Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.sys.mac.system > #69610 > unrolled thread

Apple Time Capsule -- Unknown User

Back to article view | Back to comp.sys.mac.system

Contents

  Apple Time Capsule -- Unknown User TaliesinSoft <taliesinsoft@me.com> - 2015-02-08 21:47 -0600
    Re: Apple Time Capsule -- Unknown User Don Bruder <dakidd@sonic.net> - 2015-02-08 20:37 -0800
    Re: Apple Time Capsule -- Unknown User Michelle Steiner <michelle@michelle.org> - 2015-02-08 21:37 -0700
    Re: Apple Time Capsule -- Unknown User Tom Stiller <clusterfux.upmon@gmail.com> - 2015-02-09 14:05 +0000
      Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-09 09:19 -0500
      Re: Apple Time Capsule -- Unknown User nospam <nospam@nospam.invalid> - 2015-02-09 13:01 -0500
      Re: Apple Time Capsule -- Unknown User Paul Sture <nospam@sture.ch> - 2015-02-10 10:55 +0100
        Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-10 14:00 +0000
          Re: Apple Time Capsule -- Unknown User Paul Sture <nospam@sture.ch> - 2015-02-10 20:08 +0100
        Re: Apple Time Capsule -- Unknown User nospam <nospam@nospam.invalid> - 2015-02-10 14:42 -0500
          Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-10 20:03 +0000
            Re: Apple Time Capsule -- Unknown User nospam <nospam@nospam.invalid> - 2015-02-10 16:05 -0500
              Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-10 21:17 +0000
                Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-10 19:51 -0500
        Re: Apple Time Capsule -- Unknown User Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-02-10 20:54 +0000
          Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-10 21:18 +0000
            Re: Apple Time Capsule -- Unknown User Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-02-10 22:37 +0000
              Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-11 00:04 +0000
                Re: Apple Time Capsule -- Unknown User Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-02-11 12:37 +0000
                  Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-11 15:07 +0000
                    Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-11 15:16 +0000
                    Re: Apple Time Capsule -- Unknown User Michelle Steiner <michelle@michelle.org> - 2015-02-11 08:32 -0700
                      Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-11 15:53 +0000
                  Re: Apple Time Capsule -- Unknown User Michelle Steiner <michelle@michelle.org> - 2015-02-11 08:24 -0700
                    Re: Apple Time Capsule -- Unknown User Huge <Huge@nowhere.much.invalid> - 2015-02-11 15:27 +0000
                      Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-11 15:53 +0000
                        Re: Apple Time Capsule -- Unknown User nospam <nospam@nospam.invalid> - 2015-02-11 12:22 -0500
                          Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-11 18:00 +0000
                    Re: Apple Time Capsule -- Unknown User Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-02-12 01:51 +0000
                      Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-12 14:11 +0000
                        Re: Apple Time Capsule -- Unknown User Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-02-12 14:52 +0000
                          Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-12 15:11 +0000
                            Re: Apple Time Capsule -- Unknown User Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-02-12 15:38 +0000
                              Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-12 16:03 +0000
                                Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-14 11:00 -0500
                                  Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-14 19:44 +0000
                            Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-14 10:58 -0500
                              Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-14 16:47 +0000
                                Re: Apple Time Capsule -- Unknown User Lewis <g.kreme@gmail.com.dontsendmecopies> - 2015-02-15 01:10 +0000
                                  Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-15 01:39 +0000
                                Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-15 09:24 -0500
                                  Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-15 14:56 +0000
                                    Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-15 11:13 -0500
                                      Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-15 16:53 +0000
                                        Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-15 18:01 -0500
                                          Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-16 01:38 +0000
                                            Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-16 12:04 -0500
    Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-09 09:21 -0500
      Re: Apple Time Capsule -- Unknown User TaliesinSoft <taliesinsoft@me.com> - 2015-02-09 14:05 -0600
        Re: Apple Time Capsule -- Unknown User Alan Browne <alan.browne@FreelunchVideotron.ca> - 2015-02-09 15:32 -0500
        Re: Apple Time Capsule -- Unknown User Jolly Roger <jollyroger@pobox.com> - 2015-02-09 20:58 +0000

Page 2 of 3 — ← Prev page 1 [2] 3  Next page →

#69693

On 2015-02-11, Jolly Roger <jollyroger@pobox.com> wrote:
>
> The absence of proof is not evidence is not evidence of absence.

