Sometimes a guest asks for my wifi password, and I gladly give it to them. Sometimes that guest has a wifi sharing app, and said app shares the key with totally random strangers (I know there is some kind of social networking going on so they are not totally random, etc, but let that behind for now).

I have several times changed my wifi password after the fact, but then I have to reauthenticate all my family devices, and again give the wifi to my guests again.

Is there a way to avoid getting the key shared by the app, to mitigate the risk of strangers connecting, or is changing the wifi key every few days the best strategy?

  • 1
    @drewbenn Problem with your logic is that this is exactly the problem that Wi-Fi Sense causes. – Iszi Apr 18 '16 at 20:25
  • 1
    @drewbenn It may not be shared by default, but it still is shareable. AFAIK, any Wi-Fi network that your system has credentials for can be shared - whether that one was shared with you or entered manually. Also, Wi-Fi Sense provides practically no granularity in terms of deciding who you share your network with - you only get to pick which social platforms it's shared on. – Iszi Apr 18 '16 at 20:34
  • A bit of clarification about what networks can be shared with Wi-Fi Sense: It seems the network's PSK needs to be entered when sharing is turned on. (Per the FAQ here.) That does make it more difficult for people who receive your network info via WiFi Sense to re-share it, but it should be noted that it is still not impossible. The system still needs a way to retrieve the PSK as cleartext, so there are certainly ways for a determined user to do it for themselves. – Iszi Apr 18 '16 at 20:38

If you give a guest a wifi password, they can share that password though obviously you could politely ask them to not share it. The only way to prevent that is never share one global wifi password with guests you do not trust.

The best practice would be to maintain your home wifi network (secret password, never give to others) and a shareable guest network (still with a strong password), but one you are willing to share and change frequently if your guests are sharing that password inappropriately.

MAC address filtering is probably not worth the effort, as again your MAC address is broadcast to everyone in cleartext every time you send a packet.

If you really need a more permanent solution, you could probably setup a captive portal on your guest network where users need to register their information and set up a username/password. Then you can flag and shutoff problem accounts (e.g., if more than 2 MAC addresses use the same password then you shut it off, or if it uses more than ~1 GB of downloads, etc.).

  • 4
    If you're going to bother with a web portal, why not just switch to RADIUS for WPA2 authentication? – Iszi Apr 18 '16 at 20:44

Here are some options: You could buy an additional cheap router, and turn it off and on whenever needed. You could add Network Access Control, you could configure your existing router to ONLY accept your devices' MAC addresses. When a guest comes in, add his MAC to the list, ignoring all unknown MAC addresses, and remove their MAC when they leave. Or you could simply say: "I do work on my wireless, and do not mix business with pleasure."

The MAC address solution is the cheapest but requires you to log into your router, and add the guest's MAC address to your allowed table. It also ensures that you have your devices entered in the same table so you wouldn't need to continuously add them. Wireless routers are cheap though, you could get used one, turn it off and on for guests without having to worry about much as you could unplug it with they leave.

  • 1
    MAC addresses are easily spoofed so offer little security. – Neil Smithline Apr 18 '16 at 20:06
  • @NeilSmithline It is always worth noting that MAC filtering can be easily bypassed. For this scenario though, you have to ask: How likely is it that someone within the social network that is receiving your PSK will also have the skills, desire, and dedication to do the work required? – Iszi Apr 18 '16 at 20:32
  • @NeilSmithline anything can be spoofed including packets. Someone would have to get on his network, get a valid MAC address that is in his list. Kind of a moot point. – munkeyoto Apr 18 '16 at 22:09
  • Is that the case munkeyoto? Wouldn't an attacker just need to be nearby when a client makes a probe request as the MAC address is transmitted in the clear in those requests? The guest's device's MAC address seems particularly vulnerable as they will take it other places and the MAC address can be obtained elsewhere. Of course, cooperation by the guest to actively distribute their MAC address would be even simpler, but require an evil guest. – Neil Smithline Apr 18 '16 at 22:17
  • Note that I don't think this is a big deal, just something that deserves mentioning so that a reader doesn't assume that MAC address filtering is better than it is. – Neil Smithline Apr 18 '16 at 22:18

What you want is an AP that offers some sort of Guest Network functionality. This would allow you to give out the wifi password, guests can then access the internet (since they probably have no business talking to your devices directly) and then every few days you can reset that password to the detriment of anyone else who might know it at that moment.

Sharing the password can't be stopped by any practical means, and the only other way to mitigate the effect of sharing would be to whitelist each new user's device which is probably more trouble than just either giving them a guest password that's changed often, or telling them that your wifi is broken ;-)

  • 1
    Whitelist the MAC address? These can easily be spoofed. – Neil Smithline Apr 18 '16 at 20:05
  • Whitelisting MAC addresses is actually much easier than giving out a password that gets cycled often. Once a MAC is on the whitelist and the client has your static password, you don't need to do anything more for them. Whenever you cycle a password though, you'll have to re-configure every client when they return. As @NeilSmithline mentions though, MAC filtering is indeed easily bypassable by a dedicated attacker. So the question then becomes: How likely is it that a dedicated attacker is going to be within the social network where your PSK is being shared? – Iszi Apr 18 '16 at 20:30
  • Reconfiguring the client is the guests problem (provided you can remember the password off the top of your head) so it's not overhead on the operator. And mac spoofing? For a guest to get on your wifi? Jesus if you really worry like that just never give out your password to anyone. – Jeff Meden Apr 19 '16 at 12:30

Actually, you have two options:

  • guest network - fast and dumb solution. It can be reconfigured as many times as you need, but it will require you to re-provide the credentials. But it can be an "isolation layer" that will properly separate your Wireless devices from aguest ones.
  • MAC access control - a little elaborating, but secure solution if applied properly. For your guests make a separate WirelessLAN, maybe a guest one, no matter. After that use not just MAC filter, but also an OTP. A Google Authenticator is the most common helping app in this schema. The software is called WifiOTP
  • It should be noted that MAC filtering is easily bypassable for a dedicated attacker. I'm not sure about WiFiOTP either - personally, I'd stick with old & trusty WPA2. – Iszi Apr 18 '16 at 20:27
  • @Iszi please take a deeper look at proper integration of MAC filtering. Yes, just MAC filtering is a piece of cake to crack/bypass. WifiOTP is only a way to authenticate, and old-good WPA2 is in order, of course – Alexey Vesnin Apr 18 '16 at 20:30
  • I'm still not really clear what WiFiOTP is designed to solve here. If you assume the attacker already has the PSK, the only thing that can stand in their way (for most SOHO routers at least) is MAC filtering. And no amount of "proper integration" will help here. Unless you want to move up to enterprise-level hardware and security software, your router will have no way of telling whether someone using a certain MAC is an authorized user or an attacker. – Iszi Apr 18 '16 at 20:43
  • @Iszi WiFiOTP applies OTP for a private(non-broadcasted) SSID, so there's technically no PSK =) Nothing to share =) And don't forget about OpenWRT – Alexey Vesnin Apr 18 '16 at 20:44
  • SSID hiding is just as weak as MAC filtering. Even worse, it makes you more vulnerable to an attacker who might spoof your AP while you're not near it. Personally, I do MAC filtering (along with an extraordinarily strong WPA2 PSK) but I will not hide my SSID. – Iszi Apr 18 '16 at 20:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.