WiFi security issues? Newbie ? for W7

On Dec 20, 5:13*am, Steel ""Fake99XX1199999fake\"@(Big)
(Steel)theXfactor.com" wrote:
On 12/19/2010 8:28 PM, RayLopez99 wrote:

On Dec 19, 5:27 pm, Steel""Fake99XX1199999fake\"@(Big)
(Steel)theXfactor.com" *wrote:

In the public domain, you only want to go to sites that are using HTTPS
or your machine has a VPN connection to the site both use encryption, if
credentials are needed to login to the site.

How would you know if it's HTTPS? *Does a little padlock icon show up,
like in Firefox? *Also do most airports and Starbucks, in your
experience, have VPN and/or HTTPS?

Do you mean to tell me that you have never been to a Website that is
using HTTPS:\\ in the URL? If you have been to a bank site or any other
site that is using HTTPS as a secure connection, like a site you
purchase things with a credit card, you are going to clearly see the
HTTPS:\\ as part of the URL in the browser's address line.

OK, as I thought: the little padlock.


As for the VPN, the link below should explain it. You also have ISP(s)
that have VPN as part of their customer package, which you can do a VPN
over wireless in a public hotspot to get protected email and other
things provided by a VPN enabled ISP.

http://www.plathome.com/products/pac...html/10-12.htm

I see. I have signed up for Steganos VPN (1 year license $99, kind of
expensive, now expired for me) and I will do so again (unless you can
direct me to a free version) for when using this laptop in a public
hotspot. Thanks for the tip.


Do you think the bigger (longer) the encryption key, the slower the
connection? *Classic communications theory predicts that, but I'm
curious if anybody has seen it in practice. *Maybe it's only 10% so
people don't really notice.

I have not paid any attention to it, because wireless is slower than a
wire connection, a given to be expected when using wireless. I have not
seen any download speed degradation in using the Droid as a hotspot and
doing downloads to the laptop

I also use the Droid smartphone about 99.9%, which can do everything the
laptop can do in a personal usage situation while I am traveling, *from
doing MS Office documents to going into HTTPS sessions over wireless
with the HTTPS showing in the smartphone browser's address line, doing
Usenet, *email with my ISP and Gmail too -- all of it. All that I was
doing on the laptop, I do with the smartphone.

Interesting. Do you think Droid or Windows 7 is more compatible for
international travel? Kind of like a US carrier (good only for the
US) vs AT&T (which has the best international coverage)? I travel a
lot internationally, and though I swap the SIM card on my mobile phone
eventually, I always carry the AT&T cell phone since in almost every
country it will work at the airport (but expensive). Same for Droid
vs W7 smartphones?

RL

On 12/20/2010 6:05 AM, RayLopez99 wrote:
On Dec 20, 5:13 am, Steel""Fake99XX1199999fake\"@(Big)
(Steel)theXfactor.com" wrote:
On 12/19/2010 8:28 PM, RayLopez99 wrote:

On Dec 19, 5:27 pm, Steel""Fake99XX1199999fake\"@(Big)
(Steel)theXfactor.com" wrote:

In the public domain, you only want to go to sites that are using HTTPS
or your machine has a VPN connection to the site both use encryption, if
credentials are needed to login to the site.

How would you know if it's HTTPS? Does a little padlock icon show up,
like in Firefox? Also do most airports and Starbucks, in your
experience, have VPN and/or HTTPS?

Do you mean to tell me that you have never been to a Website that is
using HTTPS:\\ in the URL? If you have been to a bank site or any other
site that is using HTTPS as a secure connection, like a site you
purchase things with a credit card, you are going to clearly see the
HTTPS:\\ as part of the URL in the browser's address line.

OK, as I thought: the little padlock.

You can be in a HTTPS session with a C#.NET Windows desktop solution
that is consuming HTTPS Web service, as an example, based on the URL
with HTTPS in the app.config.


As for the VPN, the link below should explain it. You also have ISP(s)
that have VPN as part of their customer package, which you can do a VPN
over wireless in a public hotspot to get protected email and other
things provided by a VPN enabled ISP.

http://www.plathome.com/products/pac...html/10-12.htm

I see. I have signed up for Steganos VPN (1 year license $99, kind of
expensive, now expired for me) and I will do so again (unless you can
direct me to a free version) for when using this laptop in a public
hotspot. Thanks for the tip.

I couldn't tell you if an ISP is free with a VPN. I suspect the VPN
service will not be free.



Do you think the bigger (longer) the encryption key, the slower the
connection? Classic communications theory predicts that, but I'm
curious if anybody has seen it in practice. Maybe it's only 10% so
people don't really notice.