Bad editing, but you should be able to parse the meaning. Just because
Paul didn't mention other security measures doesn't mean he isn't using
them.  : )

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#69696

In article <ck19ieFpnuqU1@mid.individual.net>, Jolly Roger
<jollyroger@pobox.com> wrote:

> The absence of proof is not evidence is not evidence of absence.

Stutter much?

[toc] | [prev] | [next] | [standalone]

#69700

On 2015-02-11, Michelle Steiner <michelle@michelle.org> wrote:
> In article <ck19ieFpnuqU1@mid.individual.net>, Jolly Roger
><jollyroger@pobox.com> wrote:
>
>> The absence of proof is not evidence is not evidence of absence.
>
> Stutter much?

Speaking, not so much. Writing, on the other hand... : D

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#69694

In article <slrnmdmj97.13ch.g.kreme@kreme.eternal-september.org>, Lewis
<g.kreme@gmail.com.dontsendmecopies> wrote:

> > And what he said is technically true. MAC address white lists *do*
> > prevent devices with MAC addresses that are not on the list from
> > connecting.
> 
> But it is trivial to spoof a MAC address that IS on the list.

But one would first have to know that MAC address.

[toc] | [prev] | [next] | [standalone]

#69695

On 2015-02-11, Michelle Steiner <michelle@michelle.org> wrote:
> In article <slrnmdmj97.13ch.g.kreme@kreme.eternal-september.org>, Lewis
><g.kreme@gmail.com.dontsendmecopies> wrote:
>
>> > And what he said is technically true. MAC address white lists *do*
>> > prevent devices with MAC addresses that are not on the list from
>> > connecting.
>> 
>> But it is trivial to spoof a MAC address that IS on the list.
>
> But one would first have to know that MAC address.

And it is trivial to discover them.


-- 
Today is Boomtime, the 42nd day of Chaos in the YOLD 3181
I don't have an attitude problem.  If you have a problem with my attitude,
                    that's your problem.

[toc] | [prev] | [next] | [standalone]

#69699

On 2015-02-11, Huge <Huge@nowhere.much.invalid> wrote:
> On 2015-02-11, Michelle Steiner <michelle@michelle.org> wrote:
>> In article <slrnmdmj97.13ch.g.kreme@kreme.eternal-september.org>, Lewis
>><g.kreme@gmail.com.dontsendmecopies> wrote:
>>
>>> > And what he said is technically true. MAC address white lists *do*
>>> > prevent devices with MAC addresses that are not on the list from
>>> > connecting.
>>> 
>>> But it is trivial to spoof a MAC address that IS on the list.
>>
>> But one would first have to know that MAC address.
>
> And it is trivial to discover them.

I'm in. How would I discover the MAC addresses in a router MAC address
filter list? Got a link handy?

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#69708

In article <ck1c7hFpnuqU5@mid.individual.net>, Jolly Roger
<jollyroger@pobox.com> wrote:

> >>> > And what he said is technically true. MAC address white lists *do*
> >>> > prevent devices with MAC addresses that are not on the list from
> >>> > connecting.
> >>> 
> >>> But it is trivial to spoof a MAC address that IS on the list.
> >>
> >> But one would first have to know that MAC address.
> >
> > And it is trivial to discover them.
> 
> I'm in. How would I discover the MAC addresses in a router MAC address
> filter list? Got a link handy?

the original claim was to block the offending mac address, so simply
changing it to *anything* else will let them in. change just one digit
and it will work. 

if there is a list of allowed mac addresses (which is a huge pain to
maintain), then all it takes is watching traffic since mac addresses
are always sent unencrypted (they have to be) and then pick one. 

although it's possible that there will be zero devices connected and
therefore no mac addresses to find, that is *extremely* unlikely,
especially these days with mobile devices, set top boxes, thermostats,
etc., that all connect via wifi. in other words, it's pretty much
guaranteed that there will be at least one device to find.

again, mac address filtering stops the casual user which isn't the type
of user to worry about. maybe they just want to check mail or facebook.
not a big deal. 

the people you *do* need to worry about, the ones with ill intent, have
absolutely no problem whatsoever getting past a mac address filter and
once in, can possibly do all sorts of stuff.

