Hot answers tagged

91

Enforce Consequences for Students Found on the Network The first thing you need to do is ensure you have a written policy outlining what devices are allowed on the network. However, if you are not consistent in the enforcement of your policy, it is useless. This should also cover the usage policies for the Teachers, including locking their computers when ...


80

There is no method to make WEP uncrackable, or at least secure. So I suggest buying a new router that suports WPA2.


72

There are two different passwords that access different functions. If an attacker has the admin password, then he / she can change the SSID, WiFi password, and any other settings on the WiFi router. To fix: ensure your WiFi security setting is WPA or WPA2. Then change the WiFi password to a long one (at least 12 characters, more is better) with special ...


66

Short answer is yes. If there is any logging on their WiFi router they might not be able to see exact apps, but they'll be able to see the server domain/hostnames that you're connecting to. You can also look at these question and answers: Is there a way for my ISP or LAN admin to learn my Gmail address? Can an employer see cellular network traffic routed ...


59

This is actually exactly the type of environment VPNs were designed to work in: when you cannot trust the local network. If set up properly (i.e. making sure all traffic goes through the VPN and using a secure mutual authentication scheme) it will pretty well protect your connection. This, however, requires the whole thing to be designed properly. ...


52

You are trying to solve the wrong problem. They are thousands and you are one. Since you are not a security expert (as far as I understand, sorry if I'm mistaken) and they aren't either but they are a horde, you are just bound to lose if you fight a conventional war. @AviD gave a great answer in a comment: Here is a non-technical idea: This is a ...


49

It is unlikely a hacker stealing internet access will have the sophistication (or need) to make the wireless network change between different names. It is more likely that someone/some device nearby installed a new wireless network that happen to broadcast on the same channel as yours (there are only 3 or 4 non-overlapping ones to choose from) and have a ...


46

I see two possible uses of such information from a government perspective. None of them involves the password or actually using your WiFi access. Forensic analysis: connected devices store an history of access points they were connected to, sometimes associated with "last seen" dates. Using this history, it is therefore possible to know where someone was ...


40

There is really only one solution to your problem. I do note however that you're not interested in upgrading your router, so I will talk a little about that. Remember that by not upgrading your router, you are only delaying the inevitable. What will work long enough for you to get a new router: PULL THE PLUG This is honestly the best solution until you ...


37

Giving the WiFi password away effectively gives full access to the local network. From there the guest might access the other computers inside the same network unless they have an additional protection. The guest can also try to brute force the router password, can mount man in the middle attacks with ARP or DHCP spoofing .... Because of this better routers ...


25

Although it is not one of the things you listed in your question, he can engage in illegal activity over the internet which, when investigated by the authorities will render your IP as the source. Which, depending on the country you live in, may land in you in a lot of trouble.


23

Short version No. All you need is WPA2-AES with a custom SSID and a strong passphrase. All this assumes a "home" scenario where the AP and clients are using a PSK (preshared key). In Enterprise settings there are a couple of other attack vectors but one nice thing about a PSK is it greatly simplifies the attack surface. It pretty much comes down to the ...


23

If you are not using a VPN, then every site you visit that sends or receives anything sensitive (especially passwords) should be HTTPS rather than just HTTP. The 's' in HTTPS stands for secure which is provided by TLS handshaking and encryption. In effect, when using TLS (i.e. HTTPS, which I refer to interchangeably here) you are effectively using a separate ...


20

If passwords are leaking like that, you may have a bigger problem than restricting Wifi access. It sounds as if the kids could do almost anything a teacher can do (including manipulate exam results?) and are routinely doing so at your location. It sounds as if a little bit of teacher education would solve this, after some detective work to narrow down the ...


19

Ethernet Before I get flamed by everyone who says iPads don't have ethernet ports, this is simply a single layer of "security". In most cases teachers should be able to use their laptops with a physical ethernet BASE-100TX CAT5+ plain old physical cable. You will have reduced the attack surface area (as the keys won't be on the teacher's laptops anymore). ...


19

So you were redirected to a captive portal page that had an expired certificate. Theoretically this puts in risk only the data you transfer over this particular connection, ie. accepting the rules and eventually your personal or payment data if you had to provide any. In fact the captive portal did not have to use https connection at all and you wouldn't ...