I have not paid any attention to it, because wireless is slower than a
wire connection, a given to be expected when using wireless. I have not
seen any download speed degradation in using the Droid as a hotspot and
doing downloads to the laptop

I also use the Droid smartphone about 99.9%, which can do everything the
laptop can do in a personal usage situation while I am traveling, from
doing MS Office documents to going into HTTPS sessions over wireless
with the HTTPS showing in the smartphone browser's address line, doing
Usenet, email with my ISP and Gmail too -- all of it. All that I was
doing on the laptop, I do with the smartphone.

Interesting. Do you think Droid or Windows 7 is more compatible for
international travel? Kind of like a US carrier (good only for the
US) vs AT&T (which has the best international coverage)? I travel a
lot internationally, and though I swap the SIM card on my mobile phone
eventually, I always carry the AT&T cell phone since in almost every
country it will work at the airport (but expensive). Same for Droid
vs W7 smartphones?


If you are talking about AT&T having international coverage, it has a
Windows 7 phone. I don't know if Win 7 phone has WIFI hotspot like the
Droid Incredible and later Droid phones have as a feature. I am sure
AT&T has Droid phones too. I am also sure the Win 7 phone will do WIFI
hotspot at some point, if Win 7 phone doesn't already have it.
'
I can only tell you about the US experience. I was using Cricket's
wireless with a USB WIFI card dedicated to Cricket's WIFI for the
laptop. I was in a no coverage area, but I was able to connect the
laptop to the Droid's WIFI hotspot and use the WIFI with the laptop.
Needless to say, I have not used Cricket from that point, which was
costing $40 a month. I just applied $20 to Verizon's Internet coverage
through the Droid hotspot now.

I guess you're going to have to do your homework on what type of
smartphone to get and what the phone provider has for coverage and other
features. Verizon has international roaming too. More and more sites are
becoming smartphone friendly or you can contact a site about it becoming
smartphone friendly. I think you'll find that sites are making the move
to become smartphone friendly, because they cannot ignore it.

On 12/19/2010 8:25 PM, RayLopez99 wrote:
On Dec 19, 3:28 pm, wrote:
On 12/19/2010 5:38 AM, RayLopez99 wrote:
You will set up your wireless router by connecting it to your PC with an
ethernet cable (temporarily). You enter the router setup by following
the instructions in your manual. For linksys you open a web browser and
type the addresshttp://192.168.1.1and Go.

The router setup is where you name your network and setup your wireless
security.

Password:
"Linksys" or "Netgear" are not the passwords you should concern yourself
with. They are the default names of your wireless network. You should
change the name of your network to something less identifiable.
Something like 7X5gT0, not something like "Apt 322" or "Joe's House".
Your new router will allow you to enter the setup by using the User Name
"admin" and a blank password. After entering the setup and making sure
your wireless network is working you should change these. Normal User
Name and Password rules work here like any website.
The point is you do not want your neighbor to see "Joe's House" as a
possible connection and then just log in to your router setup using
linksys and no password. Unbelievably, this is the way a lot of wireless
routers are set up.

OK, so apparently a human recognizable network name is a sign of
unsophistication and invites hackers. Got it.



Wireless Security:
The wireless security type you use must be capable in your wireless
devices. Only very old devices can't handle advanced security encryption.
The security types you can choose from are WEP, WPA, and WPA-2. WEP is
antiquated and useless. WPA is good and WPA-2 is better.
Here is where you will be asked to come up with an Encyption Key. This
is the "password" that is important. Linksys automatically generates a
20+ character key. The longer the key, the better the security.
This key is what you will need to get your PC and any other wireless
device to use the wireless connection.

Question: the longer the key the better the security, but I think
(from my experience) the longer the key the slower the connection too,
right? Maybe not radically slower, but it should be slower with a
bigger key. Please confirm.



In Windows
You will see a wireless connection named 7X5gT0 in your Network. You
click on it and there will be a "Connect" button. Click that and it will
connect to the router and up will pop the "Password" screen. Here you
type in that 20+ character Encryption Key to be able to use the wireless
network. Somewhere in here Windows will ask if this is a Home or Public
Network. A home network is treated as a private (secure) network by
Windows. A Public network is treated as an open, unsecured network
connection.

Question: why would anybody use a public network then, such as
Starbucks? Why do people do this? They don't care if people read
their email, is that it? Or does Starbucks always have HTTPS?


When you installed and set up Windows the OS asked if your PC was part
of a Home or Public Network. You may need to change that in Network&
Sharing Center.

Hope that helps.

Yes it does, thanks.

RL


Hey Ray
My understanding is that the actual encryption of the data is performed
by an algorithm built into the security protocol and is randomly
generated. The "Encryption Code" I mentioned is technically the
"Pre-Shared Key (PSK)". And the PSK is simply a "password". So the
length of the key is for security in a password sense and has no direct
effect on the actual encrytion algorithm.
Sorry for the confusion.

