Steal This Wi-Fi

[michaewlewis]

Whenever I talk or write about my own security setup, the one thing that surprises people -- and attracts the most criticism -- is the fact that I run an open wireless network at home. There's no password. There's no encryption. Anyone with wireless capability who can see my network can use it to access the internet.

To me, it's basic politeness. Providing internet access to guests is kind of like providing heat and electricity, or a hot cup of tea. But to some observers, it's both wrong and dangerous.

Continued.....
http://www.wired.com/politics/security/commentary/securitymatters/2008/01/securitymatters_0110

My thoughts exactly..

[patio]

I'd rather give a war-driver bum the same thing i do on the street...a few bucks.
If he get's a bottle of Ripple for it instead of paying for wireless well than that's his problem.

 

The Author deserves whatever security is compromised on his machine....he must be out of material to write such an irresponsible diatribe....

[Deerpark]

Having an open network is alright if you're fully aware of the consequences of doing so like Bruce Schneier is. Unfortunately I don't think most people with an unsecured wifi connection is aware of it and therefore haven't taken steps to secure their browsing in other ways. So if you take advantage of other peoples open wifi; you won't know if they're actually offering it to you, or they simply isn't aware of its openness. If you're going to offer your wifi to strangers I'd much rather you do it porperly and use a service like FON.

And I have to say I think he takes a bit of a head in the sand approach to the risks. Like his example with RIAA.

In a less far-fetched scenario, the Recording Industry Association of America is known to sue copyright infringers based on nothing more than an IP address. The accused's chance of winning is higher than in a criminal case, because in civil litigation the burden of proof is lower. And again, lawyers argue that even if you win it's not worth the risk or expense, and that you should settle and pay a few thousand dollars.

I remain unconvinced of this threat, though. The RIAA has conducted about 26,000 lawsuits, and there are more than 15 million music downloaders. Mark Mulligan of Jupiter Research said it best: "If you're a file sharer, you know that the likelihood of you being caught is very similar to that of being hit by an asteroid."

It may not be a huge risk but it is still going to suck if you have to pay for your neighbor's music downloads.

[michaewlewis]

its not irresponsible... its helpful. and the chances that someone is going to sit in a car in front of your house and try to hack your network is about the same as someone hacking your network from a different state... maybe even less. But in either case, I have all my sensitive data in a truecrypt folder.

[Zylstra]

I think securing your network is important if you plan on exchanging secured information... eg: Bank accounts, email password, forum passwords, etc etc.

I personally use WPA-PSK [TKIP] + WPA2-PSK [AES], and also MAC Address filtering...
It works well, and is compatible with everything in my network. (Before, I used to use WEP, and a friend informed me it can be hacked with free tools in about 5 minutes)

Now, I am a heavy network user, and that increases my chances of partial packet scanning network exposure, however, that's why I always have the MAC filter enabled.. just as a backup. (Though, it is possible to spoof your MAC address, my router is somehow picky whenever something changes. eg: Whenever I reinstall the OS on any computer on my network, I have to delete the filter value and put it in again)

I have personal data on my computer, specifically email(s).
I have a descent firewall, etc

[quaxo]

Like Zylstra, I keep my network very secure too, with WPA-PSK [TKIP] and MAC Address Filtering. I live in a condominium with lots of neighbors.

[michaewlewis]

How vulnerable are you if you access a secure banking website with 128bit encryption on a unsecured wireless network? Does ssl not mean anything on wireless?

[Zylstra]

How vulnerable are you if you access a secure banking website with 128bit encryption on a unsecured wireless network? Does ssl not mean anything on wireless?

It should still be plenty secure over WiFi, after all, its an encrypted connection, completely unreadable to hackers.

[SilentAssasin64]

I don't bother securing my wireless.  I have 2 neighbors.  1 of which are my grandparents, the other is another elderly couple.  The chances of them getting into my network are non-existent.  However, if I were to live up the street a few blocks I would definitely secure it.

[quaxo]

I'm gonna sit outside Silent's house with my laptop and steal his internet. 

[GX44]

I don't understand people who don't secure anything these days tbh.

The way I see it, having an unprotected wireless network is similar to having your wallet strapped to your arm with a rubber band. Why take the risk?

(sorry for the poor comparison with the wallet, haha... I'm having a bad word day and forget the actual name used when you draw up a reference like that... anyone else get those days?)

[quaxo]

It's a simile.

And no, I don't have days like that. I'm an English teacher, it's not allowed. 

[gamerx365]

ur an english teacher? you dont get paid for radio ads? or you don't do those anymore?

[michaewlewis]

Whatever it is, I don't see how having your wallet on your arm even comes close to having an unsecured wireless in principle. I'd say its more like having a bag of chips on the table at a superbowl party. Anyone can have some, but don't take the whole thing.

[WillyW]

Analogy, perhaps?

[quaxo]

Nah, I've  been out of the music business for a while. Now I just teach English and run my computer shop. 

I actually haven't worked on any music in quite a while, maybe 6 months. I think it's time to get started again.

