8

If we would want to give internet for free via WIFI, then what would be the better option and why from a security standpoint if we could only choose between:

  1. A non-encrypted wireless network setup
  2. An encrypted wireless network setup with known password (WPA2/AES/PSK, and the SSID is "The password is: free internet")

UPDATE: If we do not require the following:

You need to ensure that if users of your free WiFi service do something illegal, you can provide the authorities with information that allows identifying the offender. This is a legal requirement in some countries.

UPDATE#2: I am searching for an answer with offical references that why is the 2 choice better.

  • 1
    Always choose the encrypted route. It helps provide another layer of protection at no cost to you. – RoraΖ Oct 1 '14 at 16:32
  • But what additional layer of protection? Please explain further. Using encryption lowers the bandwidth. – thequestionthequestion Oct 1 '14 at 16:37
  • People still have to know the password. Some guy in a van with a jacked up wireless receiver wouldn't be able to just scan your wireless network. I understand that it's a known password, but it's still just another hurdle. I understand from a mathematical standpoint there is a decrease in bandwidth for encryption, but the reality is this is negligible. – RoraΖ Oct 1 '14 at 16:41
  • 1
    Can you please explain "wouldn't be able to just scan your wireless network"? what is the difference between an open and a wpa2/aes/psk encrypted network if we check it from "scanning" perspective? – thequestionthequestion Oct 1 '14 at 16:48
  • @thequestionthequestion, the only way that encryption "lowers the bandwidth" is if you enable WEP or TKIP on an 802.11n or newer AP. Since the 802.11n standard, AES is the only official encryption method, so if you enable WEP or TKIP the standard says that the HT data rates need to be disabled. Other than that, there should be no performance loss for using encryption unless there is a hardware or driver problem. – YLearn Oct 3 '14 at 2:48
10

A wireless network that is unprotected means that anyone can simply connect to your wireless access point, and collect all of your traffic. If users of the network aren't using HTTPS (SSL/TLS enabled) webpages then their passwords, usernames, and any other sensitive information would be unprotected.

Using WPA2-PSK, the wireless access point uses the common passphrase to generate unique encryption keys for each wireless client. Meaning that even if users aren't using HTTPS enabled webpages their traffic is still protected with WPA2.

How WPA2-PSK Authentication Works

Using a technology called TKIP (Temporal Key Integrity Protocol), that passphrase, along with the network SSID, is used to generate unique encryption keys for each wireless client. Those encryption keys are constantly changed.

TKIP is considered insecure and should not be used. Instead the WPA2-PSK with AES option should be used to provide unique keys for each wireless client.

Long story short, always choose the encrypted option.

NIST Guidance

Wireless networks and handheld devices are vulnerable to many of the same threats as conventional wired networks. Intruders who gain access to information systems via wireless communications can bypass firewall protection. Once they have accessed systems, intruders can launch denial of service attacks, steal identities, violate the privacy of legitimate users, insert viruses or malicious code, and disable operations. Sensitive information that is transmitted between two wireless devices can be intercepted and disclosed if not protected by strong encryption. Handheld devices, which are easily stolen, can reveal sensitive information.

Before establishing wireless networks and using handheld devices, organizations should use risk management processes to assess the risks involved, to take steps to reduce the risks to an acceptable level, and to maintain that acceptable level of risk. Using risk management processes, managers can protect systems and information in a cost-effective manner by balancing the operational and economic costs of needed protective measures with the gains in mission capability to be achieved through the application of new technology.

Secure Your Wireless Network

The convenience of having a wireless network in your home comes with added security risks. If it isn't secured properly you are vulnerable to someone using it to get to your information or to hijack your connection or computer for their own purposes.

You could be held liable if someone uses your internet connection, as any illegal activity will be linked back to your ISP account.

Having an unsecured wireless network can allow anyone within range-your neighbours or anyone on the street-to access your network or use your internet connection. They could use up your download allowance (possibly resulting in excess usage fees), intercept and read your files or email or, more seriously, use your account to access illegal content or undertake criminal activities.

Security Risks with Using Unsecured Wireless Networking

Whether you are using a wired router or a wireless one, if it is not configured properly, both of them could pose potential security risks. The common notion that wireless routers or networks are not secure or less secure is true, but only in circumstances where it is used right out of the box without correctly configuring its security settings. If your wireless network is ‘unsecured’ or ‘open’, an intruder can easily gain access to your internal network resources as well as to the Internet, all without your consent. Once the intruder has access to your network, he/she can use it for a variety of operations, such as:

  • To steal your Internet bandwidth.
  • To perform disruptive or illegal acts.
  • To steal your sensitive information.
  • To perform Denial-of-Service (DoS) attacks to make the network unusable by sending out false requests.
  • To infect the network with malicious threats.
  • 1
    Just adding to your answer Raz; The TKIP is crucial for security and privacy because it encrypts each client effectively eliminating MitM attacks. – Matthew Peters Oct 1 '14 at 17:12
  • 1
    TKIP is no longer considered secure and was deprecated in the 2012 revision of the 802.11 standard: en.wikipedia.org/wiki/Temporal_Key_Integrity_Protocol – thequestionthequestion Oct 1 '14 at 19:38
  • Note that an attacker doesn't need to connect to your AP to see the traffic if it's unencrypted -- they just need to put their wireless card into monitor mode. – Mark Oct 1 '14 at 21:11
  • @thequestionthequestion I have updated my answer to reflect current protocols. – RoraΖ Oct 2 '14 at 12:17
  • 1
    @thequestionthequestion, you're right, it's more of the concept than the actual encryption method. today AES is secure, tomorrow IDK but the concept of securing each client independently holds true (for now?). – Matthew Peters Oct 2 '14 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.