Freaknomics and Bruce Schneier -- the interview
Security ninja Bruce Schneier just concluded a group interview with the readers of the Freaknomics blog, who suggested a long list of smart, wide-ranging questions for him. Schneier's theory of security involves a lot of economics -- the economics of theft that make it worth a crook's thief to target you, the economics of prevention that make it worth your bank's while to adequately protect you. It's classic Freakonomics stuff.
Q: Is there any benefit to password protecting your home Wifi network? I have IT friends that say the only real benefit is that multiple users can slow down the connection, but they state that there is no security reason. Is this correct?Link (via /.)A: I run an open wireless network at home. There's no password, and there's no encryption. Honestly, I think it's just polite. Why should I care if someone on the block steals wireless access from me? When my wireless router broke last month, I used a neighbor's access until I replaced it.
the latest
latest episodes
I have used Wi-Fi connections at home since 2001. Sometimes I secured them,but as I have moved around a little I have left them unsecured as I forget the encryption codes I end up resetting them. However when I set up networks for business i do encryptthem where peoples personal information is at risk. on my home PC windows firewall and other spyware keep me protected so im not worried and I do little to have my personal information exposed as i do not put this on my computer anyways!
Clearly Bruce doesn't pay per Gig for data :-) Try that here in SA and you'd be bankrupt within 5 minutes!
I'm more concerned about someone using my Internet connection for bad stuff than about someone stealing my data. Suppose the guy next door is a spammer? Wouldn't be much fun trying to explain to your ISP how those ten million spam e-mails got sent through your hookup, would it?
And if you can explain that one, how about a bunch of kiddie porn downloads? Or a death threat sent to a public official?
Nope, too much chance of winding up in trouble for something somebody else did for my taste. I'll keep mine secured, thanks anyway.
I completely agree with joe mommasan's comment. I am way more concerned with someone who is up to no good than bandwidth problems. If I were going to get up to shenanigans online, I would do it that way.
I used to work for an ISP, and if we got reports of copyright infringement coming from your IP address (usually reported through our abuse channels), we had to shut the connection off after three reports. This was company policy.
Granted, you can always switch ISP's. But if the next one won't even allow any kind of file sharing- getting to be more and more common, see COmcast's completel blocking of it through their routers- you have just allowed your own ISP connection to be compromised due to the stupidity of allowing unauthorized access to your wireless.
And it happens, believe me, I worked enough of those issues. Clueless customer with unsecured network + Clueless downloader in the neighborhood sharing bandwith = No network connection after detection.
Secure with a password, and do what we do in my neighborhood- tell your closest neighbor the password so they can use it if their own goes down. It's the best thing to do.
With an open WiFi network, aren't you exposing your PC to any neighbor who might want to portscan it? Why rely only on your PC's security protections?
Boy is it nice to see *no* people screaming about stealing things in a discussion of open WiFi! The solution really is quite simple: If you're paranoid of kiddies inviting the feds to your house, secure your WiFi. Your WiFi router comes with instructions, and a support phone number. You can also ask your local 12-year-old on how to do this, or have him/her do it for you.
For those of us in the ubiquitous-computing camp, defaults can be a fabulous way to instantly have working WiFi for you and your visitors.
Remember, the ISPs generally have an acceptable use policy, which may prohibit sharing to your neighbors (especially for profit), so you might want to familiarize yourself with it. Otherwise, the Internet is a much more interesting place when untethered.
(Have you been out wardriving lately? You'd be amazed at how these things are being installed EVERYWHERE. Even in the ghettos.)
Many ISPs service agreements include some sort of limit to how many computers you can use or who you can share the connection with. It is generally not acceptable to them for you to hook up your neighbors and share the cost (it cuts into their market).
Also, legally (as I understand it), the account holder is responsible for whatever happens on the connection. If your open wifi connection is used by some anonymous party to violate someones copyright, you bear the penalty, which could include getting sued.
Generally, the law favors corporations and lawyers, if they say 'here we have logs of your connection being used to violate our copyright' and your defense is 'but I run an open WiFi access point, it wasn't me!', you will lose.
I'm all for copyright reform, but if I'm going to have to pay a judgment or settlement, I at least want to be guilty!
Of course, if you are running a WiFi access point with simple encryption and it gets cracked, and then you get sued, well, you're probably still screwed, but you might get lucky if you can provide proof that your access point was secured at the time.
Yeah, right.
As an example of how this sort of stuff is slanted toward the corps, consider the mailbox rule. It is widely accepted legally that the US mail system is 100% reliable. If a party can show that they posted a document, and the document was not returned, then it is assumed that the addressee received the document, unless the addressee can prove that they did not receive the document.
It is sufficient for some agent of the corporation to sign an affidavit that the document was mailed and not returned. No other documentation is required. A private citizen, generally presumed to be more likely to lie, must provide proof that a document was mailed, such as a postal return receipt. There is essentially no way for a citizen to prove that they did not receive a document that the corp allegedly sent.
I lost a court case over this issue just recently, so it really sticks in my craw.
My point is that you're probably screwed either way, but if you claim to use some encryption, at least you've got a slim chance.