Timeline for To sufficiently protect against KRACK is patching the client, the AP, or both, required?
Current License: CC BY-SA 3.0
19 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| S Oct 18, 2017 at 16:50 | history | suggested | Mark Booth | CC BY-SA 3.0 |
Emphasised the currently relevant part of the answer and de-emphasised the historical context.
|
| Oct 18, 2017 at 16:22 | review | Suggested edits | |||
| S Oct 18, 2017 at 16:50 | |||||
| Oct 18, 2017 at 9:12 | comment | added | Matthieu M. | @mobill: It would be great if you could reword your answer with first a TL;DR, and then only the historical perspective. The TL;DR at the start would ensure that no-one accidentally misinterpret your answer, while the historical perspective helps people who heard prior statements understand those were mistaken (editing in the link to the patch in response to IBM statement would be a plus, as comments are ephemeral). | |
| Oct 17, 2017 at 23:56 | comment | added | NetMage | It seems to me that it should be possible to mitigate unpatched client vulnerabilities with the right changes on the AP side, such as noticing an extra Message 3 ACK (for a packet not re-sent) and/or rejecting an extra Message 4 (reply to 3?). | |
| Oct 17, 2017 at 21:07 | comment | added | Will Vousden | @mobill That's my understanding as well. | |
| Oct 17, 2017 at 15:46 | history | edited | mobill | CC BY-SA 3.0 |
deleted 126 characters in body
|
| Oct 17, 2017 at 15:03 | comment | added | mobill | Here's how I parse it: 1) patched AP can still connect to unpatched device. 2) (and vice versa) patched device can still connect to an unpatched AP. 3) To defend against the full set of vulnerabilities, the AP AND the device must be patched. Given that a patched AP/unpatched device is vulnerable to some subset of the vulnerabilities AND a patched device/unpatched AP is vulnerable to a (possibly) different subset. | |
| Oct 17, 2017 at 14:37 | comment | added | Vladimir F Героям слава | @WillVousden It does not say even that. It says if AP is patched and the client not, it is vulnerable. It does not say anything about an unpatched AP and an unpatched client. | |
| Oct 17, 2017 at 14:32 | comment | added | Will Vousden | @VladimirF I guess it's ambiguous; it's not clear whether it means that for a given (device, AP) pair, security is only achieved when both are patched, or that for all devices and APs to be secure, they must all be patched (which is not a very helpful piece of advice). To me the first interpretation makes more sense. | |
| Oct 17, 2017 at 14:03 | comment | added | Vladimir F Героям слава | @WillVousden That quote gives a one way implication. If does not tell if patching the client only is sufficient. If not, everyone is screwed and we can close all wifis. You can't check the routers in the local eduroam or other networks at your workplace. | |
| Oct 17, 2017 at 13:28 | history | edited | mobill | CC BY-SA 3.0 |
Add EDIT section.
|
| Oct 17, 2017 at 12:05 | comment | added | Mirsad | This answer has most of up votes, but it is wrong and it is misleading people, so that should be clarified. | |
| Oct 17, 2017 at 8:59 | comment | added | solsTiCe | Look at this commit: github.com/vanhoefm/krackattacks/commit/…. This was made to clarify the b***** of IBM XForce post. | |
| Oct 17, 2017 at 8:20 | comment | added | Will Vousden | This is at odds with krackattacks.com, which states: Finally, although an unpatched client can still connect to a patched AP, and vice versa, both the client and AP must be patched to defend against all attacks! | |
| S Oct 17, 2017 at 8:20 | history | suggested | muru | CC BY-SA 3.0 |
quote formatting for quoted part
|
| Oct 17, 2017 at 2:15 | review | Suggested edits | |||
| S Oct 17, 2017 at 8:20 | |||||
| Oct 17, 2017 at 0:12 | comment | added | multithr3at3d | To try and further explain, my understanding is that the attack relies on the "re"-installation of a key that is known by the attacker (specifically, the key is 0). The AP and station need the same key to communicate. If the key is only changed on one in the pair, they won't be able to communicate thus there would be no communications for the attacker to intercept. | |
| Oct 16, 2017 at 17:06 | review | First posts | |||
| Oct 16, 2017 at 17:59 | |||||
| Oct 16, 2017 at 17:05 | history | answered | mobill | CC BY-SA 3.0 |