2,661 reputation
21222
bio website
location
age
visits member for 3 years, 6 months
seen yesterday

May
17
comment How do I protect myself against 'hole 196'?
@Rook A source for what statement? Again, the PSK is the only secret master key in the whole ESSID. All other informations are sent in clear-text in the air, or derived from the PSK and informations sent in the clear. Once you have given the PSK to a double-agent, you pretty much have an open unencrypted WLAN - inside a Faraday cage (outsiders cannot connect to the WLAN).
May
17
comment Does vulnerability exist when using XHR with GET method and custom anti-CSRF HTTP header?
@cx42net It isn't clear why the OP thinks it is necessary, or even useful, to prevent the legitimate user from copying the URL. What is the threat model here?
May
17
comment Does vulnerability exist when using XHR with GET method and custom anti-CSRF HTTP header?
+1 Some users will post a copy of the browser windows to forums, revealing the URL (I have seen it). Some users will actually post the URL as text (I have actually witnessed that a few times). Many users do not understand that a URL sometimes contains sensitive information.
May
17
comment How do I protect myself against 'hole 196'?
Knowing the PSK you can even setup a rogue AP that cannot be distinguished from the legitimate ones: clients could detect a BSSID change, but they cannot assume that there is only one AP for a given SSID as many AP could be part of the same ESSID. Of course the BSSID could also be cloned. Conclusion: WPA*-PSK offers zero protection against insiders. Use WPA-Enterprise.
May
16
comment How do I protect myself against 'hole 196'?
@drjimbob "eavesdropping by others which most modern networks with a star based topology would not allow" unless by "most modern networks with a star based topology" you mean "switched Ethernet with specific security features that prevent DOS on the switching logic as well as ARP poisoning", this is not true. "Most wifi setups do not use RADIUS authentication servers, instead opting for (often-weak) pre-shared keys" If they buy such professional-grade Ethernet switch, why do they use WPA-Personal with a weak passphrase? It is hard to believe that they fear wired more than wireless.
May
16
comment How do I protect myself against 'hole 196'?
@drjimbob "If an insider didn't intercept the initial nonce" then all they have to do is to force dissociation.
May
16
comment Any advantage to securing WiFi with a PSK, other than to keep out unauthorized
"Hole 196" is a hole only if you have insane expectations for an "open" thing.
May
14
comment How do I protect myself against 'hole 196'?
@drjimbob "Wifi makes it trivial for anyone nearby to eavesdrop or interfere" Obviously, "open" (cleartext) Wifi is trivial to attack for anyone in range. "and only starts to be comparable in security" Which "security" properties? As you said, encrypted Wifi is still detectable and can easily be jammed (and some people even say it gives you cancer!). It all depends on the security properties you need. I am happy to let my neighbours know I use Wifi, and they never tried to jam my signal (my MW oven tried to jam my Wifi, but then changed channels).
May
14
comment when is it safe to click through an SSL warning message?
@Misha "if you have visited it before (even if your use this time is non-confidential browsing, say), because it will have access to HTTPS-only cookies for that domain?" before, and after!
May
14
comment when is it safe to click through an SSL warning message?
"On a theoretical point of view, an HTTPS site with a warning on the certificate is no better, but no worse either, than a plain HTTP site." Sorry, this is not correct from a purely theoretical point of view. Accepting the unverifiable certificate is a global change to the browser, it impacts not only the current browsing context, but the HTTP/HTTPS engine used by the browser for every other website. You may think that accepting a certificate for a website you do not trust (or even know about) is safe, but that intuition is wrong. This domain may be used by another, trusted website.
May
14
comment How do I protect myself against 'hole 196'?
@drjimbob Indeed. You should always go directly to the https URL. You should bookmark this URL, not the HTTP URL. The HTTP URL should immediately redirect to the HTTPS URL, so people don't have a chance to bookmark it. You can also define as HTTPS-only with a header whose spelling I forgot. Anyway I do not think that the Web browser should be used for anything really sensitive unless it is totally castrated to only be able to access a few trusted servers.
May
14
comment How do I protect myself against 'hole 196'?
@drjimbob "If I want to DOS a wifi connection its as simple as turning on a nearby interfering microwave oven" Choosing a low Wifi channel helped me with my Wifi vs. MW conflict (the 5 GHz band would help even more, I don't have such Wifi card). EOAnectode. Of course what you say is correct, and it applies to to any radio communication that is not very focussed, or uses military, unpredictable channel hoping. There is nothing special with the Wifi protocol here, it's about the physical media. Note that DSL is wired and also has similar EM noise issues.
May
14
revised How do I protect myself against 'hole 196'?
added 9 characters in body
May
14
comment How do I protect myself against 'hole 196'?
Please explain the downvote.
May
14
comment How do I protect myself against 'hole 196'?
@Iszi The "just break the glass" vulnerability applies to all windows, opened or closed. It is much less relevant to opened windows. If you are worried about this vuln, you don't leave your windows open either (or you shouldn't). If you leave your windows open you should rather worry about the "just go through the open window without breaking the glass". The "hole 196" applies to all variants of WPA, but I can't see its relevance to a Shared (as in shared by every Wifi client) Key set-up. If you worry about insiders you don't share the master key. That would be insane.
May
14
revised How do I protect myself against 'hole 196'?
edited body
May
14
comment How do I protect myself against 'hole 196'?
"Most security researchers consider "hole 196" to be more of a technical break than something that is very useful to the attacker." It isn't either things. "I think that the WPA-PSK handshake, [is] far more serious threats" If you are using PSK you cannot be worried about said "hole 196".
May
14
answered How do I protect myself against 'hole 196'?
May
14
comment How do I protect myself against 'hole 196'?
I don't understand what you are talking about: which "malware injection, port scanning, denial of service, etc." techniques are related with "Hole196"? Port scanning is a legitimate non-intrusive remote examination technique of any network-connected computer. "open" vs. "closed" ports is not a secret. You just have to accept that. ARP poisoning is an Ethernet thing, it isn't specific to Wifi.
May
14
revised Is my computer at risk of being hacked when using public Wi-Fi?
more on cookies, f.ex. Google identity