WiFi - Security Enabled vs Unsecured

[taoshum]

and is a good reason not to freeload on just any open connection.

I also "heard" that since it amounts to stealing bandwidth on FCC regulated frequencies, it's a federal crime, maybe even a felony but it is not enforced.  Our neighbor was doing this for a while until I became a little smarter and put WPA2 encryption on the wireless router.

 

[Pat]

I have our campground router password protected, so nobody can make changes to or operate it, but I have removed security that limits who can use our connection.  Too many people just couldn't log on for one reason or another.  We are far enough from any nonguest, that unauthorized usage is negligible.  Needless to say, we have no clue what our guests are doing with our connection, whether it's password protected or not.  Our cable company advertises that, as the subscriber, we are responsible for all illegal activities that transpire over it.  I imagine campgrounds everywhere just have to hope for the best.

--pat

 

[Ned]

Using an open WiFi connections isn't necessarily a crime, but it definitely is rude.  The frequency bands used for WiFi are not licensed, so the FCC is not much concerned about usage, as long as it complies with the regulations regarding interference with licensed operations.  The 2.4GHz band is shared with, among other things, microwave ovens, some cordless phones, and other wireless devices.

 

[seilerbird]

I would first make sure of the unsecured wifi you are connecting to. You don't want to connect to someone's honey pot.  Which is essentially a fake access point to harvest data through.

I have set up ad hoc networks in campground just to see if people will jump on board and they sure do.

I set up my network to boost RV park wifi in low signal area. Since my signal is the strongest they jump on with no question. I even rename it to other things and people just jump on without permission. I could easily harvest data, redirect them to pages I want or make them pay for the connection while using the RV park's free wifi...

So many things to do to clueless users.

You could easily harvest data? How are you getting past their firewall?

 

[Ned]

The firewall is irrelevant as you would be sniffing the traffic on the network outside of the firewall.  You don't steal files, you steal passwords and credit card numbers.

 

[Giles]

Ned,
Hi !
We always use RV parks connections; however, private WIFI connections frequently look so much better.
Any way to use a private WIFI connection and not be rude ?
And at what risk ?

 

[Ned]

If you see an open WiFi connection, and it's the only option available, try to find the owner and ask if 1) they know it's open, and 2) if so, can you share it.  There is always a risk.

 

[Jammer]

As long as you're using WPA or, better yet, WPA2, encryption on your wireless links, you're secure from any freeloaders or eavesdroppers.  The https links are secure regardless of how you connect to the internet.  It is a separate issue from WiFi encryption.

Well, any freeloaders or eavesdroppers who don't have Aircrack, at least.

The WiFi encryption in widespread use is worthless against sophisticated eavesdroppers.  There are more of them than you might think.

The thing to be careful of is not so much the banks and credit cards, which as others have pointed out are secured end-to-end using SSL (which is almost, but not quite, bulletproof) -- but rather things like email and Facebook and other places where you might type a password.  The other risk is that, with WiFi, sophisticated eavesdroppers can see what sites you're visiting, which depending on which sites you visit, might matter to you.

There are (paid) VPN and proxy services out there that are actually quite secure, that you might want to consider if you use public WiFi services and are concerned about privacy and security.

 

[taoshum]

I bet that between Google, Microsoft, Yahoo, the telecos and the NSA there is absolutely no privacy.... none, zero, nada, zilch, nothing is left beyond the prying eyes of these folks if they choose to look.  I've also heard that the *.dat files that Microsoft Windows puts on your hard drive also store some of this information.  It is certainly very difficult to get rid of them and messing with them can cause big problems, I understand.

I guess you can choose to not use the internet, or a cell phone and do all of your transactions in cash... but even that approach is limited anymore.  Try to buy a vehicle without having your records show up on 50 computers.

The most disturbing aspect of this is that even with all this "power" they still cannot find the 10 most wanted people very often.  And  the suicide bombers, forget it.  IMHO, we would be way ahead if we trained about 100 million US citizens to be the front line defense against these threats, instead of spending trillions on spy satellites and electronic snoopers that don't seem to be that effective, really. 

Sorry about the "soap box"... it's only my opinions so if you disagree, please delete. (you too Google).

 

[taoshum]

Just in case anyone is curious: http://en.wikipedia.org/wiki/Aircrack-ng

 

[Mr Bojangles]

Hello All:
Not trying to be disrespectful here..., but, if one (fellow RV'er) connects to a another RV'ers WIFI (router) what does it cost or how does it "effect" the router operator/owner?

I know we primarily are talking about the security part of CONNECTING PERSON, but, if I can not find the owner, and not concerned with risk, I do not feel I'm stealing anything (I'm asking now, am I costing owner of router something).
Please (someone) let me know..., and I hope this was not addressed in this posting earlier.

 

[Jammer]

I bet that between Google, Microsoft, Yahoo, the telecos and the NSA there is absolutely no privacy.... none, zero, nada, zilch, nothing is left beyond the prying eyes of these folks if they choose to look.

There are tools, techniques, and encryption available for free to the common person that provide security that even the NSA cannot penetrate.  The techniques are well known and understood in the computer security community.  To use them requires a degree of understanding and self-discipline that is beyond the reach of most users.

There is extensive discussion of this and related issues at places like http://yro.slashdot.org for those who are interested.

