... by a colleague regarding network setup, he wanted advice on security, particularly wireless.

My response was: If you think someone actually wants your data, as opposed to the casual bandwidth thief or other opportunist, then FFS, don't use wi-fi ... at all. And it might be a good idea to stay off the Internet altogether.

Personally, I blame Microsoft. No reason - I just don't like them.

which apple products? my airport extreme supports wpa2 just fine?

"And it might be a good idea to stay off the Internet altogether." ... By Anonymous Coward Posted Saturday 8th November 2008 13:34 GMT

The Soundest of Advice if you want Total Information Communication Security. In CyberSpace is Everything Transparent in TIA.

And it would be UnWise to Imagine that as an Answer whenever IT just Opens Portals ..... Heavens' Doors.. Can you Imagine what you See is Real and Create ITs Being? MeThinks that is a Gift4Giving2All

For most home users, what security they use for Wi-Fi is the same as the default security protocol on their router. Netgear used to be infamous for having no encryption whatsoever, so anyone in the neighbourhood of a Netgear wireless router could hop on the poor pleb's network...

As for me, I use WPA2 (AES encryption), with a 256 bit PSK (courtesy of GRC's "Ultra High Security Password Generator") and MAC address filtering. I've experimented with not broadcasting my SSID, but Vista gets unhappy if I try that...

Jolly Roger, 'cause it seems rather appropriate in the light of plebs with unsecured (or lightly secured) WiFi...

....do it without cables....

The problem here is that most corporate wifi is used in the industrial context, running barcode scanners. Unfortunately most handheld barcode scanners use an old implementation of Windows CE that doesn't support WPA2. In fact, I know some scanners in operation that only support WEP. And neither of the units support upgrades (manufacturers want you to spend megabucks to replace handsets) Suffice to say that in a corporate environment Wifi should be firewalled off from the network at a minimum. I'm getting to the point where in some locations I just want to unplug it now.

We've been looking at our wireless security, as we use WPA/TKIP.

The problem we have with WPA2 is that you cannot configure it in group policy unless you have a Vista or WS08 machine to open the GPO with. Not a problem here but our corporate office and other sites don't have this yet, and will not setup a Vista workstation purely for the management of one GPO.

RE: The broadcasting comment, not broadcasting is security through obscurity, which IMO is not security at all. Your actually better off broadcasting as your clients would give away the network anyway, as they sit there continually checking to see if the network is there.

Have you any idea how easy it is in a half-decent OS to clone a MAC address? ifconfig ath0 link 00:0f:de:ad:be:ef will do just nicely and that MAC address can be picked up rather easily using any decent wireless surveying software. MAC filtering is useless against an attacker with even skiddie levels of clue.

The ideal at the moment, if you really must use wireless, is WPA2-EAP running IPSEC over the link once associated, with "required" in your SPD for all localnet hosts, wired or wireless. Much extra load on your network stack and software crypto (unless you're a lucky sod with either a hardware cryptodev or a Via C7), but it's about as secure as it gets for now; even if they burst your wireless femidom, they still have the IPSEC dutch cap to worry about.

Here's a radical idea: If it's that sensitive a network, don't connect an AP to it. If you think of it as leaving a stray cable, plugged into your core switch, lying on the car-park for any old munchkin to connect to his OLPC*, you'll not go far wrong.

* Do OLPCs have a wired port? I must confess I really don't know.