[toc] | [prev] | [next] | [standalone]

#69710

On 2015-02-11, nospam <nospam@nospam.invalid> wrote:
> In article <ck1c7hFpnuqU5@mid.individual.net>, Jolly Roger
><jollyroger@pobox.com> wrote:
>
>> >>> > And what he said is technically true. MAC address white lists *do*
>> >>> > prevent devices with MAC addresses that are not on the list from
>> >>> > connecting.
>> >>> 
>> >>> But it is trivial to spoof a MAC address that IS on the list.
>> >>
>> >> But one would first have to know that MAC address.
>> >
>> > And it is trivial to discover them.
>> 
>> I'm in. How would I discover the MAC addresses in a router MAC address
>> filter list? Got a link handy?
>
> the original claim was to block the offending mac address, so simply
> changing it to *anything* else will let them in. change just one digit
> and it will work. 

Actually, the original claim was that there is a *whitelist* of
acceptable MAC addresses, where any device whose MAC address was not
registered would not be able to connect, which is how most routers I
have used work:

On 2015-02-10, Paul Sture <nospam@sture.ch> wrote:
>
> I'm not using an Airport but I whitelist the MAC addresses belonging
> to my devices; any device not registered there cannot connect.
>
> Can an Airport do that?

Honestly, I don't get why you continue to argue about this. It's pretty
silly. 

> if there is a list of allowed mac addresses (which is a huge pain to
> maintain)

It's not a huge pain for those wanting to use it. I've done it in the
past myself. All it takes is knowledge of the MAC addresses of the
devices to be allowed on the network. If you have an Apple access point,
configuration of the whitelist is ultra-simple. I've also done it on
Netgear and others, which are also not all that complicated.

> then all it takes is watching traffic since mac addresses
> are always sent unencrypted (they have to be) and then pick one. 

Casual users don't typically have traffic-watching apps on their phones
or computers though. Casual users also don't typically have the ability
to *change* the MAC address of the device they want to connect. In fact
it's not even possible on most iOS devices, since most are not
jailbroken. Again, it's meant to *augment* rather than replace security
measures, to prevent casual connections from unknown devices.

> although it's possible that there will be zero devices connected and
> therefore no mac addresses to find, that is *extremely* unlikely,
> especially these days with mobile devices, set top boxes, thermostats,
> etc., that all connect via wifi. in other words, it's pretty much
> guaranteed that there will be at least one device to find.

And if an advanced user did go through the trouble of snooping wireless
activity to gather valid MAC addresses, and went through the trouble of
changing their device MAC address to one that matched, they would have
bypassed only the whitelist - not other security protections in place,
such as key-based encryption, which is standard on most routers out
there. Again, as far as I can see nobody here (certainly not me) is
suggesting that one should rely *solely* on MAC address filtering for
security, but rather to augment it.

> again, mac address filtering stops the casual user which isn't the type
> of user to worry about. maybe they just want to check mail or facebook.
> not a big deal. 

Again, what to "worry about" is not for you to decide for everyone else.
If I want to use a MAC address whitelist to prevent unknown MAC
addresses from connecting to augment the security of my router, then
that's a perfectly valid thing for me to do, even if you disagree.

> the people you *do* need to worry about, the ones with ill intent, have
> absolutely no problem whatsoever getting past a mac address filter and
> once in, can possibly do all sorts of stuff.

Not with other standard protections in place, they can't.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#69721

Okay, so one time? In band camp? Michelle Steiner <michelle@michelle.org> was all, like:
> In article <slrnmdmj97.13ch.g.kreme@kreme.eternal-september.org>, Lewis
> <g.kreme@gmail.com.dontsendmecopies> wrote:

>> > And what he said is technically true. MAC address white lists *do*
>> > prevent devices with MAC addresses that are not on the list from
>> > connecting.
>> 
>> But it is trivial to spoof a MAC address that IS on the list.

> But one would first have to know that MAC address.

Nope. You can monitor the wifi stream for a valid MAC address.

