[liberationtech] HTTPS by default campaign launch today

[Jacob Appelbaum]

On 11/09/2010 12:09 PM, Mehdi Yahyanejad wrote:
> On Tue, Nov 9, 2010 at 12:48 PM, Jacob Appelbaum <jacob at appelbaum.net>wrote:
> 
>>
>> Access Point Isolation does not help a passive sniffing attacker unless
>> it is used in combination with WPA2 or some other reasonable encryption
>> mode. Attackers simply need their wireless cards to be in monitor mode
>> (eg: using Kismet) and they win.
>>
>>
> 
> Yes. WPA2 needs to be enabled. A simple password can be given out to the
> public users
> such as "free".
> 

You sorta neglected to mention that crypto was also required. Arguably,
it's the main thing required here to defend against entirely passive
attacks. Still, it is very limited protection against a very lazy attacker.

Even together, I don't think that this is safe advice. What happens when
the attacker sniffs the setup phase (eg: disconnects the client, they
re-auth, etc) of the WPA connection?

If the attacker can decrypt (they have a shared key, they have the
handshake) the WPA session data, I guess the attacker can probably see
the unencrypted sessions cookies just as they might otherwise.

See this wireshark documentation page for an example:
http://wiki.wireshark.org/HowToDecrypt802.11

> 
> 
>> Also, if someone "hacks into your network" - I'm fairly sure that
>> session cookies and passwords are the least of your problem. Surely
>> they're still a problem though. Owning the upstream router or network
>> almost certainly beats Access Point Isolation; the packets are
>> reassembled and sent to the internet through that very same router that
>> is probably now compromised...
>>
>>
> This is not a protection against an advanced hacker. This is about
> protecting
> people against someone running Firesheep/Wireshark on the laptop and
> monitoring traffic.
> These precautions are to make it more difficult for average users to steal
> information.
> 

I don't think it actually makes it much more difficult. It just shifts
the risk to a different part of the network or to the same part of the
network in a weakly (strong block cipher, bad keying) encrypted form...

All the best,
Jake