If you still think wireless security is useless because you have nothing to hide ...
- Thread starter electron
- Start date
:hesaid:
If anyone has anything further to ask, feel free to PM me as this thread is done.
apostolakisl
Senior Member
when I make my passwords I do it monkey style.:nutz: I just start pounding randomly on the keyboard.
This I bet is true however.
The guy who got his door busted in by the FBI probably was
1) broadcasting his ssid
2) had no security turned on at all.
It is my speculation that if he had done either of those two things, he would not have had his pervert neighbor jump on his router. I think this was a crime of opportunity and the smallest measure closes the opportunity door.
This I bet is true however.
The guy who got his door busted in by the FBI probably was
1) broadcasting his ssid
2) had no security turned on at all.
It is my speculation that if he had done either of those two things, he would not have had his pervert neighbor jump on his router. I think this was a crime of opportunity and the smallest measure closes the opportunity door.
I understand that she is secure from my wired network to her corp LAN. But I'm still curious as to how to better secure my wireless LAN in general using some of the more advanced techniques mentioned in the thread, e.g., VLANs, in a pure Windows environment. I'm not opposed to buying better hardware if it offers something extra for the money. For example, I use Netgear's "business class" SSL VPN router so that I can VPN into my home LAN.
tmbrown97
Senior Member
Is your goal to isolate her from the rest of the home traffic - in case, say, someone from her work infects her computer in some way? Or to keep someone from tunneling from her computer back through the rest of your network while she's on the VPN, or what?
Depending on how large a company she works for - there's a good chance that the VPN client she uses actually blocks all her access to the home network while she's VPN'd in; she wouldn't be able to print to a local network printer, etc. Others do allow network mixing - that generally is a topic in itself for the kinds of things that could allow.
If you want to isolate her from your network, your best bet is going to be doing something via separate VLAN's and likely separate SSID's. You'd need a router capable of getting a single IP address and doing multiple VLAN's and routing between them based on rules. I can do all this via my Cisco router but I'm not sure about things like DD-WRT or other more available routers. Cisco isn't a beast worth tackling without a good reason and these routers cost several hundred $$.
Of course sometimes you can get away with a double-nat type scenario using two routers - but that's really bad practice... or if you can get two IP's from your ISP, you can do things like - use a switch at the head end, with two routers behind it - one on each IP, etc.. but there's a lot of variables and it's probably more trouble than it's worth.
If you're adamant about it, find a router that can support multiple VLAN's and multiple SSID's and route between them via ACL's as needed. You're generally talking about higher end equipment at that point.
Minor quibble - there's no way that something like #Random@Passphrase!Text$Goes%Here^To&Prevent*Malicious~Activity is in someone's speedcrack rainbow table. P@ssw0rd, pa$$word, and the like for sure... but if you do something dumb and lazy like that then you're sort of asking for it in the first place.
Point of the story: be bizarre and unpredictable in your security phrases.
drozwood90
Senior Member
It's not fooling a table. It's increasing the size that is needed.
drozwood90
Senior Member
drozwood90
Senior Member
Thank you for understanding what I was trying to get across.
drozwood90
Senior Member
I do agree about the beating dead horse.
I guess I couldn't get across that I was not advocating anything I said as "secure" or "perfect". Just adding those things adds an extra step to things. I was trying to get across, in my area it is harder to get on my network. If someone TARGETS my system, they can get in. BUT why go through extra effort when there are 20+ networks in my area, 2-3 of which are OPEN. So...yeah...
As was pointed out, if someone WANTS in the house, you can bolt / lock / etc. your doors. Breaking a window is a LOT easier. So...there's a "window of opportunity" (haha, couldn't help myself).
--Dan
I guess I couldn't get across that I was not advocating anything I said as "secure" or "perfect". Just adding those things adds an extra step to things. I was trying to get across, in my area it is harder to get on my network. If someone TARGETS my system, they can get in. BUT why go through extra effort when there are 20+ networks in my area, 2-3 of which are OPEN. So...yeah...
As was pointed out, if someone WANTS in the house, you can bolt / lock / etc. your doors. Breaking a window is a LOT easier. So...there's a "window of opportunity" (haha, couldn't help myself).
--Dan
What everyone is trying to tell to is that if you have wpa you are just as safe as with or without ssid broadcast. If I wanted to crack your network I would use something like airsnort and this tool will see every network in the area regardless of ssid broadcast without any extra work on my part. So how in this setup would your network look less appealing to me than your neighbor who has wpa but is broadcasting his ssid? Heck unless I look closely at the packets I would not even notice you were not broadcasting the ssid.
drozwood90
Senior Member
True, that's IF I am home and on the network. If no one is on my router (I am the only one that uses it), it doesn't do anything, right? I am no expert...so, correct me if I am wrong...
If I am not on the router the 1-2 hours a week I use it, by having it not transmit anything, it wouldn't show up in Airsnort, right? That is why I say it's better for me. SURE, if there is traffic out there, and you are picking it up, the packets surely have the routing information. They have to.
--Dan
If I am not on the router the 1-2 hours a week I use it, by having it not transmit anything, it wouldn't show up in Airsnort, right? That is why I say it's better for me. SURE, if there is traffic out there, and you are picking it up, the packets surely have the routing information. They have to.
--Dan
Nope every client needs to send a handshake every so often to keep the connection alive regardless of traffic. As long as one client is associated to the router it is viewable. Some of us are experts on this subject and can tell you it adds no security at all not even a layer. Since you are using WPA you are well protected against most attacks, the attacks you are not protected from would not even notice SSID broadcast. Companies really should never had made that as an option to their routers since it clearly breaks the wifi spec but they wanted to have that feature checkbox. I recommend you reenable since it could cause you issues with some clients.
EDIT: Assuming you are using a "good" passphrase for your WPA key.
drozwood90
Senior Member
"Nope every client needs to send a handshake every so often "
Right, but I am not sure I am understanding, or you are not understanding my question. I have ONE laptop that connects to ONE wireless router, a few hours a week. If that laptop is turned off, then the router won't be doing anything, and there will be no clients, so no traffic to pick up on, right?
Just trying to be clear, as I do not want to have misunderstandings about security.
--Dan
Right, but I am not sure I am understanding, or you are not understanding my question. I have ONE laptop that connects to ONE wireless router, a few hours a week. If that laptop is turned off, then the router won't be doing anything, and there will be no clients, so no traffic to pick up on, right?
Just trying to be clear, as I do not want to have misunderstandings about security.
--Dan
