# Wireless Network Security
**URL:** https://boards.straightdope.com/t/wireless-network-security/423201
**Category:** Factual Questions
**Created:** [October 18, 2007, 6:23pm UTC](https://boards.straightdope.com/t/wireless-network-security/423201 "2007-10-18T18:23:16Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@MeanJoe](https://boards.straightdope.com/u/MeanJoe)
#### Post date: [October 18, 2007, 6:23pm UTC](https://boards.straightdope.com/t/wireless-network-security/423201/1 "2007-10-18T18:23:16Z")
Okay, I am not computer illiterate but this topic leaves me feeling very đ
I have cable broadband that comes into the cable modem. My cable modem connects to my wireless router. My desktop computer is connected the the router via a network cable. My work laptop and iPhone connect wirelessly. I have a Linksys WRT546 wireless router and Iâm running Windows XP Pro on both computers. My laptop is a work provided laptop.
How do I secure my wireless? I am most concerned about unauthorized computers using my wireless network to piggy-back onto my internet connection. Secondary concern is someone âhackingâ my personal or work computer through the network.
I have done nothing at this point so where do I start? Use small words please. đ
MeanJoe
---
### Author:  [@Rysto](https://boards.straightdope.com/u/Rysto)
#### Post date: [October 18, 2007, 6:33pm UTC](https://boards.straightdope.com/t/wireless-network-security/423201/2 "2007-10-18T18:33:20Z")
What you want to do is enable encryption on the wireless network. That way, anybody who doesnât have the key(ie password) wonât be able to communicate with your network at all.
Whatâs youâll want to do is enable WPA2 encryption on your router â the manual should tell you how you can do that(it should be really easy â navigate to a special web page for configuring the router, go to the Encryption setting and enter a password). Make sure that the network is using Shared Key Authentication, not Open Access Authentication(if the router doesnât give this option, then it will default to Shared Key when WPA2 is enabled).
Once thatâs done, you should only have to give your Windows machine the password to connect to the wireless and youâll be secure.
---
### Author:  [@Duckster](https://boards.straightdope.com/u/Duckster)
#### Post date: [October 18, 2007, 6:37pm UTC](https://boards.straightdope.com/t/wireless-network-security/423201/3 "2007-10-18T18:37:07Z")
[QUOTE=MeanJoe]
I have done nothing at this point so where do I start? Use small words please. đ
[/QUOTE]
Reading the router user manual would be a good place to start.
I read the user manual and did the following:
1. Changed the default network name or SSID.
2. Changed the default admin password used for accessing the router to a 16 character alpha-numeric case-sensitive password.
3. Upgraded the router firmware to latest version.
4. Set up the strongest encryption that came with the router.
5. Enabled MAC address filtering.
6. Changed the router internal IP address sequence from the default settings.
---
### Author:  [@Amblydoper](https://boards.straightdope.com/u/Amblydoper)
#### Post date: [October 18, 2007, 9:32pm UTC](https://boards.straightdope.com/t/wireless-network-security/423201/4 "2007-10-18T21:32:42Z")
As a poor, off campus college student, with ZERO spending money, and no internet access, I hope ignorance prevails with this topic. I really enjoy piggybacking on one of the 3 âlinksysâ networks that are wide open in my apartment building.
However, It is very easy to secure it, as mentioned above. Point your browser on the physically connected PC to [http://xxx.xxx.xxx.xxx](http://xxx.xxx.xxx.xxx) (number should be on the back of your router if not in the manual) and login as âadminâ. Then just change the settings listed above.
---
### Author:  [@Mangetout](https://boards.straightdope.com/u/Mangetout)
#### Post date: [October 18, 2007, 9:39pm UTC](https://boards.straightdope.com/t/wireless-network-security/423201/5 "2007-10-18T21:39:50Z")
I wouldnât bother with MAC address filtering - itâs not even slightly effective against a serious hacker (actually, even a determined amateur), who will be shut out by WPA2 encryption anyway. Also, MAC address filtering makes it a pain to add new or authorised guest devices to the network.
