Hot answers tagged

80

"Hiding" your SSID is just "security by obscurity" - like hiding the front door key under the mat. It works only as long as no one figures it out. Once it is figured out, it provides zero security. In general, you want security measures that will work even if everyone knows what measure you've used. Yes, by providing your name, any opportunist can focus ...


27

The risk is not really for your own system but for the corporate network. I assume that the private network is only connected to internet through a secured firewall, and that through the VPN you get access to that private network. If you manage to have your machine connected at the same time to a public network and to the VPN, it will constitute a new ...


19

It doesn't help for reasons described in other answers. And there is actually a way for an attacker to use strange SSIDs against you. If your access point authenticates itself with a certificate and its SSID is "Company", then no attacker can claim to be "Company". They would need to choose another SSID, so there would obviously be two networks and this ...


10

Depending on your routing table (corporate laptops may have defined route table entries), settings in your network adapters, having or not having a perimeter firewall which filters traffic for VPN users, IPS or IDS, when you connect to any two networks (cable + wifi, cable + hotspot ad hoc) (cable + cable) (bridged) (if network is setup as shared) the hosts ...


9

From a security perspective, is it considered bad practice to use the company name as a part of an SSID? No. Would I be overthinking this if I required wireless network SSID's to be random strings? Yes. While doing this may prevent the simply curious, this will in no means deter an interested or determined attacker. Effective security should always put ...


6

One thing to bear in mind is that some devices broadcast which SSIDs they have previously connected to when they're out and about. This may make it trivial to identify employees/visitors to your company away from the site itself. It will depend on your threat model as to whether this is a concern, though.


6

I would not broadcast an obvious SSID name. While I do not believe in security by obscurity, I don't see a strong incentive in advertising your identity over the airwaves. And the SSID doesn't have to be random characters, it can be somewhat memorable but unrelated to the actual company name. I'd rather brief the people who work in your office and grant ...


5

Generally speaking, a vulnerable device/network doesn't become less vulnerable if it is turned off some of the time. Or if you have infected devices on the network, this won't make them any less infected. However, it may reduce the probability of your router or any exposed service from becoming infected any given day. I guess you could also argue that an ...


3

The corporate network is almost certainly segmented into multiple zones or security areas. Between them are firewalls and/or other security systems to control access to those areas. If you connect a machine that is not a properly configured security device to two networks at the same time, you are creating an uncontrolled bridge between these two networks. ...


3

No, he cannot have recorded your traffic then decrypt it later. That takes an incredible amount of power and time. As for "downgrade attacks", those require an active connection. You manipulate the negotiation of the security between the server and the client and force a weaker level of security. That's obviously not possible when there is no connection or ...


2

Since you are talking about SSID, I assume you connect over a WiFi Network to your cable modem. WiFi is open in the sense that anyone can listen to the packets anyone exchanges with the WiFi access point, even when the connection is encrypted. It only requires a WiFi network card/USB Stick etc. working in promiscuous mode, and you can see all packets in ...


2

Is this setup truly insecure as mentioned by other IT companies and what are best practices for securing such a setup? The quality of both open source and commercial solutions differ widely. There are commercial firewalls which more or less do what pfSense does and there are firewalls which do a lot more. From what you mention as security features of your ...


2

@multithr3at3d gives a good answer about what you are directly asking for. However, you may not have considered whether your "personal security" is diminished as a result of this policy: If some individual or government knows your IP address, by turning off your modem on a holiday, this tells a third-party that you're away from the house.


2

... is it [a] bad practice to use the company name as a part of an SSID? As @schroeder mentions above, probably not. However, it feels like you are setting a bad example, right? Just pick something and consistently use that - everyone will still know what to pick off the list, and you don't look "unsecure" to people who aren't informed. Anecdote: A ...


1

Keep in mind that TOR provides anonymity, but not necessarily security. For example, say that the government where you live has banned parsnips for being too vulgar, and anyone caught even looking at them online is thrown into jail. But you still like reading about parsnips, but you don't want the government to know that you're a deviant for fear of being ...


1

Most corporate VPN clients (by means of firewall and routing rules) intentionally insulate your computer from all other networks you may be connected to, when connecting to the corporate VPN. This is done in order to prevent your computer from being used as an intermediate for connecting to your corporate network from outside. When you connect to more than ...


1

Not broadcasting any SSID, combined with MAC filtering, might be the only approach which adds to security - because this requires an additional factor for the authentication and it would only permit known devices. The down-side is, that it also adds administrative effort for adding/removing MAC addresses and supporting users with setting up eventual BYOD.


1

Brute-forcing a Wi-Fi password, and by extension wireless cracking in general, is a large subject matter in and of itself. Generally speaking, yes, it is certainly possible to brute-force a Wi-Fi password, but there are many things to factor into the equation. Namely, the type of encryption that is used on the wireless network will play a large part in the ...


1

My opinion is that it is highly unlikely that your device was compromised by your friend in the way you describe. A much more likely way to exploit this situation would be to monitor your web traffic while connected. Doing this might allow him to see what types of websites you are going to while you are connected to his wifi, but usually won't allow him to ...


1

Wifi and cellular data networks use different hardware. One set won't help positively identify the other. Some data, like MAC, will expose the hardware type (like iPhone, Samsung, etc.) but that's about it. What will identify you are your actions, not your hardware.


Only top voted, non community-wiki answers of a minimum length are eligible