 

[Ernie n Tara]

Yes! There is a potential cost to the owner of a wifi site that you use. Usually, he will be using an air card or satellite to do the actual communication. He will usually be limited to 5 gig per month and subject to very high costs (0.25/meg?) if he goes over. Simple emails and similar do not pose much of a risk (I seem to use a few hundred meg. per month that way and I'm a fairly heavy user), but downloading movies or similar will rapidly use up the 5 G.
Ernie

 

[Mastermtn]

Yes! There is a potential cost to the owner of a wifi site that you use. Usually, he will be using an air card or satellite to do the actual communication. He will usually be limited to 5 gig per month and subject to very high costs (0.25/meg?) if he goes over. Simple emails and similar do not pose much of a risk (I seem to use a few hundred meg. per month that way and I'm a fairly heavy user), but downloading movies or similar will rapidly use up the 5 G.
Ernie

We use an ATT "aircard" - 5GB per month @$60 month and have netflix so we do not down load movies...
We use about 3 GB a month and there is NO ROLLOVER....which sucks bigtime..point being: If you have]ATT
please call your customer service (611 is free) and ask them to pass on we want rollover on aircards just
like cell phones....or better yet pen a letter....

TIA,

Rich
PS-

Two comments:

1- to receive AND break into the encryption and spit out byte ordered data
on wifi or cell phones requires a pretty high cost of gear...but like anything else..
today for example...a gee-whiz cracker posted how to crack GSM data on the cheap
so what will happen is anybody's guess....

2- I would not do banking whatsoever on public wi-fi...I am barely secure (NPI)  with
ATT aircard service which uses older 128 bit technology....

Rich

of gear and expertise....

 

[taoshum]

There are tools, techniques, and encryption available for free to the common person that provide security that even the NSA cannot penetrate.  The techniques are well known and understood in the computer security community.  To use them requires a degree of understanding and self-discipline that is beyond the reach of most users.

There is extensive discussion of this and related issues at places like http://yro.slashdot.org for those who are interested.

You seem to understand this stuff pretty well. On a scale of 1 to 10 where 1 is easy setup and trivial impact to the user and 10 a very difficult setup and impact to the user, where does this higher level of security rate?  You say it is "free" but what is the nature of the discipline and impact?  Thanks!

 

[Ned]

Use WPA2 with a strong pass phrase (at least 16 characters, mixed letters, numbers and special characters) and you're as safe as possible with today's technology.  As of today, the only possibly successful attacks on WPA2 are dictionary attacks and a strong pass phrase will protect against those.

 

[Bighorn]

Using somebody's open wifi signal is illegal, but rarely enforced or even discovered.

It is covered by most states by theft of services, computer trespass and various other laws.

Of course people will say they are being trespassed on by the signal entering their home/rv/space etc.  This argument really holds no water.

It is not illegal to "listen" to radio broadcasts. The problem lies is when you enter that persons router and issue instructions to that router. That's where a computer trespass charge comes into play.  When you use someone's internet connection that they pay for without their permission is where the theft of services comes into play.  Just because technology has removed the wires its the same as running a wire over to your neighbors houses and using their electric or cable tv.

Nearly all ISPs have a term of service that restricts customers from having open wifi, just because you leave the door open is not an invitation for use or implied consent for use. Many people use the implied consent argument to justify stealing the service..

Because people have little knowledge on wifi and how it works they just jump onto any open wifi network, this led to people setting up honey pots.  Many passwords are sent in the open. Sadly some banks send the initial user and password in the open before you get a secure connection.

Let's look at what might happen. You go online at a RV park you're staying at.  You hook up to my router and I monitor traffic. I notice that you are going to Wachovia.com, but I don't see your password and user name.  I then recreate an exact page (takes about 1/2 hour) that looks like wachovia and I forward you to that page next time your mac address requests Wachovia. com. You enter your user name and password on my page, I then have that logged and then redirect you to the real wachovia page, you think it's an error and redo it or I get real fancy and have my page enter your username and password, you then enter as normal.

Chances of this happening? Prettly slim, but growing.

Back in the day I used to work for a major electronics retailer. This was back in the day when you had limits on your AOL usage.  One of the computer geeks one evening  recreates a duplicate of the AOL sign in page and puts in on one of the stores computers. People would flock to that computer to get some free AOL time. Enter the user name and password hit enter and it would go to an error page. This guy had thousands of user names and passwords and he never paid for internet.  Just because it's free, doesn't mean it's safe.

For an easy explanation.
http://www.dba-oracle.com/t_unauthorized_access_computer_network_crime.htm

Some laws by state.
http://www.ncsl.org/IssuesResearch/TelecommunicationsInformationTechnology/ComputerHackingandUnauthorizedAccessLaws/tabid/13494/Default.aspx

 

[SCVJeff]

That was highly publicized and shook the industry until it was later released that there were certain conditions set as well as some little software hack installed on the broken PC to sway this test. I run 63 totally random character WPA2 encryption both at home as well as the router in the coach. It's a flat statement that it won't be broken.

 

[Jammer]

You seem to understand this stuff pretty well. On a scale of 1 to 10 where 1 is easy setup and trivial impact to the user and 10 a very difficult setup and impact to the user, where does this higher level of security rate?  You say it is "free" but what is the nature of the discipline and impact?  Thanks!

All depends what you want to secure.  Then there are tradeoffs.

- Run Linux instead of Windows -- history of fewer exploits and, most would say, an inherently safer security model
- Run Firefox instead of IE -- history of fewer exploits and fewer exploitable bugs
- Use Truecrypt for your hard disk -- used properly keeps anything on your hard disk secure if your computer is stolen.  There are other similar products.
- GPG -- secures email, highly effective if used by both sender and receiver.  Thunderbird and some other email clients help with this.
- Various secure proxy services - allow you to browse the web, useful if you're concerned about the security of your password on non-secure sites like the rvforum, or if you're concerned about people knowing what web sites you visit and what searches you perform

 

[Mr Bojangles]

Thanks Everyone:

I understand and will not just connect to a "router" with no security. (Individual may have limiting rules with "service providing internet connection". (I was too afraid and hardly did "deed" anyway)

Lots of good info here... keep it coming.