[OpenWireless Tech] Open Wireless encryption

["Andy Green (林安廸)"]

On 04/01/13 19:39, the mail apparently from dfine at sonic.net included:

> Let's acknowledge that clients always need to trust the AP unless there
> is a third party trust anchor. Because any attacker can act as an AP,

Right.

> trusting the AP is not a good approach. Examples of trust anchors would
> be a VPN beyond the AP or an SSL Certificate Authority for services the
> client uses.

Right, although outsourcing the CA has proven a double-edged sword...

http://www.google.com/search?%7Bgoogle:RLZ%7D%7Bgoogle:acceptedSuggestion%7D%7Bgoogle:originalQueryForSuggestion%7Dsourceid=chrome&ie=%7BinputEncoding%7D&q=root+certificate+stolen

Unless you need anonymous verification, there are credible advantages to 
to doing your own personal CA en masse, ie, in your home router and 
nothing else has any idea of your keys.

> At the same time, let's not confuse the two problems we're discussing:
>
> 1. Protecting AP operators from legal liability
>      I think this is a social problem for which there is not necessarily
> a technical solution. We need strength in numbers, media and legal
> support. AP operators can VPN their traffic to avoid scrutiny, but
> that's not our department. Unless people here want to become VPN
> operators (I don't).

Practically, there needs to be a new, bulletproof story that something 
changed from the current situation where the rational decision to hide 
behind WPA already was made.  Otherwise Joe Schmo will stick with the 
idea that anyone who would like to make some small use of his connection 
is the devil incarnate.

It can be some kind of strong VPN solution or something else that solves 
the same issues, but something must be demonstrated to have changed to 
shift the status quo in AP sharing.

> 2. Protecting clients.
>      People suggest EAP-TLS for that to protect client's traffic from
> being sniffed. While that's cool, the client still has to trust the
> AP operator. And anyone "resell" a legitimate AP's link to become
> the MitM. That is, I'm the attacker and I connect to the internet
> cafe's wifi and re-share it, controlling all the authentication
> mechanisms along the way. EAP-TLS makes it harder though, and I
> think that's pretty much an okay bar to set.
>
> Who wants to have a meatspace discussion in San Francisco this month?

Hey if people can't join a cabal consider a google hangout.  Ping should 
be good from Mountain View by the sound of it.

-Andy

> Happy New Year,
> --DF
>
>
>> On 04/01/13 04:36, the mail apparently from Christopher Byrd included:
>>
>> Hi -
>>
>>>     - VPNs connections are easily blocked on attacker controlled
>>> networks
>>> (such as injecting TCP resets or dropping packets on evil twin APs).
>>
>