Securing wifi with encryption

Question

So I have been hearing that using WPS Pin is not secure at all and that there are available downloads that can brute force attack the pin until it uncovers it depending on what encryption you use. I have done a little digging but I cant conclusively discover what is the most secure encryption to use. I was wondering if people could point out what would be the safest among the available options my router supports they are as following:

• WEP (Wired Equivalent Privacy)
• WPA-PSK (Wi-Fi Protected Access Pre-Shared Key)
• WPA2-PSK (Wi-Fi Protected Access 2 with Pre-Shared Key)
• Mixed WPA-PSK+WPA2-PSK
• WPA-802.1x

I have set it to the WPA2-PSK (Third option) with a very long complex key. However I have read and maybe I have misunderstood but it seems that the length and complexity did not matter when it was brute force cracking the WPS and that ultimately it would uncover the pin. I have turned off the WPS pin feature in my router but I am still a bit fazed by what method of encryption is the best to use. Ideally I would like to turn the WiFi off but in this building its almost infeasible.

Thanks in advance for any help!

Answer 1

WPS is a quick-config system that allows you to connect to a router without doing any configuration on the client side. It works by exchanging a pin code that acts as a temporary key, in order to transmit configuration details to the client. Unfortunately, the key is short, and easily brute-forced. The solution is to turn off WPS on your router, which you have done.

As for which method of encryption to use, WPA2-PSK is fine. So far the only attacks against it revolve around brute-forcing weak passwords, so if you're using a strong password then you should be alright.

The older WPA (WPA1, if you will) has problems that could allow an attacker to break into your WiFi by sending special probes, leading to information disclosure that can be leveraged via a cryptanalytic attack. WEP suffers from similar issues, but is much worse - in general WEP is considered to be about the same as no password at all, in the face of an attacker that knows how to perform basic wireless attacks.

Mixed mode means that both WPA and WPA2 are available, and the client can choose which to use. I'm not sure of the specifics, but I'd guarantee that this is less secure than just running WPA. I think in order to attack it there must be at least one authenticated client attached via WPA, but don't quote me on that one. The reason this mode exists is to provide compatibility with older devices. For example, a stock firmware Sony PSP doesn't support WPA2.

WPA-802.1x is another name for WPA-Enterprise, which involves running a RADIUS server inside your network to federate login requests. This uses Extensible Authentication Protocol (EAP) for the authentication. The primary benefits of RADIUS-based wireless security are that you can choose different credential types for authentication (i.e. you don't just have one shared key), and that you can prevent brute-forcing of logins. This is a more complex setup, though, and isn't well-suited to home use.

The last thing to consider is the encryption scheme. The two standards are Temporal Key Integrity Protocol (TKIP) and Counter Cipher Mode Protocol (CCMP). The first is based on RC4, and is used by WPA. The second is based on AES, and is much stronger than TKIP, and is the default for WPA2.