[ale] wpa_supplicant on hidden SSIDs

[JD]

On 09/26/2013 01:06 PM, Pete Hardie wrote:
> This is going off on a tangent from the original, but given the current
> state of cracking tools and the wholesale marketing of such to
> non-tech-savvy end users, would 'security through obscurity' still be a bad
> policy? - if the script kiddies are using "store-bought" cracking suites
> that do not check for hidden SSIDs, etc, but just grab the low-hanging
> fruit of visible SSIDs, hiding might be better now that is used to be, when
> the crackers were also hackers
> 

I'd be shocked if any wifi security tool did not locate non-broadcasting
SSIDs. Shocked, I say.

Security through non-obscurity IS bad policy.  This is radio. It broadcasts.
**Anyone** interested can listen.  The SSID is available, just not inside a
"broadcast packet". It isn't encrypted.

Only unbreakable encryption helps, assuming there aren't mistakes ... like
WPS, WEP, WPA w/ short passphrases.  Unbreakable for certain values only.

MAC filtering is another nearly useless idea.  Anyone who is hacking will
spoof their MAC to match an existing MAC on the Wifi.  MAC filtering is like
locking a convertable car with the top down, nothing more, IMHO.

Use a long passphrase, unguessable and be happy.  If you want real security,
use a key-based RADIUS server and VPN.

It is all about trade-offs. Convenience and security. Only you can choose the
right mix for your needs.