7

I'm currently using WPA2-PSK with CCMP on my home WiFi network for encryption and security.

I was a big fan of MAC filtering, until I realized that MAC addresses are publicly sniffable in the 802.11 packets.

Is WPA2-PSK with CCMP "good enough" for WiFi security in light of programs like oclHashcat, which can bruteforce passwords like there's no tomorrow? As the entropy on my WiFi password increases, do I get actual security benefits, or is unauthorized access inevitable?

  • Brute force works. This is inevitable. That being said, I'm pretty sure that a 15-20 character password would take longer than the age of the universe to crack or something, so you're probably pretty safe... – KnightOfNi Jan 28 '14 at 23:34
8

The short answer is probably.

The actual answer depends entirely on what "good enough" means to you.

Do you need to disallow WiFi altogether? Perhaps you really need Ethernet cables run in pressure-monitored shielded conduit run under an access-controlled, video-monitored raised floor with locks on the exposed ports? Okay, that is overkill for almost everyone, but just almost.

Like almost all security questions, you need a risk analysis. Maybe not a formal one, but at least go through the risks and costs in your head.

  • What is the impact of unauthorized access?
  • What are you trying to protect?
  • What is the impact of disclosure?

In your case, take a look at some oclHashcat performance benchmarks. How long is your WPA2 password? How big is the search space for a password that long, with those "types" of characters (digits, alphas, symbols, etc.)? GRC has a convenient calculator.

On average, an attacker will have to search half the search space to find your password. Given how fast they can search (which depends on what amount of resources the attackers are will to put forth), how long will it take to find your password?

Can you live with that? Can you simply change your password more often than that? Are you willing to take that risk?

To answer your specific questions:

  • yes, as the entropy on the WiFi password increases, you get security benefits in the form of an increased password search space, and
  • yes, unauthorized access is inevitable given enough time

My work site has a WiFi password that has a search space of 4.23 x 10^33. oclHashcat can guess 350k or so passwords a second on the system used in the benchmark. Assuming the attacker has 1,000,000 of those boxes at their disposal, or at least 1,000,000 times the compute power, they can try 3.5 x 10^11 passwords a second. It would take them on average 2 x 10^14 years to find the password. Good enough for me. Even if they are a million times luckier than average, I'll have changed the password before they find it.

Of course, they could guess right on their first try. Or in their first few minutes of guessing. Or they might have some knowledge of the password that they can reduce the search space (e.g., they know how long the password is, which characters can be used, what the first 5 characters are, etc.). Maybe the WiFi password is written on a white board that can be seen through a window from the street, making this whole discussion moot.

Again, it all comes back to what the acceptable risk is to you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.