1

My roommate's wifi password is just the ssid with a single-digit number appended. The ssid itself is a word that appears in the dictionary also with a single-digit number appended to it. E.g. his network might be called Dict-word6, with the password being something like Dict-word65.

I want to hop on his wifi but he stubbornly keeps brushing off my requests that he let me hard reset the router and switch to a high-entropy password. I'm wondering if I should just use it and not really worry? How likely is it that some hacker actually cracked his password? (He's not a target in the hacker world by any means, just a regular dude.)

Edit: my question evolved from how secure is it to how do I securely use it. Answers to the second point are in the comments.

Improve this question
7
  • 2
    What do you think? Of course it's horrible. You can use it, just handle it like an open network in a cafe or a hotel and use VPN for things you want to keep private like banking. Btw, dictionary doesn't mean low entropy. "PigPlaneHammerRainbowGatlingUnicorn" is a pretty darn good password. xkcd.com/936
    – Broco
    Commented Sep 26, 2018 at 8:11
  • Yeah, I mean it's a single dictionary word :)
    – idonutunderstand
    Commented Sep 26, 2018 at 8:43
  • 1
    Having a not-quite-open WLAN is as secure or as insecure depending on how you use it and what advantage you have by being on that connected LAN. Ideally it should not matter and you can treat it like a public hotspot.
    – eckes
    Commented Sep 26, 2018 at 13:11
  • 1
    @idonutunderstand nah, that's not what I meant. Having a stationary insecure WLAN gives a lot of other attack vectors, e.g. analysing the traffic, then spoofing and then possible redirects etc. Also you can assume that the password for the router login itself isn't very secure either. Basically you have to be cautious all the time, a VPN let's you just feel safe. Or just kick your roommate until he fixes his stuff.
    – Broco
    Commented Sep 26, 2018 at 17:54
  • 1
    You could use a VPN with a PSK for authentication. Any attackers will have a difficult time with any kind of MitM attacks on you that way.
    – xorist
    Commented Sep 26, 2018 at 18:43

1 Answer 1

Reset to default
3

It's a pretty awful password, if anybody is trying to break in. A WiFi password brute-forcing tool would almost certainly find it quickly. I certainly wouldn't treat it as Definitely Secure.

On the other hand, the odds that anybody has tried to break in are probably minimal. You (or your roommate) could consult the device table to see who all has connected, but the odds are that nobody has bothered. Most of the time, people don't bother guessing even easy-to-guess passwords; they just go for either totally open networks or ones that are still using documented and consistent passwords.

Hard-resetting the router shouldn't be needed. Changing the password is easy and doesn't usually even require a reboot, much less a complete reset. If you're worried about some malicious actor getting into the device through its WiFi interface and then uploading malicious firmware, a hard reset probably wouldn't even solve that (and also, that's a very unlikely scenario unless the router is so insecure it can be compromised from the Internet through the WAN port).

Sorry your roommate sucks at security. I take it you don't have access to a separate network / Internet connection yourself?

Improve this answer
4
  • if he keeps the insecure password but I use a VPN service like strongvpn.com or nordvpn.com, can I treat my connection through his wifi as Definitely Secure? X)
    – idonutunderstand
    Commented Sep 26, 2018 at 11:42
  • 1
    A VPN should give you secure remote access to the network depending on if it's set up with encryption and hashing but if the network is compromised because of a weak password then the problem is that there is an untrusted device on your local area network, so any defenses added by the gateway's firewall is bypassed. The only upside to a weak wifi password is that you need to be within range to access it. One downside is that a person would only have to get in to the config mode on your router once to modify settings and create themselves a remote VPN.
    – flerb
    Commented Sep 26, 2018 at 13:51
  • 2
    Using a VPN would prevent others from sniffing your Internet traffic, even if you use otherwise-insecure protocols like HTTP, yes. It would work even in the case that an attacker uses their access to the router's network to launch a man-in-the-middle attack. VPN will not protect your local network traffic, though. Also, VPNs tend to cost money, limit your bandwidth, increase your RTT (ping times), and/or some combination of those, and also you have to trust the VPN service since you're deliberately giving it a man-in-the-middle position.
    – CBHacking
    Commented Sep 26, 2018 at 18:43
  • Alright we changed the password and all devices listed under current and recent connections check out. But I don't think it's a complete list because a device that I connected a while ago is not listed and I'm wondering if there is a way to see the FULL device table? I guess the answer is specific to the router but in general should it be possible?
    – idonutunderstand
    Commented Sep 30, 2018 at 22:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .