[Full-Disclosure] Wireless ISPs

[Scott Taylor]

On Tue, 2004-05-11 at 13:46, D B wrote:
> They claim the internet is insecure anyway so they
> wont use it.
<much else deleted>

I do a great deal of wardriving in order to map out my coverage area. In
doing this, I happen to get a lot of data captured. And a pretty good
portion of the WEP-protected networks happen to get cracked by wepattack
in under a minute. I don't even go back to see if I can snoop more of
their data, but just having this huge list of networks of people that
have a false sense of security because they turned on WEP is a great
motivational device to get people to think about how they send data.
Sure static WEP stops the super casual wardrivers, but it doesn't take
much effort on my part to get these keys. On my own server, TLS and SSL
are options for smtp and pop3. Customers who do not bother with the 2
seconds it takes to check "encrypt when possible" have been warned and
deserve to have their email captured. I have no sympathy. Any network
admin at an isp your data crosses can capture your wired data and any
kid with a laptop can capture data flying thru the air. Period. Deal
with it. Thats why I use ssh, ssl, and tls for anything important.
Encryption tools are free. Use them.


--
Scott Taylor - <security at 303underground.com> 

Langsam's Laws:
	(1) Everything depends.
	(2) Nothing is always.
	(3) Everything is sometimes.