Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Maybe I have the wrong idea but this is a question that has been floating in my head for some time.

Whenever you use an iPhone (or a Mac, Apple products seem to be more prone to this because it simplifies stuff for users) you get asked what network to join if you are not on WLAN.

Now imagine this scenario: You have to debug stuff at your cousin's computer but need access to the internet in order to read up something on the bug. You get the key to the wireless network and save it on your phone. Since it is your cousin's network he's cool with you keeping the key. However, the SSID of the network is the default one from the vendor. You try to tell him how to change it but he doesn't seem interested, so you drop it.

Fast forward some time, you are in a city and want to read up something. Since the iPhone is on 3G, it asks if I want to join a wireless network (even though I deactivated that feature). However, when there is a Network with the same default SSID, it does not show me a list of networks but rather an input field that asks the key to that network as if I typed it wrong.

My questions

Has the device (regardless of hardware) already sent the key to the wrong router prior to asking a new key? If yes, is it a security risk worth caring about and can that technique be used against me if, for instance, someone sets up a second network in my vicinity with the same SSID? Is static DHCP for WLAN-devices a useful fallback technique once the key is broken?

share|improve this question

1 Answer 1

up vote 10 down vote accepted

There is nothing to worry about. The key is not sent to the router.

The key is what is used to encrypt the traffic from both ends. So if the access point doesn't have the same key to decrypt the traffic you are sending it, all it will see is garbage.

share|improve this answer
    
Although that garbage could be handy if it's using a weak encryption scheme. (i.e.: WEP) –  Iszi Mar 29 '11 at 3:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.