undefined | Better HN

0 pointsPeterisP12y ago0 comments

Why is google having my Wifi password a bad thing? I'd be happy to let EVERYONE have it, and the only thing I fear is neighbour teenagers overloading the connection with torrents so that it's not usable for me.

As long as I expect them not to overload my wifi too much, I'm perfectly happy with google or FBI or KGB or friends or random strangers to use have that wifi password.

If wifi routers were good at traffic shaping / quality of service tech, I'd put no passwords at all on wifi devices - if a neighbour wants to browse some web, then it's a good deed to make it easier.

0 comments

5 comments · 2 top-level

drdaeman12y ago· 3 in thread

I'm unsure, but doesn't WPA2 password knowledge allows to decrypt your traffic? (Possibly with an active attack to re-initiate handshake?)

I.e. someone who knows your password could drive by your home, listen to the air and see what you're doing online.

lightcatcher12y ago

This isn't the case. The WPA2 handshake involves the computation of a session key for each client, so clients on the network can't read the plaintext of each other's traffic. The session key is established with a nonce generated by the access point as well as the MAC addresses of the access point and client.

drdaeman12y ago

Thanks for clarifications.

What I had in mind was the following case: if you disrupt someone's connectivity (jam the channel for some time) and force them to reconnect, having listened to nonces and knowing pre-shared secret, you can calculate PMK (and GTK), or I'm wrong?

(I haven't re-checked the specs, but believe 802.11 headers are unencrypted - only payload is - so MACs are not secret.)

PeterisPOP12y ago

My internet traffic anyways is wide open and can be probably be tapped by giving a beer to a teenage techie in my local ISP ; or going to a router in our attic (last time i was there, it was behind a tiny padlock) where the wires split out to apartments.

If I use https/ssh, then my traffic is safe even if wifi is open; if I don't, then my traffic is unsafe even if WPA2 is used.

DanBC12y ago

> Why is google having my Wifi password a bad thing?

I don't think it is a bad thing. It's about as bad as them having "All the IP addresses" - (http://blort.org/~kgasso/images/how-to-catch-script-kiddies....) (http://imgur.com/04sMAxd)

j / k navigate · click thread line to collapse