[patio]

Whatever it is, I don't see how having your wallet on your arm even comes close to having an unsecured wireless in principle. I'd say its more like having a bag of chips on the table at a superbowl party. Anyone can have some, but don't take the whole thing.

Using this analogy how's your Bank Account lookin these days ? ?
Can anyone have some ?

[gamerx365]

So how does having unsecured Wi-Fi put you/your computer in danger?

I live on a little hill in like, nowhere with the neighbors way far away so i wont have to worry about that, but just wondering.

[michaewlewis]

Using this analogy how's your Bank Account lookin these days ? ?
Can anyone have some ?

My bank account is secured and I access it over a secure, SSL, connection. It's not like a bag of chips.

So how does having unsecured Wi-Fi put you/your computer in danger?

I live on a little hill in like, nowhere with the neighbors way far away so i wont have to worry about that, but just wondering.

Having an unsecured wireless network increases your risk slightly more than being connected to the internet. It's something that has been argued about for years and will be argued for many more years.

[Zylstra]

Look, even I[/i] run around rural areas looking for wifi signals so I can check my email.

Now, had I happened to connect to your network, and had I suddenly seen all of your workgroup folders, one of which contained that little file that had your credit card number written down, what would happen?
(Not that I am able, mentally, to steal such a number and abuse it or anything, but, point still exists)

Many people just run around searching for signals. Some of those people have bad intentions. Secure it!

[gamerx365]

1) whats a workgroup folder?
2) why would anyone write the CCard number down in a file in it?

[Zylstra]

1) whats a workgroup folder?
2) why would anyone write the CCard number down in a file in it?

1) A Workgroup Folder is a folder shared across anyone connected to your network

2) Its upsetting how many people wouldn't even encrypt it. Yes, many people do it. But, lets say its other information. For example, what if I found information that would slowly lead up to finding your personal information? Eg: I find something titling where you work, how old you are, (a job application, for example), perhaps the last four digits of your SSN are on there, and other random information.

[GX44]

Analogy was the one I was looking for... And excuse the poor wallet analogy, I like the bag of chips one better now

[SilentAssasin64]

I'm gonna sit outside Silent's house with my laptop and steal his internet. 

Go ahead =]. 

[Emiel]

Whenever I talk or write about my own security setup, the one thing that surprises people -- and attracts the most criticism -- is the fact that I run an open wireless network at home. There's no password. There's no encryption. Anyone with wireless capability who can see my network can use it to access the internet.

To me, it's basic politeness. Providing internet access to guests is kind of like providing heat and electricity, or a hot cup of tea. But to some observers, it's both wrong and dangerous.

Continued.....
http://www.wired.com/politics/security/commentary/securitymatters/2008/01/securitymatters_0110

My thoughts exactly..

Mine too. It's nice to provide guests with internet access, but he/she should consider the risks of a random *sshole who hacks into the system.

[Eg0Death]

Like leaving your car doors unlocked.  With the keys in the ignition.  Parked in the dark corner of the parking lot.

[michaewlewis]

Like leaving your car doors unlocked.  With the keys in the ignition.  Parked in the dark corner of the parking lot.

not really

[Calum]

I don't think that's a bad analogy actually.

To carry on the trend: it's like connecting to the internet unprotected, in the sense that it's dangerous.  You won't get a virus from not securing your connection, but why offer it out for free for people to do what they like with it?
The type of people who are going to be stealing your connection are most likely the type of people to do other illegal things once they've logged onto it.
Guess who gets the blame?
Clue: it's not them, they're long gone.

If you have a wireless network, secure it as well as you are able.  Simple as that.  Unless of course you have a very good reason, e.g. you're in the middle of nowhere, you're a charitable organisation who has money and net access to burn, etc.

[socrates]

I have security on my setup at home, but I give my guests passwords.  What I don't want is neighbor freeloaders (i live in an apartment) ripping off my internet and not purchasing their own.

[michaewlewis]

If you have an unsecured connection and somebody uses it for illegal purposes, all you would have to say in court is that the network is open and anybody could have done it. If you have a secured connection and someone does the same (by breaking your encryption), it will be a lot harder to explain.

The people who want to do illegal things are more likely go to a public place like Starbuck's or an airport instead of sitting in front of someone's house in a lawn chair. It's easier to go unnoticed that way. And do you think Starbuck's is ever held responsible for anything illegal done over their wireless? I doubt it.

[michaewlewis]

I have security on my setup at home, but I give my guests passwords.  What I don't want is neighbor freeloaders (i live in an apartment) ripping off my internet and not purchasing their own.

Ever burn a friend's CD for yourself?

[patio]

No matter how you rationalise it it's an irresponsible article at best...i'll bet he's out of work inside of 6 months.

If not he'll be somewhere else where they pay for drivel.

[socrates]

I have security on my setup at home, but I give my guests passwords.  What I don't want is neighbor freeloaders (i live in an apartment) ripping off my internet and not purchasing their own.