-- 
http://2blog.kreme.com

[toc] | [prev] | [next] | [standalone]

#69726

On 2015-02-12, Lewis <g.kreme@gmail.com.dontsendmecopies> wrote:
> Okay, so one time? In band camp? Michelle Steiner <michelle@michelle.org> was all, like:
>> In article <slrnmdmj97.13ch.g.kreme@kreme.eternal-september.org>, Lewis
>> <g.kreme@gmail.com.dontsendmecopies> wrote:
>
>>> > And what he said is technically true. MAC address white lists *do*
>>> > prevent devices with MAC addresses that are not on the list from
>>> > connecting.
>>> 
>>> But it is trivial to spoof a MAC address that IS on the list.
>
>> But one would first have to know that MAC address.
>
> Nope. You can monitor the wifi stream for a valid MAC address.

Yes, if both of these are true:

* you know how
* you have a device that will allow it

But the important point is spoofing a MAC address doesn't nullify other
protections that are in place. MAC address filtering is just an
additional layer on top of better security measures in place. It's there
to prevent *casual* users from connecting unknown devices to the access
point.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#69732

Okay, so one time? In band camp? Jolly Roger <jollyroger@pobox.com> was all, like:
> On 2015-02-12, Lewis <g.kreme@gmail.com.dontsendmecopies> wrote:
>> Okay, so one time? In band camp? Michelle Steiner <michelle@michelle.org> was all, like:
>>> In article <slrnmdmj97.13ch.g.kreme@kreme.eternal-september.org>, Lewis
>>> <g.kreme@gmail.com.dontsendmecopies> wrote:
>>
>>>> > And what he said is technically true. MAC address white lists *do*
>>>> > prevent devices with MAC addresses that are not on the list from
>>>> > connecting.
>>>> 
>>>> But it is trivial to spoof a MAC address that IS on the list.
>>
>>> But one would first have to know that MAC address.
>>
>> Nope. You can monitor the wifi stream for a valid MAC address.

> Yes, if both of these are true:

> * you know how
> * you have a device that will allow it

> But the important point is spoofing a MAC address doesn't nullify other
> protections that are in place. MAC address filtering is just an
> additional layer on top of better security measures in place.

MAC address filtering is not security.

> It's there to prevent *casual* users from connecting unknown devices
> to the access point.

Which is completely pointless if the access point is secure.

If you are using encryption, MAC filtering gains you exactly nothing in
securing your access point. And if you are not using encryption, MAC
filtering gains you exactly nothing in securing your access point.

OK, fine, if you have someone who is totally clueless, cannot use
Google, or only has an iOS device, then MAC address filtering might stop
them connecting, but it will not stop anyone who wants to connect. It's
about as secure as locking your front door with a zip tie. Sure, someone
without a knife or a strong stick might not be able to open your door,
but no one would call that 'locked'.

Encryption will, assuming a decent non-WEP password, actually prevent
*anyone* from connecting who isn't authorized, even those who really
want to connect.

-- 
http://2blog.kreme.com

[toc] | [prev] | [next] | [standalone]

#69734

On 2015-02-12, Lewis <g.kreme@gmail.com.dontsendmecopies> wrote:
> Okay, so one time? In band camp? Jolly Roger <jollyroger@pobox.com> was all, like:
>> On 2015-02-12, Lewis <g.kreme@gmail.com.dontsendmecopies> wrote:
>>> Okay, so one time? In band camp? Michelle Steiner <michelle@michelle.org> was all, like:
>>>> In article <slrnmdmj97.13ch.g.kreme@kreme.eternal-september.org>, Lewis
>>>> <g.kreme@gmail.com.dontsendmecopies> wrote:
>>>
>>>>> > And what he said is technically true. MAC address white lists *do*
>>>>> > prevent devices with MAC addresses that are not on the list from
>>>>> > connecting.
>>>>> 
>>>>> But it is trivial to spoof a MAC address that IS on the list.
>>>
>>>> But one would first have to know that MAC address.
>>>
>>> Nope. You can monitor the wifi stream for a valid MAC address.
>
>> Yes, if both of these are true:
>
>> * you know how
>> * you have a device that will allow it
>
>> But the important point is spoofing a MAC address doesn't nullify other
>> protections that are in place. MAC address filtering is just an
>> additional layer on top of better security measures in place.
>
> MAC address filtering is not security.