---
### Author:  [@Musicat](https://boards.straightdope.com/u/Musicat)
#### Post date: [October 18, 2007, 10:32pm UTC](https://boards.straightdope.com/t/wireless-network-security/423201/6 "2007-10-18T22:32:49Z")
[QUOTE=Mangetout]
I wouldnât bother with MAC address filtering - itâs not even slightly effective against a serious hacker (actually, even a determined amateur), who will be shut out by WPA2 encryption anyway. Also, MAC address filtering makes it a pain to add new or authorised guest devices to the network.
[/QUOTE]
A pain it can be for legitimate users, but I am surprised to hear you say that MAC filtering isnât that effective. Is it easily spoofed?
---
### Author:  [@gazpacho](https://boards.straightdope.com/u/gazpacho)
#### Post date: [October 18, 2007, 10:43pm UTC](https://boards.straightdope.com/t/wireless-network-security/423201/7 "2007-10-18T22:43:53Z")
[QUOTE=Musicat]
A pain it can be for legitimate users, but I am surprised to hear you say that MAC filtering isnât that effective. Is it easily spoofed?
[/QUOTE]
Many wireless card can easily change the MAC address they use.
> **[Changing Your MAC Address In Window XP/Vista, Linux And Mac OS X
(Sometimes...](https://www.irongeek.com/i.php?page=security%2Fchangemac)**
>
> Irongeek's Information Security site with tutorials, articles and other information.
---
### Author:  [@Rick](https://boards.straightdope.com/u/Rick)
#### Post date: [October 18, 2007, 10:57pm UTC](https://boards.straightdope.com/t/wireless-network-security/423201/8 "2007-10-18T22:57:11Z")
[QUOTE=Duckster]
Reading the router user manual would be a good place to start.
I read the user manual and did the following:
1. Changed the default network name or SSID.
2. Changed the default admin password used for accessing the router to a 16 character alpha-numeric case-sensitive password.
3. Upgraded the router firmware to latest version.
4. Set up the strongest encryption that came with the router.
5. Enabled MAC address filtering.
6. Changed the router internal IP address sequence from the default settings.
[/QUOTE]
**Write all of these settings down, and save it somewhere you can find it again in 9 months when something goes sideways.**
Ask me how I know this. đ
---
### Author:  [@Mangetout](https://boards.straightdope.com/u/Mangetout)
#### Post date: [October 18, 2007, 11:20pm UTC](https://boards.straightdope.com/t/wireless-network-security/423201/9 "2007-10-18T23:20:06Z")
[QUOTE=Musicat]
A pain it can be for legitimate users, but I am surprised to hear you say that MAC filtering isnât that effective. Is it easily spoofed?
[/QUOTE]
Yes, and itâs fairly trivial to sniff a few packets and deduce the correct MAC addresses to use.
Turning off SSID broadcast (another common piece of advice) wonât do much for security either, because again, it can be deduced by passively snagging a few packets.
Changing the default SSID is a good idea, because it often identifies the make and model of the router, which might suggest device-specific security holes.
Setting the router so that it canât be administered wirelessly (only by plugging in a cable) can be a good idea, where practical - changing the default password is absolutely essential if you donât (and probably a good idea anyway)
But most importantly, WPA encryption - thatâs really the thing - way above and beyond the others - thatâs going to make it most secure.
---
### Author:  [@Duckster](https://boards.straightdope.com/u/Duckster)
#### Post date: [October 19, 2007, 3:58am UTC](https://boards.straightdope.com/t/wireless-network-security/423201/10 "2007-10-19T03:58:31Z")
[QUOTE=Mangetout]
Yes, and itâs fairly trivial to sniff a few packets and deduce the correct MAC addresses to use.
Turning off SSID broadcast (another common piece of advice) wonât do much for security either, because again, it can be deduced by passively snagging a few packets.
Changing the default SSID is a good idea, because it often identifies the make and model of the router, which might suggest device-specific security holes.
