header image
July 18th, 2006 by dm Hacking, Vulnerabilities none Comments

A recent research presented at the Workshop on Economics of Information Security at the University of Cambridge suggested that 46 percent of almost 2,5000 access points in Indianapolis were not running any form of encryption.

So far so good, and let’s assume that Indianapolis is fairly representative area for the rest of the country when it comes to securing Wi-Fi. Most of the researchers participating in the workshop criticized the default settings of Wi-Fi routers which leaves networks running without security and without encrypting traffic, "People just really don’t care about Wi-Fi security, and open Wi-Fi at home is a nice big target," said Matthew Hottell, lecturer in informatics at Indiana University. "Defaults (settings) are king."

What troubles this author is comments from some security experts that as long as people’s devices were secure, having a secured network is unnecessary. Here is what "security expert" Bruce Schneier said, 

I have a completely open Wi-Fi network. Firstly, I don’t care if my neighbors are using my network. Secondly, I’ve protected my computers. Thirdly, it’s polite. When people come over they can use it.

Really? Many in the security field would claim that no networked machine is 100% secure. How would Mr. Schneier guarantee that his device is 100% secure? What happened to the layered security models requiring adequate protection at each level? Just because we want to be polite to our neighbors does not mean that we should encourage people lifting the security of their networks hoping that they know how to secure the devices inside their networks and praying that security vulnerabilities would not be discovered and exploited faster than they can be patched. Thank you, Mr. Schneier, but I’d rather secure my network AND device. As far as my neighbors - you are not downloading illegal movies on my bandwidth!