1 |
On Monday 25 Feb 2013 03:00:56 Michael Mol wrote: |
2 |
> On 02/24/2013 09:49 PM, walt wrote: |
3 |
> > I've been connecting my google nexus 7 tablet to my wireless router |
4 |
> > using the standard ssid/password method until last week, when I found |
5 |
> > that my router will allow wireless connections based on the tablet's |
6 |
> > MAC address. |
7 |
> > |
8 |
> > What I don't know is whether the MAC-address authentication method |
9 |
> > will cause the wireless router to skip the password authentication |
10 |
> > entirely and accept the MAC address as 100% sole proof of identity. |
11 |
> |
12 |
> Not unless there's something amazingly broken with it. And by that I |
13 |
> mean it would be newsworthy; the kind of thing Slashdot would jump on |
14 |
> before it sat in their queue five minutes. |
15 |
> |
16 |
> MAC filtering, as it's called, is only trivially more secure than the |
17 |
> network would be without it. It adds just enough inconvenience that it's |
18 |
> unlikely for anyone to get on your network without directed attention or |
19 |
> prior planning for such circumstances. |
20 |
> |
21 |
> > I've heard that MAC address spoofing is easy given the right skills, |
22 |
> > so I don't know if relying solely on MAC address for authentication |
23 |
> > is asking for trouble, or not. |
24 |
> > |
25 |
> > Your opinions are most welcome, the more paranoid the better :) |
26 |
> |
27 |
> WPA-Enterprise is the most effective supported-by-default way to lock |
28 |
> down access to your wireless network...but it requires you to have a |
29 |
> RADIUS server on your network for your AP to check credentials against. |
30 |
> Every user of your network gets their own username and password, which |
31 |
> you configure on whatever authentication server the RADIUS server uses |
32 |
> as a back-end. |
33 |
> |
34 |
> If that sounded confusing to you, it's probably far, far, far more than |
35 |
> you need. |
36 |
> |
37 |
> Otherwise, WPA2-Personal is very good; it's a shared-key authentication |
38 |
> mechanism combined with better encryption and encryption application, as |
39 |
> well as key rotation. Chances are, it's what you're already using. |
40 |
|
41 |
Preshared key (PSK) with WPA2 CCMP/AES is probably all you need for a home |
42 |
network and you can throw MAC ACL in just for laughs (because as Michael said, |
43 |
that's all it's worth): |
44 |
|
45 |
ifconfig ath0 hw eth XX:XX:XX:XX:XX:XX |
46 |
|
47 |
|
48 |
The WPA2 keys can be (air)cracked with dictionary files and the like, but if |
49 |
you have some ridiculously long key, and a changed SSID from the router's |
50 |
default (it is used as salt in calculating the key and many a rainbow table |
51 |
are built with default SSIDs) it can be infeasibly difficult to crack it. If |
52 |
you are really paranoid, then using SSL certificates instead of PSKs would |
53 |
make things even more secure. Changing your key/certificates once a month |
54 |
would make it very improbable to have your wireless cracked. |
55 |
|
56 |
Of course you could start covering the inside of your walls with aluminium |
57 |
foil or moving somewhere remote and digging a moat all around your castle, but |
58 |
I'm not sure your connection is that desirable to warrant it. :-)) |
59 |
-- |
60 |
Regards, |
61 |
Mick |