Hacker News Reader

Comment by UncleMeat | Hacker News Reader

Wifi is largely insecure anyway. You should largely assume that the network is malicious no matter what and just rely on application layer security.

View on HN

That's a reasonable position to take for networks in general like coffee shops, but if I'm paying WeWork to provide office infrastructure, I expect the network to not be malicious, just like I expect not to need to boil and chlorine-treat the water I get from their water fountains.

Not everybody knows or appreciates the use of a VPN. I don't think yours is enough justification for WeWork for not having built a proper service.

What is a "proper service" in this case? Many company networks routinely allow access using fairly straightforward and rarely rotated passwords. Of course, access to actual company resources like email require 2FA etc.

But as others note, the main purpose of having a password at all is to stop casual passersby from leeching off your network.

> What is a "proper service" in this case?

Something like one of the 802.11 Enterprise modes that don't use a PSK and actually check against a user DB before handing out a session.

So now there’s significant complexity to getting on the network. Seems like a poor choice for a co-working space. And, as I say, plenty of large companies with competent IT departments don’t seem to think that’s necessarily.

And how about when you’re having a meeting with outside people who need to get onto a network?

> So now there’s significant complexity to getting on the network

Not really, every OS (even Network Manager does a good job) has support for the WPA enterprise login flow. You basically get 1 prompt to trust a cert, then enter your username + pass (usually tied to AD) which you can save to your OS keychain. I've never had to fiddle with the one at my corporate network since first signing in months ago.

I don't know about the actual security benefits, but I do know it stops the typical "capture the handshake & game over"

> And how about when you’re having a meeting with outside people who need to get onto a network?

You set up a crappy rinky-dink "FooBarGuest" network with a PSK that has no real access to the rest of the network and pretty much can just be used for web browsing.

It's not hard to automate guest accounts.

Most universities and schools have a similar setup. No idea how WeWork works but I assume you have some sort of user account already (how do you pay them otherwise?) that you can use to authenticate yourself. Then your AP just needs to talk to a auth gateway (usually RADIUS) which then talks to your actual auth backend (LDAP, AD, or whatever online login form they use).

For guests you either generate guest account or just have a guest network. We don't care if guests fight over the guest network because there aren't that many of them around at any one time... the problem is that actual WeWork customers shouldn't be fighting over insecure APs.

Fair enough. Although I'm familiar with quite a few situations where most people just use a single network for wireless (whether employees or guests) and confidential company resources are put behind SSO and/or VPN using 2FA.

Others do have separate networks of course and maybe that makes sense in the case of something like WeWork that probably has more people who aren't employees/paying customers coming in and out and getting on the network than the typical company office does.

I think the problem is that providing internet access is part of WeWork's core product. It doesn't matter if your accountant's office just has one shitty wifi connection for everyone -- you'd still go visit them even if they didn't have wifi. But literally the entire point of WeWork is renting space to work, with internet. They should be held to a higher standard in this regard, IMO.

Every WeWork member has a dedicated account which is tied to their company and badge (which is used for building access). This account is also used for reserving rooms.

Application layer security doesn't just mean VPNs. What websites are you connecting to with sensitive information that don't use HTTPS with HSTS preload nowadays?

Here's one from just yesterday: the password reset form for sched.com, which the Linux Foundation uses for schedules, is HTTP. I had to follow this link to upload my slides for a talk I'm giving at a LF conference next week.

Yes, the ideal, which we should all be actively working towards, is HTTPS. That doesn't mean that the world is already there.

Note that Let's Encrypt, which is making universal https possible, is also part of the Linux Foundation.

I was going to complain to sched.com for you, but I can't replicate the problem:

https://ossna19.sched.com/password-reset is the default and http://ossna19.sched.com/password-reset redirects to it.

(I work for the Linux Foundation.)

The email you get in your inbox when you do that is http. It starts with http://a.sched.com/track/click/.

I worked with Sched.com this week based on your feedback and that link is now https. Thanks.

Awesome work

What VPNs should one be using? Should I create my own because what's the guarantee of a vpn actually being trustworthy?

https://github.com/trailofbits/algo is pretty good for self hosted

Reply on news.ycombinator.com