Subject: [88attendees] WPA2 Enterprise WiFi?

From: "Marco Davids (SIDN)" <[email-masked]>
Date: Fri, 8 Nov 2013 11:25:40 -0800

Hi,

Now, I'm not an expert on the matter, but since privacy seems to be the
major theme of this 88th IETF, I was wondering; would it be of any value
if we introduce WPA2 Enterprise (WPA-802.1X mode) in the WiFi network ?

Logging in with personal credentials seems a bit more secure in terms of
'privacy'.

The IETF could send them to me, PGP-encrypted, next time I register and
upload my PGP-key on the website, for example.

Regards,

-- 
Marco

---

From: Dominik Bay <[email-masked]>
Date: Fri, 8 Nov 2013 19:38:07 +0000

Just use the .1x SSIDs or eduroam with your credentials

> On 08.11.2013, at 11:26, "Marco Davids (SIDN)" <[email-masked]> wrote:
> 
> Hi,
> 
> _______________________________________________
> 88attendees mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/88attendees

---

From: Warren Kumari <[email-masked]>
Date: Fri, 8 Nov 2013 11:41:35 -0800

> Logging in with personal credentials seems a bit more secure in terms of

Not to me it doesn't…

If everyone logs in as ietf, ietf it is much harder to correlate a user with a device (especially if the machine doesn't identify itself as "BobSmiths-mac" via DHCP!)

Logging in a "BobSmith" and "Hunter3" makes it fairly clear who you are.
Using the .1x SSIDs already gets you encryption, etc on the wise…

> upload my PGP-key on the website, for example.

-1

--
Credo quia absurdum est.

---

From: "Marco Davids (SIDN)" <[email-masked]>
Date: Fri, 8 Nov 2013 12:00:04 -0800

> Just use the .1x SSIDs or eduroam with your credentials

.1x won't help much, will it? It uses a PSK.

(try 'sudo tshark -w wifi.pcap -s 1500 -i en1 -y PPI' if you happen to
have it available)

And unfortunately I don't have any Eduroam credentials.

--
Marco

---

From: joel jaeggli <[email-masked]>
Date: Fri, 8 Nov 2013 12:00:54 -0800

> if we introduce WPA2 Enterprise (WPA-802.1X mode) in the WiFi network ?

wpa2 enterprise is in fact deployed at the IETF.

ietf.1x and ietf-a.1x

The radius server that supports the .1x ssids accepts any credentials as valid.

> 'privacy’.

not using credentials at all and still getting perfect forward security seems better.

> upload my PGP-key on the website, for example.

I wouldn’t mind getting the cert fingerprint signed in a mail I have to accept it on faith the first time around.

---

From: Yasuo Okabe <[email-masked]>
Date: Sat, 09 Nov 2013 05:01:21 +0900

If privacy really matters to you, you should take care on not only 
wireless but also wired links up to the Internet. I recommend you to use 
some VPN connection to your trusted host, and in that case it doesn't 
matter whether the Wi-Fi connection is WPA2 Enterprise or not.

-- 
Yasuo Okabe
Academic Center for Computing and Media Studies, Kyoto University
http://www.net.ist.i.kyoto-u.ac.jp

---

From: "Marco Davids (SIDN)" <[email-masked]>
Date: Fri, 8 Nov 2013 12:06:14 -0800

> If everyone logs in as ietf, ietf it is much harder to correlate a user with a device (especially if the machine doesn't identify itself as "BobSmiths-mac" via DHCP!)

What about grabbing a random piece of paper from a large bowl when when
you arrive?

Or a digital version of this: the 'get me a random IETF-credential'
webpage...

--
Marco

---

From: "Marco Davids (SIDN)" <[email-masked]>
Date: Fri, 8 Nov 2013 12:10:03 -0800

> The radius server that supports the .1x ssids accepts any

Is that so? So I can use whatever random strings I want, not just
'ietf,ietf' ? But that's fantastic (and cleverly done).

