Downsides of password free WiFi (vs giving the password to anyone who asks)

[MakeColdplayHistory]

Just a thought...

The landlady at my local is getting a new broadband connection next week, new Wifi router etc. She was talking about the fact that everyone who's had a connection to the old one will need the new details. I don't actually use it as the current service is slow and I have lots of 'free' data on my phone anyway. But this got me wondering whether it would be such a bad idea if she (or someone competent) set it up with no password and a name like 'Free Pub Wifi'. She will give the current password to anyone who asks for it anyway.

Any issues?

[Plug]

Just a thought...

The landlady at my local is getting a new broadband connection next week, new Wifi router etc. She was talking about the fact that everyone who's had a connection to the old one will need the new details. I don't actually use it as the current service is slow and I have lots of 'free' data on my phone anyway. But this got me wondering whether it would be such a bad idea if she (or someone competent) set it up with no password and a name like 'Free Pub Wifi'. She will give the current password to anyone who asks for it anyway.

Any issues?

Set up the WiFi with the SSID and password as before. Everyone who previously had access should log straight in. It’s what I’ve done at home with the last 3 or 4 routers.

Cheers,

Plug

[Nogbad The Bad]

They could just pop a sign up at the bar with the new SSID and password or use the old one.

They also could generate a QR code with the SSID and password on via http://zxing.appspot.com/generator/ if you open the camera app with an iPhone / iPad and point it to the QR code it will automatically join the network.

[JasonM]

Set up the WiFi with the SSID and password as before. Everyone who previously had access should log straight in. It’s what I’ve done at home with the last 3 or 4 routers.

Cheers,

Plug

This was a ‘top tip’ I learned on here a few years ago, with the amount of devices in the house it’s a godsend.

[Phil Lee]

Most routers have the facility to create a guest network that can only access the internet. Use this and not the normal WiFi.

[PhilipK]

A password would provide zero authentication, authorisation or accounting. There are no security or privacy benefits to having one on a public wifi - all is does is make it more difficult for her customers to access that wifi.

Set it up with no password and use something like the name of the pub as the SSID.

[ChromeJob]

Most routers have the facility to create a guest network that can only access the internet. Use this and not the normal WiFi.

This, always this for public. IF not, ensure she turns on
“AP isolation” which protects users from each other.

OR if she wants to do it proper, get a router that supports a free “wifi hotspot” service which can work with or without a password, a sign in page, optional “lease expiration,” optional limits on bandwidth usage, etc. I do this with a dd-WRT equipped router at my HOA’s community pool. Works a treat.

[catch21]

I believe that a “no password” ssid does not encrypt the data between phone and AP, therefore can be easily eavesdropped. The “password” also encrypts the data so has real value. That’s my understanding anyway, and more than happy to be corrected.

[broxie]

Set up the WiFi with the SSID and password as before. Everyone who previously had access should log straight in. It’s what I’ve done at home with the last 3 or 4 routers.

Same here. Had same SSID and password over several system/router changes and also for my mobile hotspot so my devices just connect automatically to the same apparent network.

I use several Cisco WAPs around my house and they give the ability to have more than one SSID. Occasionally I add humorous ones in case neighbours can see the signal. Currently got "Met Police Surveillance Van" as one. Used "TV Licensing Van" in the past as well. Little things I guess ;-)

[senwar]

I remember when you went to the pub for a pint and a chat with your mates.

Anyway - having no password means anyone on the street within range can use it whether they've been in the pub or not

[PhilipK]

Set up the WiFi with the SSID and password as before. Everyone who previously had access should log straight in. It’s what I’ve done at home with the last 3 or 4 routers.

That's sensible and convenient on a private (e.g. home) network, but the password is pointless on a public network (such as in a pub).

I believe that a “no password” ssid does not encrypt the data between phone and AP, therefore can be easily eavesdropped. The “password” also encrypts the data so has real value. That’s my understanding anyway, and more than happy to be corrected.

Nobody who is concerned about security would ever connect to any public network, not least because of the ease of an attacker setting up an "evil twin" which spoofs the legitimate AP. And anyway, any secure applications or web site should be using strong end-to-end encryption so intercepting the traffic between the device and the AP will be of very limited use to an attacker.

From a purely business perspective, the pub should be making it as easy as possible for their customers to access the wifi which they are providing, and putting a password on the service just inconveniences those customers while providing a (spurious) appearance of security - referred to in the security community as "security theatre".

(BTW, fully agree that the public wifi service needs to be kept separate from anything that is internal to the pub, such as tills or their own PCs. Ideally there would be an entirely separate internet connection just for public use, but I appreciate that this may not be financially viable for a small pub).

[PhilipK]

Anyway - having no password means anyone on the street within range can use it whether they've been in the pub or not

Unlikely to be an issue in these days of unlimited data tariffs. And anyway, if there was a password, all anybody in the street has to do is go into the pub, read the password that's written on the blackboard (or, worst case, buy the cheapest possible drink and ask for the password).

[senwar]

Unlikely to be an issue in these days of unlimited data tariffs. And anyway, if there was a password, all anybody in the street has to do is go into the pub, read the password that's written on the blackboard (or, worst case, buy the cheapest possible drink and ask for the password).

Not everyone is on unlimited. Plus, there is still a lot of free wifi pilfering going on.

And at least the worst case sees the pub benefit.

Just wouldn't go with free/no password.

[broxie]

I remember having a Hawking wifi aerial I used to poke out hotel windows to sniff for nearby unsecured wifi networks in the days internet connections were expensive in hotels.

[rfrazier]

That's sensible and convenient on a private (e.g. home) network, but the password is pointless on a public network (such as in a pub).


Nobody who is concerned about security would ever connect to any public network, not least because of the ease of an attacker setting up an "evil twin" which spoofs the legitimate AP. And anyway, any secure applications or web site should be using strong end-to-end encryption so intercepting the traffic between the device and the AP will be of very limited use to an attacker.

From a purely business perspective, the pub should be making it as easy as possible for their customers to access the wifi which they are providing, and putting a password on the service just inconveniences those customers while providing a (spurious) appearance of security - referred to in the security community as "security theatre".

(BTW, fully agree that the public wifi service needs to be kept separate from anything that is internal to the pub, such as tills or their own PCs. Ideally there would be an entirely separate internet connection just for public use, but I appreciate that this may not be financially viable for a small pub).

I'm disinclined to access public wifi networks, worrying about things like man-in-the-middle attacks. If I were to use such a network, I would try really hard to refrain from performing any money related activities when using it, or connecting to any site where I want the password protected.

At home, I have a guest network for the use of people doing any work (tea/coffee, biscuits and wifi). If I were running a business, I wouldn't allow all and sundry on a network on which I rely financially (servers, tills, etc.).

Best wishes,
Bob

[MakeColdplayHistory]

As far as I know, none of the pub relies on the Wifi with the possible exception of the jukebox that may get updates every now and again (I think it's caught up with the mid 90's by now judging by the music played). The till (singluar) is a standalone thing and the card machine is GPRS (and sometimes requires payee to stand by the window to work).

I'll let her know that, from a security point of view, there's little difference between having no password and giving the password to anyone who asks for it but that she has the option to set the SSID and password to the current values - I should have thought of that myself (and will probably get the task of doing it if that's what she wants to do).

People outside the pub using it wouldn't be a huge problem as it would be pretty obvious if anyone is just hanging around outside.

[ChromeJob]

I'll let her know that, from a security point of view, there's little difference between having no password and giving the password to anyone who asks for it…

Not true. Setting WP2 security encrypts the communications.