My goodness, you guys just can't seem to let this go...

You are arguing semantics, which is not constructive. MAC filtering is
an access control that is often in the "Security" section of a router's
configuration page, as shown in this example:

<http://documentation.netgear.com/fvs336g/enu/202-10257-01/FVS336G_RM-06-16.html>

While most router manufacturers consider it a "security" feature,
Apple's routers call it "access control". But it doesn't matter what you
call it, as long as you know what it does.

>> It's there to prevent *casual* users from connecting unknown devices
>> to the access point.
>
> Which is completely pointless if the access point is secure.

While *you* certainly can consider it "useless" for your own uses, you
don't get to impose your beliefs on the rest of the world. If someone
decides to give their network password to their family living in the
same house, and they also decide that they want to white list the MAC
addresses of known devices in the house so that they can control which
devices can connect without changing that password, that's certainly
their prerogative, and they will almost certainly debate your "useless"
assessment.

> If you are using encryption, MAC filtering gains you exactly nothing
> in securing your access point. And if you are not using encryption,
> MAC filtering gains you exactly nothing in securing your access point.

No, it adds another level of access control (since you seem to have such
a problem using the word "security" in this context) to the system.

> OK, fine, if you have someone who is totally clueless, cannot use
> Google, or only has an iOS device, then MAC address filtering might
> stop them connecting

Then it's not "useless", is it?

> but it will not stop anyone who wants to connect.

That's what key-based encryption is for. And as I'm sure you are aware,
even key-based encryption can be cracked with enough time, know-how, and
determination.

> It's about as secure as locking your front door with a zip tie. Sure,
> someone without a knife or a strong stick might not be able to open
> your door, but no one would call that 'locked'.

Again, I haven't seen a single person here suggest that one should rely
*solely* on MAC address filtering for security - certainly not me. You
and nospam seem to be the only ones acting as if they are somehow
mutually exclusive, which is not the case.

> Encryption will, assuming a decent non-WEP password, actually prevent
> *anyone* from connecting who isn't authorized, even those who really
> want to connect.

Not someone who is really determined and has the know-how. WPA has been
cracked before by those who really want to get in:

<http://www.pcworld.com/article/153396/wifi_hacked.html>

As much as I hate repeating myself: MAC address filtering is there to
prevent casual users from connecting unknown devices, and is meant to
augment key-based encryption security already in place on a router. The
two are not mutually exclusive and can be legitimately used together.
Why you guys continue to argue as if anyone is claiming MAC address
filtering should be used by itself is beyond me, since nobody here has
made such a suggestion TMK. Very strange!

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#69736

Okay, so one time? In band camp? Jolly Roger <jollyroger@pobox.com> was all, like:
> On 2015-02-12, Lewis <g.kreme@gmail.com.dontsendmecopies> wrote:

> You are arguing semantics, which is not constructive. MAC filtering is
> an access control that is often in the "Security" section of a router's
> configuration page, as shown in this example:

It is not semantics to say that MAC address filtering is not security.
Anyone who thinks that MAC address filtering increases security *at all*
is deluding themselves.

>>> It's there to prevent *casual* users from connecting unknown devices
>>> to the access point.
>>
>> Which is completely pointless if the access point is secure.

> While *you* certainly can consider it "useless" for your own uses, you
> don't get to impose your beliefs on the rest of the world.

"Useless" is not a belief, it is a value judgment based on facts. There
is absolutely no security offered by MAC address filtering on a secured
network. None. Zero. Nada. Zilch.

> If someone decides to give their network password to their family
> living in the same house, and they also decide that they want to white
> list the MAC addresses of known devices in the house so that they can
> control which devices can connect without changing that password,
> that's certainly their prerogative, and they will almost certainly
> debate your "useless" assessment.

I am happy to debate how adding MAC address filtering to their LAN will
increase their security.

>> If you are using encryption, MAC filtering gains you exactly nothing
>> in securing your access point. And if you are not using encryption,
>> MAC filtering gains you exactly nothing in securing your access point.

