[86879] in North American Network Operators' Group
Re: Wifi Security
daemon@ATHENA.MIT.EDU (Patrick W. Gilmore)
Mon Nov 21 09:47:50 2005
In-Reply-To: <39420CFB89A9E0449F4314DE8D1CFF4713035B@exchange.corp.hometel.com>
Cc: "Patrick W. Gilmore" <patrick@ianai.net>
From: "Patrick W. Gilmore" <patrick@ianai.net>
Date: Mon, 21 Nov 2005 09:47:21 -0500
To: nanog@nanog.org
Errors-To: owner-nanog@merit.edu
On Nov 21, 2005, at 9:42 AM, Ross Hosman wrote:
> So my question is pretty simple. You have all these major companies
> such
> as google/earthlink/sprint/etc. building wifi networks. Lets say I
> want
> to collect peoples information so I setup an AP with the same ssid as
> google's ap so people connect to it and I log all of their traffic.
> Most
> people won't check beyond the ssid to look at the mac address but even
> that could be spoofed. Is there anyway to verify a certain ap beyond
> mac/ssid, will there be in the future? How do these companies plan to
> mitigate this threat or are they just going to hope consumers are
> smart
> enough to figure it out?
Why would you even need to set up an AP? Why not just sit and sniff
traffic? Gets you the _exact_ same information.
And why worry about Google, etc., when Starbucks and airports have
been doing this for _years_?
Lastly, most consumers are smart enough to know to use encryption
(the little pad-lock in their browser). Some aren't. Changing the
WiFi architecture is not going to save those who aren't.
--
TTFN,
patrick
