What prevents a coder from brute forcing a wifi?

Question

I know that a coder is able to connect to a wifi through code so my question is: Is there anything that will make it difficult to brute force a wifi password?

Answer 1

What makes WiFi encryption harder to brute force?

First, a strong password, preferably not set to the router default. The best password is set using a cryptographically secure random number generator (CSRNG), to the full 63 ASCII or 64 Hex chars. You can also use WPA-802.1X mode, however, this requires a Authentication server, and therefore is generally used for large networks.

However, a password built from five and more words would be far easier to remember, without significantly compromising the security of the key.

Another issue is WiFi Protected Setup, specifically, the PIN method significantly reduces the entropy for an attacker. The PIN is a 8 digit number checked in two chunks. This reduces the entropy from around 50 bits (5 word password) to less than 15 bits (2 times a 4 digit PIN), a factor of more than 34 billion. Turn that off, and you'll be relatively safe.

Answer 2

Only the size of the key/passphrase, really. Given long enough, it's always possible. An access point could theoretically have some rate limiting built into it, which would help against authentication schemes that can't be attacked offline, but in practice the only solution is to use a long key/passphrase. You also need strong encryption, of course. (Do not use WEP; it's broken. Similarly, do not use any variant of MS-CHAP if using WPA-Enterprise.)

When discussing brute force attacks, it's important to consider the size of the search space (the collection of possible values). This is often discussed in terms of entropy, usually discussed in the base-2 logarithm of the number of possible values. For example, if there's about a billion (10^9) options, that's 30 bits of entropy (2^30 is roughly a billion). Compare this value with rate that your attacker can try guesses at; in general, it's probably worth assuming at least a thousand guesses per second for an online attack (though in practice home WiFi access points can't support that many).

Completely random English letters and numbers, case-sensitive, are about six bits of entropy per character, but the letters in English words are only a couple bits per character; there are usually only a handful of possible options for the next character in a word. This means, in practice, that human-memorable passwords are usually not very good, but passphrases, especially ones composed of randomly-chosen words, can be quite good.

XKCD has a pretty good illustration of this concept.

Answer 3

You can consider allowing connections only to whitelisted mac addresses and then even brute forcing the password won't succeed, but this is only a defence against casual attacks as mac spoofing is relatively simple to achieve.