> No, it adds another level of access control (since you seem to have such
> a problem using the word "security" in this context) to the system.

We are talking about security. If you'd like to change the topic, go
ahead.

>> OK, fine, if you have someone who is totally clueless, cannot use
>> Google, or only has an iOS device, then MAC address filtering might
>> stop them connecting

> Then it's not "useless", is it?

As security? Yes, it is.

>> but it will not stop anyone who wants to connect.

> That's what key-based encryption is for. And as I'm sure you are aware,
> even key-based encryption can be cracked with enough time, know-how, and
> determination.

Millions of years for even a 9 character password.

>> It's about as secure as locking your front door with a zip tie. Sure,
>> someone without a knife or a strong stick might not be able to open
>> your door, but no one would call that 'locked'.

> Again, I haven't seen a single person here suggest that one should rely
> *solely* on MAC address filtering for security - certainly not me. You
> and nospam seem to be the only ones acting as if they are somehow
> mutually exclusive, which is not the case.

As I said above:
>> If you are using encryption, MAC filtering gains you exactly nothing
>> in securing your access point.

Nothing. At all. This is not my opinion, it's easily demonstrable fact.

>> Encryption will, assuming a decent non-WEP password, actually prevent
>> *anyone* from connecting who isn't authorized, even those who really
>> want to connect.

> Not someone who is really determined and has the know-how. WPA has been
> cracked before by those who really want to get in:

Which is why we have WPA2.

> As much as I hate repeating myself: MAC address filtering is there to
> prevent casual users from connecting unknown devices

Which implies an unsecured network.

> and is meant to augment key-based encryption security already in place
> on a router.

It doesn't do that.

-- 
http://2blog.kreme.com

[toc] | [prev] | [next] | [standalone]

#69737

On 2015-02-12, Lewis <g.kreme@gmail.com.dontsendmecopies> wrote:
> Okay, so one time? In band camp? Jolly Roger <jollyroger@pobox.com> was all, like:
>
>> While *you* certainly can consider it "useless" for your own uses, you
>> don't get to impose your beliefs on the rest of the world.
>
> "Useless" is not a belief, it is a value judgment based on facts. There
> is absolutely no security offered by MAC address filtering on a secured
> network. None. Zero. Nada. Zilch.

The fact remains that manufacturers overwhelmingly place it in the
"security" section of router configuration pages. Call it whatever you
like, but that's where it shows up, and people tend to think of access
controls as part of security. You are arguing semantics, which is not
at all constructive.

>> If someone decides to give their network password to their family
>> living in the same house, and they also decide that they want to white
>> list the MAC addresses of known devices in the house so that they can
>> control which devices can connect without changing that password,
>> that's certainly their prerogative, and they will almost certainly
>> debate your "useless" assessment.
>
> I am happy to debate how adding MAC address filtering to their LAN will
> increase their security.

You clearly refuse to concede that some people may find MAC address
filtering to be useful, even though you have already admitted it can be
an effective way of blocking unknown devices from connecting to a
network. And you are hell bent on this silly semantic argument about
"security". Talking with you about this is becoming a waste of time. 

>>> If you are using encryption, MAC filtering gains you exactly nothing
>>> in securing your access point. And if you are not using encryption,
>>> MAC filtering gains you exactly nothing in securing your access point.
>
>> No, it adds another level of access control (since you seem to have such
>> a problem using the word "security" in this context) to the system.
>
> We are talking about security. If you'd like to change the topic, go
> ahead.

No, we are talking about "MAC address filtering", because someone asked
whether Apple's access points supported it. You and nospam seem to be
the ones wanting to change the subject to general security.

>> That's what key-based encryption is for. And as I'm sure you are aware,
>> even key-based encryption can be cracked with enough time, know-how, and
>> determination.
>
> Millions of years for even a 9 character password.

Not always - depends on the router and security measures in place:

"Tews and his co-researcher Martin Beck found a way to break the
Temporal Key Integrity Protocol (TKIP) key, used by WPA, in a relatively
short amount of time: 12 to 15 minutes, according to Dragos Ruiu, the
PacSec conference's organizer."