Setting the router so that it canât be administered wirelessly (only by plugging in a cable) can be a good idea, where practical - changing the default password is absolutely essential if you donât (and probably a good idea anyway)
But most importantly, WPA encryption - thatâs really the thing - way above and beyond the others - thatâs going to make it most secure.
[/QUOTE]
Given the choice to do a number of things, however feeble it may be to some, or doing nothing, is akin to not locking the doors to your home. A professional burglar will get in anyway, but at least locked doors will keep out most of the riff-raff.
---
### Author:  [@Musicat](https://boards.straightdope.com/u/Musicat)
#### Post date: [October 19, 2007, 4:56am UTC](https://boards.straightdope.com/t/wireless-network-security/423201/11 "2007-10-19T04:56:55Z")
[QUOTE=Mangetout]
Changing the default SSID is a good idea, because it often identifies the make and model of the router, which might suggest device-specific security holes.
[/QUOTE]
OTOH, when people change the default SSID, they typically use something that identifies with their home or business, like âSMITH\_FAMILYâ, which makes hacking a bit easier. If security is the primary concern, maybe using something random like â1G9RW3Bâ might be more clever?
---
### Author:  [@GiantRat](https://boards.straightdope.com/u/GiantRat)
#### Post date: [October 19, 2007, 5:02am UTC](https://boards.straightdope.com/t/wireless-network-security/423201/12 "2007-10-19T05:02:20Z")
All of the above are true, but ultimately wireless (at a consumer level, anyway) is not secure. WPA-PSK can be beaten (in most deployments) with a dictionary attack, which is not tough to perform but will usually make you more annoying to break into than a data thief. Itâs similar to the task of cryptography - nothing is safe, but make it âcomputationally infeasible.â That is, make it a whopping pain in the ass. WPA2 is about as good as you can get for now.
Coming soon to a consumer market near you - elliptic crypto for wireless! Well, âsoonâ is a relative termâŚ
---
### Author:  [@Mangetout](https://boards.straightdope.com/u/Mangetout)
#### Post date: [October 19, 2007, 7:30am UTC](https://boards.straightdope.com/t/wireless-network-security/423201/13 "2007-10-19T07:30:56Z")
[QUOTE=Duckster]
Given the choice to do a number of things, however feeble it may be to some, or doing nothing, is akin to not locking the doors to your home. A professional burglar will get in anyway, but at least locked doors will keep out most of the riff-raff.
[/QUOTE]
Sure, but MAC address filtering, when youâre also using WPA2 encryption, is like locking the internal doors connecting rooms - inconvenient to the people living inside the house, and unnecessary when you have a secure lock on the external door.
---
### Author:  [@Mangetout](https://boards.straightdope.com/u/Mangetout)
#### Post date: [October 19, 2007, 7:35am UTC](https://boards.straightdope.com/t/wireless-network-security/423201/14 "2007-10-19T07:35:21Z")
[QUOTE=Musicat]
OTOH, when people change the default SSID, they typically use something that identifies with their home or business, like âSMITH\_FAMILYâ, which makes hacking a bit easier. If security is the primary concern, maybe using something random like â1G9RW3Bâ might be more clever?
[/QUOTE]
Or just some random word picked from the dictionary.
---
### Author:  [@Rysto](https://boards.straightdope.com/u/Rysto)
#### Post date: [October 19, 2007, 7:48am UTC](https://boards.straightdope.com/t/wireless-network-security/423201/15 "2007-10-19T07:48:11Z")
[QUOTE=Musicat]
OTOH, when people change the default SSID, they typically use something that identifies with their home or business, like âSMITH\_FAMILYâ, which makes hacking a bit easier. If security is the primary concern, maybe using something random like â1G9RW3Bâ might be more clever?
