Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I recently purchased a Honeywell thermostat with a WiFi connection, and I haven't been able to get it connected to my network yet. According to a representative, the network name and password are required to be 13 or fewer alphanumeric characters. Before I go about changing all the passwords on the machines, I want to know:

1) Is this a common restriction for small hardware pieces like this? The rep sounded pretty confident in her information.

2) Will my home network be sufficiently secure under these restrictions?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

A password of 13 alphanumeric characters CAN be robust enough to ensure security. There are 6213 such passwords, a number which is close to 277. If you choose such a password with full uniformity (i.e. you generate all 13 characters independently from each other, using a strong random source, i.e. /dev/urandom or some dice but not any biological brain), then you have 77 bits of entropy, and brute-forcing that is on the verge of the possible. That is, it could be done, but it would be expensive (cost in dollars would rise to the billions, not mere millions). In that sense, setting a 13-character password for your home WiFi should not impact your security too much, if you do it properly.

However...

A limitation to 13 characters screams of WEP. WPA and WPA2 can use any password length between 8 and 63 characters; a password length limited to 13 (a weird value in the absolute; developers prefer powers of 2) probably means that the thermostat will want to connect to your WiFi with WEP.

And that is bad news. WEP has a very poor design and can be easily broken through with software which is readily available for free, regardless of how random the password is. It is probable that even with the 13-character password, the thermostat won't connect until you configure your router to allow WEP, and that would punch a hole in your security. A big hole. Rather a four-lane tunnel, really.

It is relatively easy to check, though. Set a 13-character password but without enabling WEP, and see if the thermostat can work with that. But if you value your network security, do not enable WEP. Never.

(If you really must make this thermostat work and if that cannot be done without WEP, then you might consider buying an extra WiFi router, for the benefit of the thermostat alone. Then link that extra router to your network with a firewall in-between, blocking everything except that which is strictly necessary for the thermostat to do its work.)

share|improve this answer
    
I'd second that final paragraph. This is what I ended up doing for some devices that could only use WEP - and segregated it entirely from the rest of my networks. –  Rory Alsop Sep 13 '13 at 20:25
    
No, it supports WPA2. I can't imagine why it has those limitations, except possibly old software or lazy programmers :) –  Ben Fulton Sep 14 '13 at 20:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.