I'm looking at ways an outsider (i.e. someone without a possible password) of the network could sniff the communication within the network, specifically focusing on WLAN.
This is what I understand about wireless network security:
- When we connect to an open wireless access point (so, with WEP) it is possible to sniff the communication (but we can't decrypt SSL-encrypted connections).
- To make it impossible for outsiders to sniff network, we could use WPA(2) or the like, but in any case this will require to password-protect the network.
This is what I understand about SSL:
- When we use for example HTTPS (so HTTP with SSL), it isn't possible for attackers to see the data that is being communicated over the connection (unless a malicious certificate has been trusted).
- When we connect to a server using HTTPS, we do not need to enter a passphrase.
Say I'd like to create an open Wi-Fi hotspot that encrypts the data in such a way that no one can sniff the communication of other users of the hotspot. This is, as far as I know, not possible (is that correct?). But then, why isn't it possible to encrypt the communication with the wireless access point using a technique like SSL? SSL doesn't require a passphrase, but guarantees nobody can sniff the line. Is there something essential about SSL that makes it impossible to use it for such an application?