Re: [Fed-Talk] A serious security issue with iOS (iPad and iPhone)
Re: [Fed-Talk] A serious security issue with iOS (iPad and iPhone)
- Subject: Re: [Fed-Talk] A serious security issue with iOS (iPad and iPhone)
- From: Will Ross <email@hidden>
- Date: Fri, 24 Feb 2012 05:00:24 -0500
How is the device supposed to differentiate between a single AP network,
and a network that uses many APs to cover an area. This was brought up
by David Mueller a few days ago. For example, a campus can have a
single SSID for it's campus, while that SSID is served by many APs, each
with a unique BSSID. The shared SSID allows the user to roam across the
campus without constantly reconnecting. How would your proposal handle
this use case without being bothersome?
In my opinion, ideally you shouldn't worry about the security of your link.
Just mutually authenticate with your destination, and encrypt the stream
in some manner (802.11i, SSL/TLS, IPsec). While we're still a ways off
for most consumer services, it's getting a lot better (ex: Gmail and Twitter
forcing TLS, Facebook allowing the option to force it).
-Will
On Feb 23, 2012, at 5:41 PM, Pike, Michael (IHS/HQ) wrote:
> I would think it would be on the device's plate...
>
> for example, lets say my home wifi is "mikepikewifi"... my phone should remember it's MAC address
>
> so if i come into work and someone else has a "mikepikewifi" the phone prompts to join because the MAC is different...
>
> I actually thought the phone had done this, but it doesn't.
>
> mike
>
> On Feb 23, 2012, at 3:30 PM, Joe St Sauver wrote:
>
>> #All they really have to do is have the phone track the MAC address.
>> #That will alleviate a big issue. While not fail safe ( as a MAC can
>> #be spoofed) it would stop my damn phone from connecting to all the
>> #"attwifi" networks that are now running in my office from android
>> #hot spots.
>>
>> