WPA2-PSK "strong security"?

My washing machine is 25 years old, the only thing I've replaced is the timer and If they stop making the pully bearings I'll press them out myself. I can rebuild the motor if I cannot buy a new one.

It takes about 35 minutes for it to do a large wash and I set a 40 minute timer with my Apple Watch.
I toss it in the drier; no idea how long it takes it has a moisture sensor and I empty it out next time I start a load of wash.

My printer is ethernet.

Other than that, I don't have anything smart but my watch and my ass.

2 Likes

You can do that, but you may not end up (much) cheaper than a new (dumb) washing machine (been there, done that - got the t-shirt, the replacement heating component would have cost more than half of the cost for a new machine, excluding the labour - and the machine was beyond its manufacturer planned obsolence date, so what would have broken next).

Modern 'dumb' washing machines made in the last 10 years do emphasize eco modes (water usage, heating, etc.) a lot. The strategy for this is by estimating the weight of the load, more mechanical movement, longer exposure to the (colder) soapy water - and checking how clear the water is when pumping it out. Unless you pick an explicitly 'short' program, you are looking at 1:30-2:30 hours for a normal washing program (and there are ones just shy of 5 hours), with very volatile actual times needed (whose estimates may change significantly right to the end).

…but, 'nuff said about dirty laundry.

We have forum treads about connecting the washing machines.

But come on, are we really having this forum tread and you don’t remember the 15-20 iot things running around at home?
But when we talk about the iot it doesn’t matter if we have different password for wpa2 and wpa3 because they all connect to the same network because if they don’t you can’t connect to them.

The alternative is endless heaps of firewall rules that no one can maintain.

The best iot is the cloud based since they can have their own isolated interface with a wpa2 wifi.

The worst thing with iot is that they are really bad to support wpa2/wpa3 combo. They usually need at best wpa2 and nothing else.

The cloud service is a double edged sword :

  • convenient on daily basis

But…

  • when internet dies, appliance doesn’t work or very basic functionality only
  • when vendor stops support, same as above
  • when vendor gets hacked, you might get hacked as well
1 Like

I know, but this tread runs around in circles for it’s own tail.

1 Like

IMHO there is one problem here. If you only consider only the encryption type it may be misleading. The label how secure the setting is should be based on encryption type, password length, KRACK on/off and roaming(1) on/off ...

E.g. WPA2 with a short password is not safe, WPA2 with KRACK countermeasure and a long password and no roaming + management frame protection is enabled is extremely secure, even with a large gpu cluster itis nearly impossible to find out the password(2).

Asimple fix for the current wording in order to avoid making WPA2 unnecessary weak, enforce a stronger password , right now the webif requires 8 characters, if this would be raised to 12 then the current statement strong security is rather true.

(1) https://hashcat.net/forum/thread-7717.html
(2) Some info how long it takes to break a WPA2 passphrase: https://hashcat.net/forum/thread-11847-post-60276.html

5 Likes

I disagree that a user-chosen 12-character web passwords is "strong security". Length is insufficient to assure strength. My canonical example of that is the 3-class, 17-character "Beam me up Scotty" (I'm really old school). That is in the crackers' dictionaries (remove the spaces and it is found more frequently). (HashMob offers a 16GB dictionary of discovered passwords).

In your link for "how long it takes to break a WPA2 passphrase", the OP there posited that it was just too difficult to break the WPA2 passwords on new APs. But you missed the links to the consequences
of the new APs' default passwords not being random and therefore the theoretical search space is inappropriate.

In that vein, about 39% of WPA traffic captured in the wild gets cracked, but I don't know how many are user-chosen or vendor-supplied or generated randomly.

I wonder how many random characters KEEPER can come up with?

Honestly, I just have an NFC disc with the ridiculous 22 character PW I have on WPA3.

No NFC? I have a label that no one gets right the first try.