<http://www.pcworld.com/article/153396/wifi_hacked.html>

"In my successful test, Reaver took 2 hours and 30 minutes to crack the
network and deliver me with the correct password."

<http://lifehacker.com/5873407/how-to-crack-a-wi-fi-networks-wpa-password-with-reaver>

And I have little doubt that one day someone will find a way to crack
even the most secure encryption available at the moment. The point is
that while some are stronger than others, anyone who is determined can
bypass a number of access control methods. 

Some people find MAC address filtering to be a useful feature, and those
people will use it, whether you like it or not.

Anyway, we've surpassed the point of usefulness of this conversation, so
I'll go ahead and bow out of this discussion now. Enjoy having the last
word.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#69769

On 2015.02.12 11:03 , Jolly Roger wrote:

> "Tews and his co-researcher Martin Beck found a way to break the
> Temporal Key Integrity Protocol (TKIP) key, used by WPA, in a relatively
> short amount of time: 12 to 15 minutes, according to Dragos Ruiu, the
> PacSec conference's organizer."
>
> <http://www.pcworld.com/article/153396/wifi_hacked.html>

7 year old article.

People should be using WPA2.  Not WPA anymore than WEP or <<shudder>> WPS.


-- 
"Your net worth to the world is usually
  determined by what remains after your
  bad habits are subtracted from your good ones."
                                   Benjamin Franklin

[toc] | [prev] | [next] | [standalone]

#69774

On 2015-02-14, Alan Browne <alan.browne@FreelunchVideotron.ca> wrote:
> On 2015.02.12 11:03 , Jolly Roger wrote:
>
>> "Tews and his co-researcher Martin Beck found a way to break the
>> Temporal Key Integrity Protocol (TKIP) key, used by WPA, in a relatively
>> short amount of time: 12 to 15 minutes, according to Dragos Ruiu, the
>> PacSec conference's organizer."
>>
>> <http://www.pcworld.com/article/153396/wifi_hacked.html>
>
> 7 year old article.
>
> People should be using WPA2.  Not WPA anymore than WEP or <<shudder>> WPS.

The point is determined hackers will find a way.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#69768

On 2015.02.12 10:11 , Jolly Roger wrote:

> Not someone who is really determined and has the know-how. WPA has been
> cracked before by those who really want to get in:
>
> <http://www.pcworld.com/article/153396/wifi_hacked.html>

WPA2 is what people use.  Should be, anyway.  It's no surprise that that 
article is nearly 7 years old.

> As much as I hate repeating myself: MAC address filtering is there to
> prevent casual users from connecting unknown devices, and is meant to
> augment key-based encryption security already in place on a router. The
> two are not mutually exclusive and can be legitimately used together.
> Why you guys continue to argue as if anyone is claiming MAC address
> filtering should be used by itself is beyond me, since nobody here has
> made such a suggestion TMK. Very strange!

I reject the blacklist/whitelist approach for the same reason that SSID 
hiding should (generally) be rejected.

Strong WPA2 passwords.  That's all that's needed.  Keep both the expert 
hackers and the accidental accessers off of the network.

A determined hacker who believes he has even a modicum of a chance at 
brute forcing WPA2 will walk through b/w-listing quickly once he's 
discovered the hidden SSID.  Those two steps are just irritants - sort 
of insulting to him.

That they add to more complexity in managing a WiFi network is just more 
reason to avoid them.  They cost you more (over time) than they cost the 
capable hacker.

But if you get more warm and fuzzy out of b/w-listing and possibly 
hidden SSID's, then go for it - and the added management.

-- 
"Your net worth to the world is usually
  determined by what remains after your
  bad habits are subtracted from your good ones."
                                   Benjamin Franklin

[toc] | [prev] | [next] | [standalone]

#69770

On 2015-02-14, Alan Browne <alan.browne@FreelunchVideotron.ca> wrote:
> On 2015.02.12 10:11 , Jolly Roger wrote:
>
>> Not someone who is really determined and has the know-how. WPA has been
>> cracked before by those who really want to get in:
>>
>> <http://www.pcworld.com/article/153396/wifi_hacked.html>
>
> WPA2 is what people use.  Should be, anyway.  It's no surprise that that 
> article is nearly 7 years old.