Wireless networks are inherently insecure. You are broadcasting your
data like a radio station. That is the trade off we make for the ease
and convenience of wireless.
Fortunately, it takes effort to actually hack into someones wireless
network, so the current security measures we have are effective in a
real world sense. Only a tiny percentage of the population has the
know-how, and you have to have something they want for them to go
through the trouble. The biggest issue, by far, is people "free riding"
on your internet connection. Not master criminals trying to steal your
stuff.
A little common sense goes a long way when using wireless, or computers
in general. If you work for the US State Department maybe you want to be
more careful. But if you are Joe-Shmoe no one cares - really!

Wireless security we have today is like having locks on your doors. Do
these provide security? Yes they Do. Do they provide complete
protection? Of course not! But you probably don't need to live in a
concrete bunker given the probability of the risks.

Per TVeblen:
Only a tiny percentage of the population has the
know-how, and you have to have something they want for them to go
through the trouble. The biggest issue, by far, is people "free riding"
on your internet connection. Not master criminals trying to steal your
stuff.
A little common sense goes a long way when using wireless, or computers
in general. If you work for the US State Department maybe you want to be
more careful. But if you are Joe-Shmoe no one cares - really!

Given that, could somebody list a dumbed-down version of the
real-world hazards associated with just leaving a home WAP
"Public" - i.e. with no password needed.

Seems like that would be the case with a lot of small restaurants
and other businesses where they don't subscribe to one of the
commercial "Free WiFi" services.
--
PeteCresswell

On 12/20/2010 9:00 AM, (PeteCresswell) wrote:
Per TVeblen:
Only a tiny percentage of the population has the
know-how, and you have to have something they want for them to go
through the trouble. The biggest issue, by far, is people "free riding"
on your internet connection. Not master criminals trying to steal your
stuff.
A little common sense goes a long way when using wireless, or computers
in general. If you work for the US State Department maybe you want to be
more careful. But if you are Joe-Shmoe no one cares - really!

Given that, could somebody list a dumbed-down version of the
real-world hazards associated with just leaving a home WAP
"Public" - i.e. with no password needed.

Seems like that would be the case with a lot of small restaurants
and other businesses where they don't subscribe to one of the
commercial "Free WiFi" services.

For me, it depends on who lives around me. If I know I've got teen-aged,
tech capable, geeks living next door then I don't want to give her a new
hobby!

On Dec 20, 3:02*pm, Steel ""Fake99XX1199999fake\"@(Big)
(Steel)theXfactor.com" wrote:


As for the VPN, the link below should explain it. You also have ISP(s)
that have VPN as part of their customer package, which you can do a VPN
over wireless in a public hotspot to get protected email and other
things provided by a VPN enabled ISP.

http://www.plathome.com/products/pac...html/10-12.htm

I see. *I have signed up for Steganos VPN (1 year license $99, kind of
expensive, now expired for me) and I will do so again (unless you can
direct me to a free version) for when using this laptop in a public
hotspot. *Thanks for the tip.

I couldn't tell you if an ISP is free with a VPN. I suspect the VPN
service will not be free.

Thanks. I found the right VPN services to use, it is this one, not
Steganos, see he


http://bestvpnreviews.com/top-3-vpn-...l-basic-review

VPN4All Basic Review is best overall, works even in China!

HideMyAss Pro VPN Review http://bestvpnreviews.com/category/vpn-reviews
is second best

RL

On Sun, 19 Dec 2010 02:38:52 -0800 (PST), RayLopez99
wrote:


3) What if, assuming I get wireless for the home (like I say right now
I got everything at home wired, but I might switch to wireless now
that I got this new laptop), you find that a neighbor is sharing your
wireless connection? I hear this is possible, but does that person
need a password?

I got a laptop from Ebay about 3 years ago. I should have started
shopping earlier, and had to buy what was available, and it arrived
only 3 days before i was to leave on a long trip to Asia.

It came with 3 methods of internet, a port that accepted a phone cord,
a PC port (PCMCIA) that accepted the included Network Jack card and
the included wireless card. One of them required installing software,
so I was doing that. I didn't have DSL yet, so I was going to have to
use a flashdrive to transport files from my desk computer to the
laptop.

Half way through doing that, I noticed that my laptop was dl'ing my
email and my newsgroups! It turned out I was using one of my
neighbors' broadband/wireless. It's a good thing, too, because it
saved me a lot of time I needed for packing, etc.

When I got back two months later, there was a password on her account.

AIUI, I didn't cost her anything. I didn't even slow her down.

I've run my network without encryption or a password for some of the
time since, and so far, I'm the only MM2005 listed in the phone book.
So I guess no one has stolen my identity yet.

I think they do. If I give them a password, will
they be able to read my files on my hard drive, or just be able to
share my internet connection?

I thought files, directories, and printers had to be checked as Shared
before even you can read those files or use the printer on your own
network, and you have to have the password too. So as long as I
don't put any files in my one Shared directory, I thought I was safe.
Yes?