[/QUOTE]
I donât see how this helps security. Itâs been a long time since Iâve looked at the 802.11 standard but I believe that when a computer first connects with the AP it sends the SSID in plaintext even for Shared Key Authentication. If Iâve recalled correct than anybody with a packet sniffer(read: anybody whoâs installed Wireshark on their machine) can easily pick out the SSID so making it something random wonât help.
Choosing a totally random WPA2 key, of course, is totally different and should be done.
---
### Author:  [@Mangetout](https://boards.straightdope.com/u/Mangetout)
#### Post date: [October 19, 2007, 8:02am UTC](https://boards.straightdope.com/t/wireless-network-security/423201/16 "2007-10-19T08:02:21Z")
Iâm curious about the dictionary attack angle - I can see how that would fairly quickly crack a WPA PSK consisting of a single word, but if the passphrase is something like:
_ **moving on the floor now babe youre a bird of paradise cherry ice cream smile i suppose its very nice** _
How is that going to get cracked easily by a dictionary attack? - itâs not as if the router confirms that any given trial passphrase was _partly_ correct.
---
### Author:  [@GiantRat](https://boards.straightdope.com/u/GiantRat)
#### Post date: [October 19, 2007, 4:41pm UTC](https://boards.straightdope.com/t/wireless-network-security/423201/17 "2007-10-19T16:41:30Z")
[QUOTE=Mangetout]
Iâm curious about the dictionary attack angle - I can see how that would fairly quickly crack a WPA PSK consisting of a single word, but if the passphrase is something like:
_ **moving on the floor now babe youre a bird of paradise cherry ice cream smile i suppose its very nice** _
How is that going to get cracked easily by a dictionary attack? - itâs not as if the router confirms that any given trial passphrase was _partly_ correct.
[/QUOTE]
Youâre absolutely correct; letâs guess how many people actually use a passphrase instead of a password.
First, the platform must allow for spaces in the âpasswordâ - many donât. Looking at my Netgear, for example, it defines âpassphraseâ as âa word or group of printable characters.â A word - singular, no spaces. That could be a documentation flaw, Iâll admit, but how many people will dick around to find out? Not many. The vast majority of folks out there using WPA varieties thinking theyâre getting âsecureâ are using passwords like âpuppyâ or some other inanity.
Secondly, with a dictionary attack, there is no cracking âeasilyâ - itâs an automated attack. Software donât sweat. Sometimes it just takes longer.
---
### Author:  [@MeanJoe](https://boards.straightdope.com/u/MeanJoe)
#### Post date: [October 20, 2007, 7:10pm UTC](https://boards.straightdope.com/t/wireless-network-security/423201/18 "2007-10-20T19:10:50Z")
[QUOTE=Duckster]
Reading the router user manual would be a good place to start.
I read the user manual and did the following:
[/QUOTE]
RTFM? Nah, Iâd rather RTSDMB. đ
---
### Author:  [@MeanJoe](https://boards.straightdope.com/u/MeanJoe)
#### Post date: [October 20, 2007, 7:13pm UTC](https://boards.straightdope.com/t/wireless-network-security/423201/19 "2007-10-20T19:13:08Z")
Okay, to everyone who posted a replyâŚ
Thank you very much for the tips and instructions. I managed to change the SSID and router name, change the default password, and set WPA encryption.
After making the changes, all my devices connected seamlessly and I was able to âlog onâ to the network from each device.
This help alone was worth the SDMB membership dues. Much appreciated!
MeanJoe
---
### Author:  [@SmartAleq](https://boards.straightdope.com/u/SmartAleq)
#### Post date: [October 20, 2007, 7:29pm UTC](https://boards.straightdope.com/t/wireless-network-security/423201/20 "2007-10-20T19:29:25Z")
If you really want to have some fun, use a WPA key like:
S0mEtH1nG vvR1tT3n 1n 133T sTy13 PsYcH0 cH1cK3n sKrYpt!!! ZOMG!11!!
High ASCII is our friendâŚ
Dictionary hack my rosy ass⌠đ
[Next page](https://boards.straightdope.com/t/wireless-network-security/423201.md?page=2)