TheShadow wrote on Mar 15^th, 2009 at 12:34pm:

So the state of wireless security is this:

WEP is about as useful as a padlock on the door of a nuclear missile warehouse.  It keeps honest Joe from getting on your network but it doesn't stop anybody who who is willing to put in the least amount of effort. It takes about 2 seconds to crack WEP with the right tools.  These tools are freely available online from "security research" sites and not difficult to find.  Some of them can even be run off a mobile phone.

WPA2 with a weak pass-phrase is better than WEP, but just barely.  We are talking less than a minute to crack with the same tools.

WPA2 with a strong pass-phrase and TKIP is difficult to crack.  A successful crack takes about an hour, 4 Nvidia graphics cards, and a special program.  Without the special equipment, a crack currently would take a few years.  This security may not last long - security researchers are working on "improving their technique" for cracking WPA2.  With computing power increasing constantly, it won't take long for the "time to crack" to drop to something reasonable.

So, with WPA2/TKIP and a strong pass-phrase, you are safe unless someone is determined to get into  your specific network (which would be unlikely for a home user.)  Any less security than that is a mere speed-bump on the way in for most intruders.

The problem is that most people use WEP and think they are safe.  A good chunk of people still don't use any security at all.

And, like I said earlier, once someone gets onto your internal network, especially a wireless one, they can easily own the entire network.

Brian, have you followed any of Steve Gibson's weekly "Security Now" netcasts?  Not that I can always follow it all, but he goes into a lot of detail about stuff like this.

He's covered this question in episodes 33, 92, and 170.  Download his show transcripts (available at www.grc.com/securitynow) and do a search for "tkip" to get to the sections where he discusses it.

The gist of his opinion is that TKIP is very strong (and good enough for all but the most sensitive security purposes), while AES is stronger but more compute-intensive (so there's a tradeoff because you technically get a slower connection).

(He also corrects listeners that they're not exactly apples to oranges--TKIP is a protocol while AES is an encryption cipher... though I'm foggy on what difference that makes to the end result.)

Brian wrote on Mar 16^th, 2009 at 6:27pm:

They are different things, not replacements for each other.  TKIP is Temporal Key Integrity Protocol.  TKIP is a way of selecting, managing, and updating the keys that are used for encryption in a way that is not predictable by an attacker.  This protects the key to your encryption.

AES is the Advanced Encryption Standard.  AES is a method to encrypt data in a way that someone else who has the key can decrypt it, but it is difficult (preferably impossible) to decrypt without the key.  I think a cipher is an appropriate term, but don't quote me on that.  Other ciphers used for digital data are RSA and DSA.  There is a lot of debate, but AES is considered to be one of the best encryption methods available today.  

So the answer is that you want both.  

Dan Goodell wrote on Mar 16^th, 2009 at 7:57pm:

I used to listen to "Security Now."  Steve does a good job covering some complicated topics and making it easy enough to understand that a lot of people can follow most of it.  I take what he says with a grain of salt since I've seen him jump to conclusions and cause a lot of panic when it turned out he hadn't done his homework.

Brian wrote on Mar 17^th, 2009 at 12:41pm:

That's a good start.  You definitely want file sharing turned off.  With that on, it wouldn't be difficult for any one in the coffee shop to see your shared files.  In fact, Linux will happily show you ALL the files on a Windows computer that has file sharing turned on - even files that aren't shared.

You also want a firewall turned on.  Of course, that's good practice anytime you are on the Internet, but especially so when on an unsecured wireless network.

Outlook Express doesn't have any unique problems, but email itself is usually unencrypted.  So, any email you download or send on an unencrypted wireless network will be there in clear view of anyone who chooses to sniff the network (which is trivial to do.)  This problem is not unique to email.  HTTP traffic is also unencrypted and freely available to anyone who sniffs the network.  So, if you aren't careful, the guy across the coffee shop from you could easily read every email you read, see every page you see, and follow every IM conversation you are having.

The options are:

1. Don't use an unencrypted (or weakly encrypted) wireless network.  Obviously choosing this option puts a damper on coffee shops, so move on to the next option if that's important to you.  At home, you have more control over the strength of the encryption in use on the network and should accept nothing less than WPA2.

2. Encrypt sensitive data.  HTTPS (as opposed to HTTP) is encrypted with SSL, which is good encryption, so HTTPS pages safe for viewing.  If you access you email through a secured webmail page or an IMAP connection that uses SSL, that is also safe.  Most IM clients now offer some type of encryption plug-in.  "Gaim Encryption" and "Off The Record" are two plug-ins that come to mind.

Note that the difficulty with this method isn't just finding a secure way to send/receive sensitive data, but also deciding *which* data is sensitive.  Do you care if the guy next to you sniffs your latest blog post?  Probably not since the whole point of the post is to be read publicly.  Do you care if they read your IM conversations?  You might not think your conversation would interest anyone else, but think about how much inside information you might pass about your company during a 10 min. IM conversation with a co-worker.

3. Bring your own encryption.  What I do if I need to surf from an unsecured wireless network is open a connection to my home through SSH.  I create a dynamic ssh tunnel, which my browser can then use as a SOCKS proxy.  Basically, traffic is encrypted and sent to my home router.  My home router decrypts it and sends it on its way.  This way, my traffic doesn't pass over the open wireless network unencrypted.  It may sound complicated, but once you do it the first time, it is quick and easy after that.

There are some services you can sign up for that do similar things (and more) if you don't want to proxy it through your house.  Here is a Google search to give you an idea of the products I'm talking about:

http://www.google.com/search?q=anonymous+browsing

I haven't used any of these products and can't recommend any specific one's.  My recommendation would be to build your own, but I know some people just aren't up to it.  Just make sure if you go that route you do a little research and verify the reputation of the product.

Now, I can imagine someone reading this and thinking "But all the people are my coffee shop are good people, and most of them know nothing about computers" or "My neighbors wouldn't bother getting on my network."  Two points on that line of thought:  

First, you are essentially betting your identity and personal information on the fact that these people are 'good' people.  

Second, there are people who's hobby is to go around looking for unsecured or weakly secured wireless networks to play with.  It's called War Driving, and it always surprises me how many people do it and how seriously they take it.  They even set up web sites to share information and tips.  If you have a wireless network, there is a good chance they've already listed it on their site, along with how tough it is to get into:

http://www.wigle.net/gps/gps/GPSDB/onlinemap2/?lat1=33.8137115&long1=-112.384661...

MrMagoo wrote on Mar 16^th, 2009 at 5:50pm:

There is no public internet at the local coffee shop. But there are many 'secured' access points. Sometimes I would like to connect to check things only available via an internet connection. I don't wanna hack anybody's PC .. just 'borrow' some of their connectivity. Doubt they would mind, long as they knew I had no malicious intent.

So .. where be these 'tools'?

PM is cool if you like.

I tried one 'tool'  ~ a year ago. It looked pretty but was worthless far as connecting to anything protected.