Baslinux mailing list

[baslinux AT lists.ibiblio.org]

On Wed, Jun 27, 2007 at 04:49:23PM +1200, Steven wrote:
> 
> Do you consider the Aironet 350 an older card?

I meant non-cardbus cards in general, which means 802.11b by definition (I 
believe).

> The Aironet 350 has the following security:
> --------------------------------------------------
> 802.1X support including LEAP, EAP-FAST, PEAP-GTC, 
> PEAP-MSCHAP V2, EAP-TLS, EAP-TTLS and EAP-SIM to 
> yield mutual authentication and dynamic, per-user, 
> per-session encryption keys
> 
> Authenication by MAC address and by standard 802.11 
> authentication mechanisms
> 
> Support for static and dynamic IEEE 802.11 WEP keys 
> of 40 bits and 128 bits
> 
> TKIP enhancements: key hashing (per-packet keying), 
> message integrity check (MIC) and broadcast key 
> rotation via WPA TKIP and Cisco TKIP
> ---------------------------------------------------
> 
> Is that secure enough for you?

It sounds like this card, despite being non-cardbus and 802.11b, is capable 
of sufficiently high encryption (it lists 
WPA). One crucial question is whether this card is unique among non-cardbus 
cards, or whether it's typical. Another 
important question is whether there is a Linux program that will allow the 
user to deploy WPA encryption (or key 
hashing, or MIC) for this card. Have you tried that? If there isn't one, then 
discussing the heightened encryption 
features of this non-cardbus card seems a bit of a moot point.

WEP is not at all secure and there are programs out there that can crack the 
WEP key in just a few minutes or as long 
as it takes to sniff a sufficient number of packets. MAC address filtering is 
pretty much useless since it's so easy to 
discover, then spoof, the MAC address.

> Do you trust your wired connection for this?  Your wired 
> connection passes through numerous routers where your 
> packets could be intercepted by an unscrupulous hacker.  
> How is that safer?

I trust https/ssl wired connections. I'm not trying to set myself up as some 
kind of wireless security guru or 
something. As I said, I've been reading some more about it and coming to a 
realization of the security risks. I think 
mainly about risks between the wifi card and its base station or router--for 
example in the home wireless network, 
rather than about the larger internet, when speaking about the added security 
risks. The very nature of wireless adds 
another vulerability point in computer inter-communications: you broadcast 
signals to/from your base station that 
anyone within range can intercept. So my thinking is how to secure better 
that added point of vulnerability (by using 
better forms of packet encryption between wifi card and base station/router).

What would be your solution? Should we just admit that, since our traffic 
could be sniffed anywhere along the way to 
its destination or back, regardless of whether it's a wired or wireless 
connection, making the radio transmission part 
of the equation more secure is unimportant?

James