17

It does not take much effort to block P2P etc with current routers and restrict access as this detailed article from 2011 (Lifehacker) shows. But unless you restrict access a lot and thus make users unhappy they will still be able to upload copyrighted content to youtube, make bomb threats etc. If you don't want to deal with these liability issues (which ...


16

This seems like a bureaucratic way of instilling FUD (Fear, Uncertainty and Doubt) in a population. For example in the old Soviet Union, neighbors would routinely spy on neighbors and agencies collected notes on citizens. But the raw data of those notes were so enormous—and the bureaucracy was/is so inneffecient—that the actual information collected was ...


16

WLAN/WiFi can be secure when properly configured (this certainly requires a password or key). Cellphone connections are not really secure. They are encrypted based on a key from your SIM card. This key is also known to your mobile network operator. You do not need a password, but your communication can be intercepted and eavesdropped on by your mobile ...


14

No. You cannot make WEP uncrackable, but there are some things you may be able to do to help the problem until you get a new router. Modify the signal strength. Take off one (or more) antennas from your router (if you have a small apartment). Move your router to the center of your home. These steps may make it more difficult for a neighbor to get a decent ...


14

Ok I am changing my answer after reading all the comments. You need to understand the basics: SSID = The SSID is the name of the wireless broadcast from your router. This is not a username. If the person keeps getting in then its possible your security is not WPA2 like you think it is. or your password for the wifi is really weak or common. try a ...


13

Consider an equipment upgrade I know you're looking for a no-budget solution, but a matching set of enterprise-grade WAPs and central controller could make securing the network easier. Weigh it against the cost of defending against a lawsuit for cyber-bullying, or harassment of an employee, or facilitating the falsification of test scores... Use MAC ...


13

Give each authorised user their own individual password. Then you'll be in a position to judge where the leaks are coming from (assuming they're being leaked as opposed to cracked). (eg You may find that need to educate one of your teaching staff not to leave the password written down on his desk). Set up harsh firewall rules that block access to most of ...


13

There are two (main) modes in which to run WPA2. You can use enterprise mode or pre-shared key (PSK) mode. If you run in enterprise mode you need to set up an authenticating RADIUS server, and configure certificates on the clients that will connect to the access point. Furthermore you need to configure the AP will all the relevant information. This level ...


13

Someone who has administrative access to the network you are connecting to can: View the IP address and domain names of the site you're connecting to (based on DNS query and/or SNI in TLS) and which email provider you're using, irrespective of encryption. You can prevent this by using encrypted third party DNS (e.g. DNSCurve to OpenDNS). The location of ...


11

The attacker did not seem to really try to conceal his track :he could have faked an existing MAC address for instance, or used the classical yagi antenna + high power WiFi adapter to silently intercept your communication. Instead it seems he just used a classical home grade WiFi range extender with what seems to be default settings. So it still seems very ...


10

You need to tighten human security, not technical security. WiFi password is good enough, the real questions are "Who is leaking passwords to students?" and "How to stop them?". You can't have any security if privileged persons (staff) share their credentials with the ones you're trying to block. Setting up different passwords for every single person would ...


9

I would use WPA2-Enterprise, so everyone would use own name and password, not just a password, which is same for everyone. To setup WPA2-Enterprise, you just need to have RADIUS server. The cheapest opinion, I think is to buy a NAS server. It supports multiple things and RADIUS sometimes too (I recommend Synology for this). Alternative is to use some ...


9

WEP has fundamental design flaws preventing it from ever being secure. This means that in order to get a secure network you either have to replace WEP with something secure (WPA2) or enforce security at a higher level in the protocol stack. Security at a higher level in the protocol stack means you don't allow your AP to get access to the internet. Instead ...


9

Whether you company will be able to see the content of your chats depends on a couple of factors Is your access to the chat site encrypted? if you're using SSL, then normally someone running a network you're accessing it over, will not be able to see the content of the chat (although they will likely know the name of the site you're accessing). The ...



Only top voted, non community-wiki answers of a minimum length are eligible