The point is eventually it can and probably will be done by someone who
is determined with the right resources. 

>> As much as I hate repeating myself: MAC address filtering is there to
>> prevent casual users from connecting unknown devices, and is meant to
>> augment key-based encryption security already in place on a router. The
>> two are not mutually exclusive and can be legitimately used together.
>> Why you guys continue to argue as if anyone is claiming MAC address
>> filtering should be used by itself is beyond me, since nobody here has
>> made such a suggestion TMK. Very strange!
>
> I reject the blacklist/whitelist approach for the same reason that SSID 
> hiding should (generally) be rejected.

The idea that features you don't happen to appreciate should
automatically be rejected by others seems silly to me.

> Strong WPA2 passwords.  That's all that's needed.  Keep both the expert 
> hackers and the accidental accessers off of the network.

Again, nobody here, as far as I can tell - and certainly not me - has
suggested that one should not use strong encryption keys. And if someone
sees utility in using other features like MAC address filtering, who am
I to say they should not? I gave an example of one potential situation
where a family shares an encryption key, but the parents want to control
which devices can connect, so use the MAC address filtering feature to
do so without having to change and re-distribute the key among family
members. I'm sure others can find other legitimate uses for the feature.
Just because *you* don't appreciate this feature doesn't mean it has
absolutely no value for *others*.

> A determined hacker who believes he has even a modicum of a chance at 
> brute forcing WPA2 will walk through b/w-listing quickly once he's 
> discovered the hidden SSID.  Those two steps are just irritants - sort 
> of insulting to him.

Again, the feature isn't for determined hackers, but for casual users.

> That they add to more complexity in managing a WiFi network is just more 
> reason to avoid them.  They cost you more (over time) than they cost the 
> capable hacker.

According to you, who never uses them. Others can decide for themselves
whether using these features is worth the added complexity, and don't
need you to make that decision for them. 

> But if you get more warm and fuzzy out of b/w-listing and possibly 
> hidden SSID's, then go for it - and the added management.

You seem like you'd rather nobody use them. Make up your mind. : )

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

#69788

Okay, so one time? In band camp? Jolly Roger <jollyroger@pobox.com> was all, like:
> On 2015-02-14, Alan Browne <alan.browne@FreelunchVideotron.ca> wrote:
>> On 2015.02.12 10:11 , Jolly Roger wrote:
>>
>>> Not someone who is really determined and has the know-how. WPA has been
>>> cracked before by those who really want to get in:
>>>
>>> <http://www.pcworld.com/article/153396/wifi_hacked.html>
>>
>> WPA2 is what people use.  Should be, anyway.  It's no surprise that that 
>> article is nearly 7 years old.

> The point is eventually it can and probably will be done by someone who
> is determined with the right resources. 

Maybe. Someday. Possibly. That has nothing to do with MAC filtering.

-- 
http://2blog.kreme.com

[toc] | [prev] | [next] | [standalone]

#69789

On 2015-02-15, Lewis <g.kreme@gmail.com.dontsendmecopies> wrote:
> Okay, so one time? In band camp? Jolly Roger <jollyroger@pobox.com> was all, like:
>> On 2015-02-14, Alan Browne <alan.browne@FreelunchVideotron.ca> wrote:
>>> On 2015.02.12 10:11 , Jolly Roger wrote:
>>>
>>>> Not someone who is really determined and has the know-how. WPA has been
>>>> cracked before by those who really want to get in:
>>>>
>>>> <http://www.pcworld.com/article/153396/wifi_hacked.html>
>>>
>>> WPA2 is what people use.  Should be, anyway.  It's no surprise that that 
>>> article is nearly 7 years old.
>
>> The point is eventually it can and probably will be done by someone who
>> is determined with the right resources. 
>
> Maybe. Someday. Possibly. That has nothing to do with MAC filtering.

I'm not the one who brought it up. In fact, I have stated from the
beginning that MAC filtering and encryption are not mutually exclusive.

-- 
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[toc] | [prev] | [next] | [standalone]

Page 2 of 3 — ← Prev page 1 [2] 3  Next page →

Back to top | Article view | comp.sys.mac.system

csiph-web