Re: [gentoo-user] [way OT] Authenticating in a wireless home network

[Michael Mol]

On 02/24/2013 09:49 PM, walt wrote:
> I've been connecting my google nexus 7 tablet to my wireless router
> using the standard ssid/password method until last week, when I found
> that my router will allow wireless connections based on the tablet's
> MAC address.
>
> What I don't know is whether the MAC-address authentication method
> will cause the wireless router to skip the password authentication
> entirely and accept the MAC address as 100% sole proof of identity.

Not unless there's something amazingly broken with it. And by that I
mean it would be newsworthy; the kind of thing Slashdot would jump on
before it sat in their queue five minutes.

MAC filtering, as it's called, is only trivially more secure than the
network would be without it. It adds just enough inconvenience that it's
unlikely for anyone to get on your network without directed attention or
prior planning for such circumstances.

>
> I've heard that MAC address spoofing is easy given the right skills,
> so I don't know if relying solely on MAC address for authentication
> is asking for trouble, or not.
>
> Your opinions are most welcome, the more paranoid the better :)
>
>

WPA-Enterprise is the most effective supported-by-default way to lock
down access to your wireless network...but it requires you to have a
RADIUS server on your network for your AP to check credentials against.
Every user of your network gets their own username and password, which
you configure on whatever authentication server the RADIUS server uses
as a back-end.

If that sounded confusing to you, it's probably far, far, far more than
you need.

Otherwise, WPA2-Personal is very good; it's a shared-key authentication
mechanism combined with better encryption and encryption application, as
well as key rotation. Chances are, it's what you're already using.