2

I recently purchased a Honeywell thermostat with a WiFi connection, and I haven't been able to get it connected to my network yet. According to a representative, the network name and password are required to be 13 or fewer alphanumeric characters. Before I go about changing all the passwords on the machines, I want to know:

1) Is this a common restriction for small hardware pieces like this? The rep sounded pretty confident in her information.

2) Will my home network be sufficiently secure under these restrictions?

1 Answer 1

7

A password of 13 alphanumeric characters CAN be robust enough to ensure security. There are 6213 such passwords, a number which is close to 277. If you choose such a password with full uniformity (i.e. you generate all 13 characters independently from each other, using a strong random source, i.e. /dev/urandom or some dice but not any biological brain), then you have 77 bits of entropy, and brute-forcing that is on the verge of the possible. That is, it could be done, but it would be expensive (cost in dollars would rise to the billions, not mere millions). In that sense, setting a 13-character password for your home WiFi should not impact your security too much, if you do it properly.

However...

A limitation to 13 characters screams of WEP. WPA and WPA2 can use any password length between 8 and 63 characters; a password length limited to 13 (a weird value in the absolute; developers prefer powers of 2) probably means that the thermostat will want to connect to your WiFi with WEP.

And that is bad news. WEP has a very poor design and can be easily broken through with software which is readily available for free, regardless of how random the password is. It is probable that even with the 13-character password, the thermostat won't connect until you configure your router to allow WEP, and that would punch a hole in your security. A big hole. Rather a four-lane tunnel, really.

It is relatively easy to check, though. Set a 13-character password but without enabling WEP, and see if the thermostat can work with that. But if you value your network security, do not enable WEP. Never.

(If you really must make this thermostat work and if that cannot be done without WEP, then you might consider buying an extra WiFi router, for the benefit of the thermostat alone. Then link that extra router to your network with a firewall in-between, blocking everything except that which is strictly necessary for the thermostat to do its work.)

4
  • I'd second that final paragraph. This is what I ended up doing for some devices that could only use WEP - and segregated it entirely from the rest of my networks.
    – Rory Alsop
    Commented Sep 13, 2013 at 20:25
  • No, it supports WPA2. I can't imagine why it has those limitations, except possibly old software or lazy programmers :)
    – Ben Fulton
    Commented Sep 14, 2013 at 20:05
  • Seriously, what is wrong with bimetallic elements for heating? Does everything really need to be networked?
    – munchkin
    Commented Apr 30, 2015 at 1:55
  • @munchkin being networked is nice, as long as it's not dependent on any remote server (cloud) and doesn't communicate with anything on its own.
    – user42178
    Commented Apr 30, 2015 at 2:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .