Hot answers tagged wifi
12
The question (to most people) is an oxymoron. By definition, people will think that "open WiFi" means "un-encrypted WiFi. To me you seem to be asking "Why did the people that wrote the 802.11 standard way back in 1997 make the decisions that they did?"
The short answer - we can only find out by asking them (or seeing if there are any discussion documents ...
11
Firesheep has nothing to do with the WiFi encryption. If you and I were both on an encrypted WiFi connection, I would still be able to Firesheep your data.
What Firesheep does happens at the router level. It does not intercept the waves on air (well, not exactly)
Basically, it runs an ARP spoofing attack. This sort of attack can be run on a LAN network as ...
11
If your bank Web site uses HTTPS, and you dutifully check that the server name in the URL is indeed the expected name, and you don't disregard warnings about unverified or expired certificates, then yes, it is safe.
If these conditions are not met, then no, it is not safe -- but it would not be safe from anywhere else either. Public WiFi is not special in ...
8
The PSK variants of WPA and WPA2 uses a 256-bit key derived from a password for authentication.
The Enterprise variants of WPA and WPA2, also known as 802.1x uses a RADIUS server for authentication purposes. Authentication is achieved using variants of the EAP protocol. This is a more complex but more secure setup.
The key difference between WPA and WPA2 ...
6
You can technically start sniffing away without "connecting" to the network. Terry is correct, if the network is open (no encryption, WEP/WPA/WPA2) then you can just "Join" the network and sniff the traffic. However, you do not need to join the network to sniff the traffic. WLANs use radio frequencies, all you have to do is match the freq (channel) and ...
5
Ultimately, it's near impossible to tell with absolute certainty that nothing was installed on your system. Rootkits and such make it next to impossible to verify a system is clean after an infection which is why the adage to "nuke it from orbit" exists in the security community.
That said, you seem to be paranoid about this. Why do you expect that they ...
5
WPA2 is more secure than WPA as explained by Terry. You just need to understand the difference between personal (pre shared key) and enterprise versions of both the protocols.
The personal version is where all the users share a secret password that is configured in the access point. In the enterprise version there is a central authentication server and all ...
4
The first step in any sort of MITM attack on a network is connecting to the network. With a wired network, that involves somehow connecting your machine to the network through the use of an Ethernet cable. With a wireless network, you just need to connect to the network.. well, wirelessly. Without a requiring a password to connect to a wireless network, ...
4
The other answers have already explained that Firesheep-style attacks (basically MitM trhough ARP spoofing) have nothing to do with WiFi itself. This is a link-layer issue.
As for why open WiFi networks don't have encryption. Well, they just don't. I don't really know why they decided not to, I can only speculate. One very obvious reason is MitM attacks, as ...
2
You're correct that they are not the same problem: Password authentication and symmetric encryption are fully independent concepts that can each be implemented without the other. However, a password is one of several ways to produce the key necessary to operate the encryption.
An encrypted connection such as that between your computer and your AP is ...
2
When you are talking about "no password" and "same password," I imagine you are referring to the pre-shared key. This is not actually a password, but used as a known value by the station and AP to generate and securely (at least from outside sources without the known value) exchange keying material for the encrypted traffic. WPA/WPA2-Personal do not ...
1
1) Depends on how your computer is setup and how observant you are. It shouldn't be obvious if they are competent, but little things like unexpected CPU and Hard drive usage are not really something that they can easily prevent from being visible. There are normal activities that can cause random CPU and HDD activity, but an attempt at hacking would have ...
1
If he's doing something to my laptop, will I notice?
Probably not if the hacker is in any way competent.
Hackers can copy data stored on my laptop, but can they possibly retrieve permanently deleted files? (empty recycle bin type of delete or shift + delete)
There is always a possibility. "Permanently deleted" files aren't really deleted. Traces ...
1
I suspect the answer has to do with the "statelessness" of the WIFI router. Incoming and outgoing packets are treated uniformly. If some sort of encryption were negotiated on a per-connection basis, the router would have to maintain state for each communicating partner.
This would break the "layer" model; that packets are treated uniformly and higher ...
1
Say you have 10 users.
In PSK mode all 10 users are using the same passphrase to generate the same key. Therefore, the likelyhood of capturing traffic and analyzing it to find the key is higher with so much traffic, and that key will be good until all 10 users agree to change the passphrase (and therefore the key)
If those same 10 users use their own ...
1
WEP was one of the first protocols which tried to secure the wireless networks. It was a part of IEEE 802.11 standards. It was cracked almost a decade back and rarely seen these days.For details on how it worked and its vulnerabilities you may see this
WEP made use of RC4 stream cipher for encryption.The problem with RC4 is if the same key stream was used ...
1
Connecting to your bank over any WiFi that you do not absolutely trust is a mistake (in case you have a lot of money, of course). While in theory checking the URL and warnings does provide a level of assurance that you're not being MITM-ed (traffic is not intercepted), there are tools that work most of the time by utilising, for example, homonymic domain ...
Only top voted, non community-wiki answers of a minimum length are eligible
