I used the forest wifi for the first time today and the first thing I noticed was that it is unencrypted.
Whilst not having a key makes it a lot easier for people to connect, there's one major flaw:
Set your wifi card to "monitor" mode and you can sniff everyone's traffic with alarming ease, including any transmitted usernames/passwords, viewed email on sites like Hotmail, etc.
Encrypting the network would make this a lot more difficult (without a lot of time and computing power).
Now, I doubt it happens at the forest but it has been known for people to sit in areas with public networks (like McDonalds) and sniff traffic, which can then be used to take over accounts.
Being the security conscious person I am, whenever I'm on a public network, all my traffic goes through several encrypted SSH tunnels to make sure no-one is watching me
but your average-Joe user will not be doing this (or even have the faintest clue how to, I suspect).So my questions are:
Do we think that this is a potential threat at Forest?
If so, is it feasible to encrypt the network and make the key available somewhere obvious (paint it on the wall or whatever)?
The encryption need only be WEP, it matters not that the security is pants, as the aim is not to stop anyone connecting, merely to stop people sniffing unencrypted traffic out of thin air.
Best,
M