Thanks to most of the posters for providing useful information. I've certainly learned some things. Especially from @qunvureze and @KONG

One thing that has not been mentioned here are the consequences of someone gaining access to your wifi. I'll list these

  • Access to unencrypted traffic on your net (HTTP but not HTTPS, SMTP but not SMTPS, printer traffic, IoT devices) Specifically, access to camera traffic if unencrypted.
  • Using your network, making it appear you did the activity (activities such as cracking, DDoS, committing fraud or similar crimes, posting porn, etc.)
  • Committing identity theft against you by posing as you from your home network. That would be hard to prove you didn't do it
  • Attacking your computers
  • Establishing a persistent presence on your devices to allow an attacker back in, even if you secure your network in the future

Even if you isolate your less-secure (for instance, WEP) devices on their own network, attacks from them that leave your network would still be from your network. For me, attacks against my computer are a concern, so I isolate it from less trusted devices.

@flygarn12 @slh You may choose to put your car, etc., on the same network as your workstation and accept the weakest link; I don't. I print less than once a week, so my printer is on a different network that I switch to if I need to print.

I liked @qunvureze characterization of the security profiles.

I would add a warning to the user that if anyone ever before has used the chosen password and it was captured, then it is no longer a secure password. Advise the user to choose a password that no one would have ever chosen a similar password before.

This is pretty much standard when someone get inside from wan port. And that is a lot more common than wifi intrusion since you need to be within 20m of the access point to get a meaningful connection.
To get inside your wan they can be somewhere on earth.

According to Cloudflare and all the CERT the bulk of the really big DDoS attacks pretty much comes from bot infected home routers today. And I guarantee those bots didn’t came in through the wifi.

https://forum.openwrt.org/t/security-design-recommendations-by-governments/191807
These two posts are really starting to move towards each other.

1 Like

Just my two cents:

When I look around in my circle of friends, I find that most of them are not interested in this topic. As a rule, they use the password and settings provided by the router manufacturer. In the past - 15 years ago - these passwords were often so bad that they could be found out using SSID and MAC address - all data that can be determined via Wifi. The newer passwords seem to no longer be based on such insecure logics. They often consist of 20 alphanumeric characters. Therefore, these are often better than self-invented NameDateSpecialCharacter structures that people come up with themselves. If OpenWRT were to suggest a “secure password” here, it would probably help many. Furthermore, weak in WEP is not synonymous with weak in WPA. While with WEP the key was calculated based on the amount of intercepted data packets, a brute force attack on WPA depends on computational power. This costs time and money and is not worth the effort depending on the target. So if you are really interested in offering more security, you should perhaps focus more on how to set up the routers so that they recognize an intruder and warn the router operator or ask for confirmation, instead of arguing about terms like weak or strong, because in the end it all comes down to brute force and computational power.

1 Like

Do you mean IDS?

1 Like

Igpa Atinla is not difficult once you understand the rules of how it is generated. Have a look at this thread (up-to-date info is at #210) regarding the space of default keys for a wide variety of access points. Note that the firmware of an AP must compute the password on something it reads from ROM. If what ti reads is predictable (the format of a serial number, etc.) then the resultant password is limited in its range. A manufacturer could (and I hope they do) put a unique & random 64-bit number as a seed into the ROM along with the s/n and make it very hard. But, there are many devices with limited ranges for their passwords.

Of course the 12 char password needs to follow standard rules. Not sure what browser you are using, but firefox suggest a good random password if you click into the openwrt wifi input field.

In dd-wrt I added code to grab the vendor set password from nvram, thus after a reset it would default to the vendor generated password.

IMHO most users, that convert firmware to openwrt have some advanced knowledge and I doubt many will choose a password like in your example. Openwrt is not grandmas favorite firmware.

Anyways, there is already a password rating label when entering a password in the admin setting for the router, should be easy to apply this also to the wifi password section.

1 Like

Yea, but the fact is that we have a never ending steady stream of users here in the forum that remove all or some of the firewall protection on wan. More or less by bad luck.