8

If a company has offices way up in a skyscraper, is it acceptable to have an open network without a password, as an easy-to-use courtesy to visiting guests?

The only ones that possibly would be able to leech off this would be the company on the floor below (or guests visiting them), which probably wouldn't happen since they have their own wireless network.

8

[ I'm first assuming you're isolating the guest network from your corporate network. Anything else would be irresponsible. ]

I see three common options for guest access: no password, captive portal, or guest password.

  • No password means no opportunity to give them chance to agree to your guest network policy. You risk legal trouble if a hidden neighbor runs something like a Tor exit node through your network, or a guest downloads 'questionable' materials, and you didn't warn them in advance that it's against your policy. The upfront costs are certainly cheap, though.

  • A captive portal is pretty simple, and people are already used to them at coffee shops and restaurants. It gives you the opportunity to present your visitors with your guest network policy rules, and they allow your visitor to conveniently ignore them before they click "Agree". They are quite popular, and obviously aren't too much trouble for most people. But you'll have to set up some kind of appliance, and that might cost a few dollars.

  • A simple guest password can be printed on a sign, or on a sheet of paper, and come with a copy of the policy. It would be the least convenient option, but it's simple, fairly cheap, and helps you avoid the legal risks of not warning them.

This is really a legal question more than it is a technical question. It's a decision of selecting a risk avoidance strategy. It's not a certainty that you would get in legal trouble for not posting your policy, nor is it certain that posting your policy would keep you out of legal trouble. I recommend you check with your attorney or legal department.

6
  • Captive portal are a pain in the ass for all that traffic that isn't browsing... E.g. what apps on your smartphone do, or your VPN client. To me a guest password is a lot more convenient. – Bruno Rohée Sep 27 '13 at 21:59
  • I'm not recommending captive portals as the perfect solution, I'm simply listing them as one common option for dealing with this issue. – John Deters Sep 28 '13 at 4:16
  • @BrunoRohée: what does guests usually have do to else than accessing HTTP(S) - services? – that guy from over there Sep 28 '13 at 7:11
  • 2
    @thatguyfromoverthere: POP, IMAP, SMTP, VoIP services (UDP), NTP, and IM services are common protocols that almost everybody has on their phone and can connect without the guest ever touching his device. A captive portal can break the guest's mobile internet connection and those services if the device were ever connected to the network and the guest didn't remove the wireless network from remembered wireless networks list. – Lie Ryan Sep 28 '13 at 12:30
  • 1
    A captive portal also silently breaks services accessed by an HTTP API, e.g. a twitter client... – Bruno Rohée Sep 28 '13 at 17:46
6

It depends on what you put on that network. If you just want to provide a free Internet access then you can probably get away with it. Janitors, delivery people, and night vigils will benefit from the service.

If the wireless network is for anything else related to work, then you have a big problem. Normal WiFi has a nominal range of about 100 meters outdoors, but it is just an average. As the Wikipedia page says:

Outdoor ranges can be improved to many kilometers through the use of high gain directional antennas at the router and remote device(s).

Meaning that someone who is less than one kilometer away from your access point (so this could be someone on the ground, outside of the skyscraper) may be able to talk to your access point, if he uses some specific hardware and does not mind going beyond local power regulations for radio emissions. If that's just for some Internet access, probabilities are low that someone would actually do it (except possibly as a way to cover his tracks), but if there is anything of value on your network, then this will happen.

4

Someone might be able to access your network from father away than you would expect using a cantenna of some sort. I doubt there are a huge number of people that would take advantage of this though, so it might not be a huge deal.

An easy alternative is to have a secure network, but post a sign wherever people will be logging in that has the password on it.

2

I would definitely recommend reading up on Max “Vision” Butler, a rather infamous hacker. One of his regular practices was to use WiFi networks via a parabolic antenna, easily giving him the range to hit networks from a great distance. Not that password-protecting it is guaranteeing security, but the assumption that distance gives you any sort of protection is faulty.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.