Is that correct?

I don't mind the latter, unless they
are a download hog, but I mind the former.

On Mon, 20 Dec 2010 09:00:53 -0500, "(PeteCresswell)"
wrote:
Per TVeblen:
Only a tiny percentage of the population has the
know-how, and you have to have something they want for them to go
through the trouble. The biggest issue, by far, is people "free
riding"
on your internet connection. Not master criminals trying to steal
your
stuff.
A little common sense goes a long way when using wireless, or
computers
in general. If you work for the US State Department maybe you want
to be
more careful. But if you are Joe-Shmoe no one cares - really!


Given that, could somebody list a dumbed-down version of the
real-world hazards associated with just leaving a home WAP
"Public" - i.e. with no password needed.


Seems like that would be the case with a lot of small restaurants
and other businesses where they don't subscribe to one of the
commercial "Free WiFi" services.

http://cybercoyote.org/classes/wifi/hotspots.shtml

http://hubpages.com/hub/IdentityTheftWirelessNetwork

You do have what they want, and if they can get it, you got some
trouble. You got more trouble than you need. So why leave the door
open, even Joe Shome?

--
posted with a Droid

On 20/12/2010 9:00 AM, (PeteCresswell) wrote:
[...]
Given that, could somebody list a dumbed-down version of the
real-world hazards associated with just leaving a home WAP
"Public" - i.e. with no password needed.

The real world hazard is that someone else could gain access to your
machine without your knowledge. Given such access, it's possible to
install stealthware on your computer in a few seconds, and to copy any
data on your machine.

Seems like that would be the case with a lot of small restaurants
and other businesses where they don't subscribe to one of the
commercial "Free WiFi" services.

Public wi-fi, protected or not, is open in the sense that anyone
connected to one could see and attack any other connected machine. If
you must use public hot spots, make sure you have shields up, so that
any evil stuff is blocked by your machine. It won't be blocked by the
network. Also, enable encryption, to protect your data.

Bottom line: protect your wi-fi network with a password, and keep your
shields up, and encrypt the data.

BTW, my ISP's wi-fi router/modem is protected by default. You can't set
up an open network with it. Very sensible.

HTH
Wolf K.

On 20/12/10 15:46, mm wrote:
On Sun, 19 Dec 2010 02:38:52 -0800 (PST), RayLopez99
wrote:


3) What if, assuming I get wireless for the home (like I say right now
I got everything at home wired, but I might switch to wireless now
that I got this new laptop), you find that a neighbor is sharing your
wireless connection? I hear this is possible, but does that person
need a password?

I got a laptop from Ebay about 3 years ago. I should have started
shopping earlier, and had to buy what was available, and it arrived
only 3 days before i was to leave on a long trip to Asia.

It came with 3 methods of internet, a port that accepted a phone cord,
a PC port (PCMCIA) that accepted the included Network Jack card and
the included wireless card. One of them required installing software,
so I was doing that. I didn't have DSL yet, so I was going to have to
use a flashdrive to transport files from my desk computer to the
laptop.

Half way through doing that, I noticed that my laptop was dl'ing my
email and my newsgroups! It turned out I was using one of my
neighbors' broadband/wireless. It's a good thing, too, because it
saved me a lot of time I needed for packing, etc.

When I got back two months later, there was a password on her account.

AIUI, I didn't cost her anything. I didn't even slow her down.

I've run my network without encryption or a password for some of the
time since, and so far, I'm the only MM2005 listed in the phone book.
So I guess no one has stolen my identity yet.

I think they do. If I give them a password, will
they be able to read my files on my hard drive, or just be able to
share my internet connection?

I thought files, directories, and printers had to be checked as Shared
before even you can read those files or use the printer on your own
network, and you have to have the password too. So as long as I
don't put any files in my one Shared directory, I thought I was safe.
Yes?

Is that correct?


I'm assuming you are using Windows.

/Everything/ is shared by default - you have to specifically disable the
file sharing service to stop it. In particular, there are a number of
"default shares" that are (AFAIK) always enabled in windows unless the
whole file sharing service is disabled - you don't need to explicitly
share them. For every drive, there is a share named "c$", "d$", etc.,
that is available to any user with Administrator privileges. These
default shares are hidden, in the sense that they don't show up in
normal network browsing or "net view \\computer", but you can connect to
them easily enough.

You may /think/ that you haven't shared your files, but if I can see
your computer on a network (and wireless networks are easily cracked -
WPA in seconds, WPA2 takes several minutes) I can type "net use x:
\\computer\c$ /user:Administrator" and try to guess your password.
Using Linux rather than Windows makes such an attack easier to automate,
but it can be done with Windows too.

Obviously enabling the windows firewall will make such a simple attack
very much harder - but certainly not impossible.