Wireless Access Pointless

Mark Ayzenshtat has written about his adventures leeching wireless internet connectivity while driving through the pre-apocalyptic landscape of suburban California.  I'm not sure if this is a good or bad thing.

Setting up Wireless Access Point (WAP) security is pretty cumbersome and the results are brittle.  Wireless devices randomly stop working and need to have their encryption keys re-entered.  What's worse, different manufacturers seem to use different passphrase hashing algorithms, so you pretty much always wind up manually typing in hex strings.  To make the process extra-tragic, some confused product designers have tried to "add security" to the process by making the GUI key entry boxes display only blanks (like most password fields) and/or disabling cut-n-paste functionality.  This guarantees that you'll have to type in a long string of numbers and letters several times, and still never be exactly sure of why your WiFi doodad isn't working.  Whenever I see such design, I am tempted to violence.

Not only is securing a wireless LAN difficult for most mortals, but there's very little motivation to actually make the attempt.  You probably won't notice the bandwidth drain of someone leeching from you, and virus and worms are best combated at the firewall and PC level.  You and your neighbor might actually be better off sharing the same access point and not having two separately encrypted networks fighting for the radio spectrum. 

When something is both difficult and unrewarding, the masses will eschew it.  That’s why most people don't read the fine print on medical forms and why they don't secure their wireless networks.  My own 802.11b access point recently gave up the ghost host, and I haven’t bothered to replace it because I can usually see three or four unprotected wireless networks just sitting in my living room.

Of course, if you keep your wireless network unsecured, you never know who might get on it.  That’s a little disconcerting, but the physical network has always been a weak security link because it’s hard to know who’s listening in; and that goes double for wireless.  You need to secure each computer and the important data regardless of whether you turn on encryption on your WAP or not.

Who suffers from this furtive air sharing?  I suppose the WAP manufacturers would sell more hardware if everyone had to buy their own access point, but that doesn’t seem like a good enough reason.  After all, the pump lobby doesn’t get to force all of us to dig our own water wells.  Internet Service Providers (ISPs) suffer some economic damage, because they typically charge a flat monthly fee for unlimited data usage and freeloaders, err, cause more load.  For free.  ISPs can try switching to a metered rate, but that approach hasn’t worked well in the U.S. market.  A couple of years ago most service providers solved this problem by restricting access to just one or two specific computers registered to each account.  That cost too much money in tech support calls when stymied customers tried to hook up new computers, so the practice has been mostly dropped.  Either way, economic damage to the ISPs is a business issue, not a security problem.  The companies should figure out how to fairly charge for their services, not lecture consumers on sloppy prevention.  There are enough real security issues vying for consumer attention as is.

I’m looking forward to the day where I can reliably get wireless data service everywhere, without having to build my own private piece of infrastructure.  A crisper understanding of who we’re trying to protect, better adherence to standards and some smart new technology will get us there.  A chicken in every pot, not a mini broadcast tower under every desk.

Mmmmmmm, potted chicken.

[Brant Chamberlain wins the impromptu, "Quick, i need a geeky euphemism for a piece of hardware dying" office contest.  His first suggestion was even funnier but, alas, not suitable for general audiences.]