8

In response to a statement elsewhere that MAC address filtering was essentially useless for protecting a wifi network because it was trivially by passable by network attack tools, I was asked if the combination of requiring a mac address and computer name (eg "Dan-Laptop") would work.

Having never seen this recommended elsewhere I suspect the answer is no; but I'm not familiar enough with wifi protocols to know one way or the other.

  • 1
    Such a measure provides no added security against an attacker who wants to get on your network. However, it does provide some security against the risks associated with non-"attacker" unauthorized users connecting, such as the risks from malware-infected devices. – R.. Jul 7 '15 at 19:47
23

Short version

No. All you need is WPA2-AES with a custom SSID and a strong passphrase. All this assumes a "home" scenario where the AP and clients are using a PSK (preshared key). In Enterprise settings there are a couple of other attack vectors but one nice thing about a PSK is it greatly simplifies the attack surface. It pretty much comes down to the attacker can guess they key or they can't.

Slightly longer version

First of all I have never seen computer name filtering that actually filters based on computer name. I am pretty sure what you are seeing is just a more consumer friendly way to enable MAC filtering. When you allow "Dan-Laptop" in the config, the AP is adding the MAC address for "Dan-Laptop" to the ACL.

Even if your router implemented hostname filtering which worked independent of the MAC addresses, it wouldn't change the answer. The only thing more trivial to spoof than a MAC address would be a hostname. The ability to rename a computer name is part of the underlying operating system.

A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.

The MAC addresses and hostname of clients are public knowledge. The ip address assignments (static, or restricted dhcp) of systems on the LAN are public knowledge. The SSID, channel usage, frequency and even the presence of the AP radio are public knowledge. Yes so called "hidden" SSID serves no security purpose either, then again it was never intended as a security feature. Assume the attacker already knows all of that information. There is one thing which is not public knowledge and that is the PSK (passphrase) so your entire security boils down to a strong cryptosystem (WPA2) and an unguessable passphrase.

I think the desire for something more is related to hearing about how security is hard and defenses should be layered. They certainly should in in complex scenarios with multiple variables as it is often difficult to model all the potential risks. In this case however authentication is straightforward and the risk model is simple. WPA2-AES is currently "unbroken". That means the entire security of your AP boils down to can the attacker guess the passphrase. If they can you lose. It really is that simple and it is the way strong cryptography should work. The system is secure even though the attacker knows everything about the system except the secret (key).

  • 1
    Why is "custom SSID" important? – Yakk Jul 7 '15 at 21:21
  • 4
    @Yakk In WPA (and WPA2) the passphrase is converted to the PSK using PBKDF2(HMAC−SHA1, passphrase, ssid, 4096, 256). Salt is used in KDFs to prevent precomputation attacks. The problem is for some reason the salt used in WPA is the ssid. This is compounded by the fact that for year and year many manufacturers shipped routers with static SSIDs which most consumers never changed. This became the low hanging fruit for precomputation attacks and rainbow tables were built of common SSIDs. Here is an example: renderlab.net/projects/WPA-tables – Gerald Davis Jul 7 '15 at 22:18
  • Ah, I remember hearing about that once: You should edit that into the answer. (In practice, it means you should stuff some random characters at the end of your SSID, no? If your SSID is a short English word, it won't make the rainbow table that much larger? Well, on a logarithmic scale.) – Yakk Jul 8 '15 at 14:00
  • @Yakk It really only makes sense for hacker to precompute VERY common SSIDs like "default", "linksys", "home", "homegroup", etc. These are currently used by thousands if not millions of routers so it is worth it to precompute them but most SSIDs are not so the bar is really low. As an example, verizon sets all fios routers to just be 5 random upper case letters (i.e. GDHIX) which is still short but good enough to avoid precomputation. Still all this could be avoided if WPA2 used a random salt. – Gerald Davis Jul 8 '15 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.