(Now I finally understand why the SSID is .1x  ;-)

Thanks

- --
Marco

---

From: Warren Kumari <[email-masked]>
Date: Fri, 8 Nov 2013 12:10:47 -0800

> What about grabbing a random piece of paper from a large bowl when when

Like we did in Beijing?

> webpage…

Please explain how this is an improvement over "ietf" / "ietf"?
We are already doing .1X…

W

--
Some people are like Slinkies......Not really good for anything but they still bring a smile to your face when you push them down the stairs.

---

From: Bill Fenner <[email-masked]>
Date: Fri, 8 Nov 2013 12:11:20 -0800

On Fri, Nov 8, 2013 at 12:06 PM, Marco Davids (SIDN)
<[email-masked]>wrote:

> > If everyone logs in as ietf, ietf it is much harder to correlate a user
> with a device (especially if the machine doesn't identify itself as
> "BobSmiths-mac" via DHCP!)
>

In what way is logging in with your own credentials different from logging
in with "ietf"/"ietf"?

  Bill

---

From: "Marco Davids (SIDN)" <[email-masked]>
Date: Fri, 8 Nov 2013 12:13:18 -0800

On 08/11/13 12:11, Bill Fenner wrote:

> In what way is logging in with your own credentials different from
> logging in with "ietf"/"ietf"?

I don't know, again I am not an expert on this matter.

If  "ietf/ietf" generates different keys for each person that uses it, I
guess we're good.

--
Marco

---

From: Warren Kumari <[email-masked]>
Date: Fri, 8 Nov 2013 12:17:10 -0800

> If  "ietf/ietf" generates different keys for each person that uses it, I

Ah, yes. I understand now, we have been talking past each other…
WPA uses  802.1X EAPOL-Key  packets to distribute per-session keys / there is a temporal key / hand wave hand wave. Every securely gets thier own key...

W

--
My memory is failing, so I changed my password to "incorrect".
That way, when I login with the wrong password the computer tells me… "Your password is incorrect".

---

From: Chris Elliott <[email-masked]>
Date: Fri, 8 Nov 2013 12:17:54 -0800

Marco,

Joel was using outdated data. We indeed did hack free radius to accept any
credentials years ago, but we are using radiator now for authentication,
and it only accepts ietf/ietf as the credentials.

Chris.

On Fri, Nov 8, 2013 at 12:10 PM, Marco Davids (SIDN)
<[email-masked]>wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iEYEARECAAYFAlJ9RRoACgkQ0dvyGJ94G1IvNACfa4CBTA9zPOqCF9YAzycuwnNx
> UaYAoKMx9r7P7tpKtQWkE3GAoXj4TZaO
> =qP1X
> -----END PGP SIGNATURE-----

-- 
Chris Elliott
[email-masked]

---

From: Bill Fenner <[email-masked]>
Date: Fri, 8 Nov 2013 12:18:59 -0800

> If  "ietf/ietf" generates different keys for each person that uses it, I

Yep.

  Bill

---

From: joel jaeggli <[email-masked]>
Date: Fri, 8 Nov 2013 12:23:16 -0800

yeah my bad.

---

From: "Marco Davids (SIDN)" <[email-masked]>
Date: Fri, 8 Nov 2013 12:24:23 -0800

> WPA uses  802.1X EAPOL-Key  packets to distribute per-session keys / there is a temporal key / hand wave hand wave. Every securely gets thier own key...

I believe I was put on the wrong track somewhere along the line. Most
likely because of the same credentials we all use. Somehow in my mind I
drew the wrong conclusion that perhaps we where doing WPA2-PSK (in spite
of the .1x in the name), but that was obviously a stupid assumption.

Thanks, good to know we're safe ;-)

--
Marco
(and yes, I do use a VPN on top of 802.1x)

---

From: Jason Fesler <[email-masked]>
Date: Fri, 8 Nov 2013 12:54:20 -0800

Never hurts to double-encrypt.

/me hugs his double-rot13.

-- 
 Jason Fesler, email/jabber <[email-masked]> resume: http://jfesler.com
 "Give a man fire, and he'll be warm for a day;
 set a man on fire, and he'll be warm for the rest of his life."