Ever burn a friend's CD for yourself?

We're talking about two different things though.  I personally have nothing bad to say about those who steal music, but that's another story.  The issue is that when someone else uses your internet on a consistent basis, your bandwith is taken up considerably (of course, a different amount depending on what they're doing on your wireless).

It'd be analogous to me burning a friend's cd for myself and in turn making it harder for my friend to listen to his/her cd.

[Eg0Death]

Posted by: michaewlewis  Posted on: Today at 15:58:54 
Insert Quote 
Quote from: socrates on Today at 15:54:37
I have security on my setup at home, but I give my guests passwords.  What I don't want is neighbor freeloaders (i live in an apartment) ripping off my internet and not purchasing their own.


Ever burn a friend's CD for yourself?

 

Legality issues aside, it's still a bit different.  If I play the copy I paid for at the same time as someone who made a free copy, there's no degradation in service.  If a bunch of people hop onto my network they will eat up my bandwidth. 

[michaewlewis]

Well, if someone gets on my wireless and starts slowing me down, I'll look at my configuration page and see who it is and kick them off for a few minutes while I'm downloading os updates or browsing youtube. If it becomes a recurring problem I'll block their mac address and/or talk to them about it. If it is a recurring problem, it will most likely be a neighbor, too. So I'll tell them that if they want to continue taking up my bandwidth, they can mow my lawn for me.
oh and btw, if you have cable internet, your neighbors are already stealing your bandwidth...

[socrates]

Well, if someone gets on my wireless and starts slowing me down, I'll look at my configuration page and see who it is and kick them off for a few minutes while I'm downloading os updates or browsing youtube. If it becomes a recurring problem I'll block their mac address and/or talk to them about it. If it is a recurring problem, it will most likely be a neighbor, too. So I'll tell them that if they want to continue taking up my bandwidth, they can mow my lawn for me.
oh and btw, if you have cable internet, your neighbors are already stealing your bandwidth...

I don't have cable internet, and what you do sounds like a big hassle (or rather, a pointless hassle) that isn't needed.  Setup security. Period.

[socrates]

Posted by: michaewlewis  Posted on: Today at 15:58:54 
Insert Quote 
Quote from: socrates on Today at 15:54:37
I have security on my setup at home, but I give my guests passwords.  What I don't want is neighbor freeloaders (i live in an apartment) ripping off my internet and not purchasing their own.


Ever burn a friend's CD for yourself?

 

Legality issues aside, it's still a bit different.  If I play the copy I paid for at the same time as someone who made a free copy, there's no degradation in service.  If a bunch of people hop onto my network they will eat up my bandwidth. 

Exactly.

[michaewlewis]

Well, if someone gets on my wireless and starts slowing me down, I'll look at my configuration page and see who it is and kick them off for a few minutes while I'm downloading os updates or browsing youtube. If it becomes a recurring problem I'll block their mac address and/or talk to them about it. If it is a recurring problem, it will most likely be a neighbor, too. So I'll tell them that if they want to continue taking up my bandwidth, they can mow my lawn for me.
oh and btw, if you have cable internet, your neighbors are already stealing your bandwidth...

I don't have cable internet, and what you do sounds like a big hassle (or rather, a pointless hassle) that isn't needed.  Setup security. Period.

And I would say the same to your proposition.... setting up security would be a big hassle that you would have to do. blocking a mac address is a big hassle might have to do. It may never happen.
I've never noticed any unnacceptable degradation of bandwidth on my connection. It's not a problem for me.

It's something that has been argued about for years and will be argued for many more years.

I give up.

[socrates]

And I would say the same to your proposition.... setting up security would be a big hassle that you would have to do. blocking a mac address is a big hassle might have to do. It may never happen.
I've never noticed any unnacceptable degradation of bandwidth on my connection. It's not a problem for me.

I've done both methods, and I personally have found major degradation due to freeloaders.  It takes only a minute to setup the security (a password is the simplest), and you don't have to worry about it anymore.  However, if you don't have the security setup, you've gotta go back in and check to see who's connected.  Then you have to boot them, and eventually ban them if they don't stop.  Also, if you think your internet's going really slow, you may go in and check the attached devices just to find that no one is leeching the first dozen times. 

Put plain and simple: It's a lot of hassle and worry that can be avoided with a one-minute solution: security.

[michaewlewis]

no worry here...
Put plain and simple, you can continue to use your secured network, and I will continue to enjoy my unsecured network. We can discuss it all day long, but I have a feeling nobody's going to be changing their settings afterwards.
Seems like a good way to close a discussion, right? Hope so.

[socrates]

no worry here...
Put plain and simple, you can continue to use your secured network, and I will continue to enjoy my unsecured network. We can discuss it all day long, but I have a feeling nobody's going to be changing their settings afterwards.
Seems like a good way to close a discussion, right? Hope so.

Right, I wasn't trying to convince you to change your settings.  I was, however, refuting that it's easier to leave it unsecure and then just check to see if people are eating bandwith when the situation arises.