Subject: RE: Wireless at IETF

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 18 Jan 2006 14:25:56 -0800

> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Ted Faber

> On Wed, Jan 18, 2006 at 02:23:49PM -0500, Steven M. Bellovin wrote:
> > In message <[email-masked]>, Ted Faber writes:
> > >
> > >
> > >On Wed, Jan 18, 2006 at 10:30:31AM -0800, Hallam-Baker, 
> Phillip wrote:
> > >> The result is that 70% of wireless access points are 
> open and can 
> > >> be used by Internet criminals to achieve anonymous access.
> > >
> > >Loaded statement?  Check.
> > >Precise statement? Check.
> > >Supported statement? Hmmmm.....
> > >
> > 
> > I'm not sure which part your claiming is unsupported; my 
> own informal 
> > measurements agree with the 70% number.  I'm not at all 
> convinced that 
> > "Internet criminals" use such access points as a major means of 
> > access, though.
> 
> Well, none of it's supported.  Your statement above about 
> informal measurements is support for your statement of 70% 
> and indirectly of his.

The figure came from a presentation at an (anti-) Internet crime
meeting. I do not remember the source. 

Although I do have similar concerns about figures like that being
repeated without verification it is certainly believable and compatible
with my own experience. 

> Going from an open access point to anonymous criminal access 
> seems much more implausible to me.  There are all sorts of 
> hurdles one could put up between "no link level protection" 
> and "anonymous criminal access."  But again, I'm wrong all 
> the time and a citation for that much more damning statement 
> would be very welcome.  Without one I feel like I'm watching 
> local news.

As for the use made by criminals, that has been documented and the
frequency is increasing. In one case in Toronto a pedophile was caught
surfing the Internet from his car with no trousers on... We see quite a
few script kiddie level hackers using open WiFi connections.

It would not have been difficult to design WiFi in such a way that it
was secure by default. None of the mechanisms provided to consumers has
met that requirement. 

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Ted Faber <[email-masked]>
Date: Wed, 18 Jan 2006 15:47:59 -0800

> repeated without verification it is certainly believable and compatible

I am being something of a stickler, which isn't your fault.  I actually
agree with the number's plausibility if it's a measure of networks run
without any authentication at the link level.  I certainly think the
technology is much more insecure than it needs to be.

> few script kiddie level hackers using open WiFi connections.

One pedophile: check. :-)

I'm not sure that the pedophile surfing the net from his paid-for DSL
line is any better from a societal perspective, but it might make
prosecution easier. 

I think that predatory behavior does not come disproportionately from
WiFi users who gain access through hacking open access points.  I can't
support that, but my guess is that people tend to stay out of public
when committing acts they know to be frowned on by most.  It certainly
would have been the best interest of the fellow in your example to have
been in private.

The script-kiddie attacks on WiFi installations are much more on point,
IMHO.  That's a denial of service that is only possible because the
securty system of the media was screwed up.  It's much less melodramatic
than the fellow wardriving with no pants, though.

> was secure by default. None of the mechanisms provided to consumers has

Secure design is usually difficult in my experience, but I agree that
it's unfortunate that we didn't do better and haven't really done
better.  But the situation really is bad enough without adding
half-naked pedophiles to the mix.

-- 
Ted Faber
http://www.isi.edu/~faber           PGP: http://www.isi.edu/~faber/pubkeys.asc
Unexpected attachment on this mail? See http://www.isi.edu/~faber/FAQ.html#SIG
_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Sam Hartman <[email-masked]>
Date: Thu, 19 Jan 2006 21:07:08 -0500

Hi.  I'd just like to speak in favor of anonymous Internet.  Yes there
needs to be a balance, but honestly, if there wern't ways to get
anonymous internet I'd consider it a big problem.

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 19 Jan 2006 21:10:52 -0500

>anonymous internet I'd consider it a big problem.
Strong second.

		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb