Posted December 16, 2014
As an outsider, and thus wont to have a skewed viewpoint, the overall impression I get is that the US health service overmedicates its users. Everybody seems to be on drugs most of the time. To the point that soon I expect to see breakfast cereals with marshmallows AND prozac.
I have little trust towards a trade that evolved mainly by: "Take two of these, and if you're still alive tomorrow, we'll try to figure out why."
j0ekerr: Considering both encryptions, am I right assuming that only the most paranoid would be worried about personal account data being stolen through a wi-fi sniffer? 
OneFiercePuppy: SSH takes a few hours to break in a best-case scenario for the attacker. But the realistic worst-case scenario for the attacker is only a few days, because the people paranoid enough to use really good passphrases are outliers.
WPA doesn't fold like WEP in a matter of seconds, but most users are susceptible to a rainbow table of some sort. If you think adding a number here or there in place of a letter makes your password s00p3r 53curE, then you don't know enough about entropy just yet.
In general, if you are banking online, your credentials will not be stolen by cracking open a tunnel and then brute forcing some hashy mess. They'll be stolen by hijacking your browser session, probably coming through an add-on or plug-in of some sort. Wireless security is pretty good. It's not the machine that will fail you. You will fail you.
[url= That's a generic "you" up there, not a you "you". I do know a lot more about networking and information security than the average bear; I'm also a bit more paranoid about it. If you genuinely worry about the security of your information, then do these things, in order of easy to hard: avoid wireless networking; take the time to create good passwords and passphrases, and keep them written down somewhere easy for you to get to but hard to associate with your online identity; use anonymized routing; use stateless virtual machines for high-risk information.][/url] Interesting, now I also need to look up rainbow table.
By hijacking your browser, I'm assuming you mean some sort of hidden add-on or java worm that will phone home your stored passwords?
As for password entropy this was illuminating. Which makes it even more painful when some sites limit password length.
So the overall conclusion is: it's not really worth the cracker, the effort it takes to crack a wifi security, when it's much easier to simply infect the user's browser?
I have little trust towards a trade that evolved mainly by: "Take two of these, and if you're still alive tomorrow, we'll try to figure out why."
WPA doesn't fold like WEP in a matter of seconds, but most users are susceptible to a rainbow table of some sort. If you think adding a number here or there in place of a letter makes your password s00p3r 53curE, then you don't know enough about entropy just yet.
In general, if you are banking online, your credentials will not be stolen by cracking open a tunnel and then brute forcing some hashy mess. They'll be stolen by hijacking your browser session, probably coming through an add-on or plug-in of some sort. Wireless security is pretty good. It's not the machine that will fail you. You will fail you.
[url= That's a generic "you" up there, not a you "you". I do know a lot more about networking and information security than the average bear; I'm also a bit more paranoid about it. If you genuinely worry about the security of your information, then do these things, in order of easy to hard: avoid wireless networking; take the time to create good passwords and passphrases, and keep them written down somewhere easy for you to get to but hard to associate with your online identity; use anonymized routing; use stateless virtual machines for high-risk information.][/url]
By hijacking your browser, I'm assuming you mean some sort of hidden add-on or java worm that will phone home your stored passwords?
As for password entropy this was illuminating. Which makes it even more painful when some sites limit password length.
So the overall conclusion is: it's not really worth the cracker, the effort it takes to crack a wifi security, when it's much easier to simply infect the user's browser?
Post edited December 16, 2014 by j0ekerr
