Re: CRIME wireless case study URLs?

From: Crispin Cowan (crispin@private)
Date: Mon Sep 27 2004 - 23:02:31 PDT


Kuo, Jimmy wrote:

>Seems to me the most obvious way is to name the SSID, "FREE".
>
>That would be rather unambiguous.
>  
>
Indeed, it is equally easy to interpret proper behavior if you see any 
of a myriad of "free" signs as it is to interpret proper behavior if you 
see "buzz off" signs, such as a WEP-keyed network :)

Those are the easy questions. The hard question is how to interpret a 
WAP that has *no* indicators at all, either way. I do not buy the "you 
must be stealing from *someone* argument" as that is provably false 
under numerous AUPs. OTOH, it is "stealing" under some other AUPs. 
However, I would argue that if the AUP prohibits anonymous sharing, then 
the person doing the stealing is the ISP customer who deployed a 
non-encrypted WLAN, contrary to the AUP, and not the casual passer-by, 
who has no way of knowing what AUP is in effect.

Crispin

>Jimmy
>
>-----Original Message-----
>From: owner-crime@private [mailto:owner-crime@private] On Behalf Of
>Don Park
>Sent: Tuesday, September 21, 2004 4:07 PM
>To: Gary Driggs
>Cc: CRIME
>Subject: Re: CRIME wireless case study URLs?
>
>
>
>On Sep 21, 2004, at 3:34 PM, Gary Driggs wrote:
>
>  
>
>>Don Park wrote:
>>
>>    
>>
>>>Possibly the best answer is to have a policy indicator in the beacon
>>>packet that states the intent of the access point owner. Since we 
>>>don't have this in 802.11b, the next best thing could be to use an 
>>>essid of a community wireless group where its fairly well established 
>>>that the standard essid of the group is meant to indicate that free 
>>>open access is allowed.
>>>      
>>>
>>Better yet, all APs should have a captive portal page similar to
>>NoCatAuth or NoCatSplash. It would allow you to warn anyone using your 
>>AP whether it were freely usable or not.
>>
>>    
>>
>
>One thing I've seen that struck me as useful is to put )( in the essid. 
>")(" being an approximation of the warchalking symbol for an open 
>access point. Although some access points are pretty stringent on what 
>characters are allowed in the essid.
>
>don
>
>  
>

-- 
Crispin Cowan, Ph.D.  http://immunix.com/~crispin/
CTO, Immunix          http://immunix.com



This archive was generated by hypermail 2.1.3 : Mon Sep 27 2004 - 23:46:04 PDT