowed - a,b,blockquote,br,code,dd,dl,dt,del,em,h2,h3,h4,i,ins,li,ol,p,pre,q,strong,ul)
Newsvine Privacy Statement
As a new user, you may notice a few temporary content restrictions. Click here for more info.
FUN STUFF:
  • Leaderboard |
  • E-Mail Alerts |
  • Top of the Vine |
  • Newsvine Live |
  • Newsvine Archives |
  • The Greenhouse |
COMPANY STUFF:
  • Code of Honor |
  • Company Info |
  • Contact Us |
  • Jobs |
  • User Agreement |
  • Privacy Policy |
  • About our ads
LEGAL STUFF:
  • © 2005-2012 Newsvine, Inc. |
  • Newsvine® is a registered trademark of Newsvine, Inc. |
  • Newsvine is a property of msnbc.com