Re: CRIME wireless case study URLs?

From: Gary Driggs (gdriggs@private)
Date: Mon Sep 27 2004 - 17:06:38 PDT


I think the reverend using the library AP in Nantucket, MA is the best 
example I can think of for this debate. The library is a non-profit 
organization whose mission is to provide the public with access to all 
forms of information. Local (county and/or city), state, and fedearal 
taxes, along with private donations help fund library costs, including 
their Internet service.

Joe Linksys in my neighborhood, however, is paying a monthly fee to his 
ISP and/or circuit provider. If Joe Linksys wants to set up an AP that 
his entire neighborhood can use, he is still bound by his ISPs 
acceptable use policies (AUP). AUPs are enforced in varying degrees 
depending on your ISP. An AUP is set up entirely for the ISP's 
protection and traditionally only enforced if you become a nuisance. If 
they start getting cease and desist letters auto-gen'd by the RIAA, for 
example, then you're likely to get some attention. Also, if someone in 
your neighborhood decides to use your AP for shenanigans, you'll take 
the heat for it. An AUP, then, is really a contract that you agree to 
when you purchase service from a provider. Whether you follow that AUP 
to the letter is ultimately at your discretion.

Some ISPs, like Speakeasy, are savvy and realize that their customers 
are likely to share their service for free but may not allow reselling 
it. It would be to your advantange, however, if you took security 
seriously and firewalled your outbound connections, possibly restricting 
it to only HTTP and HTTPS access -- maybe pop3s and imaps as well. 
You'll find that not all SOHO grade APs offer this out of the box, 
however, which is why there's a whole class of middle tier APs that are 
marketed as 'hot spot in a box' products. But even the most low end APs 
offer some pretty basic options to prevent unauthorized access.

-Gary



This archive was generated by hypermail 2.1.3 : Mon Sep 27 2004 - 17:52:28 PDT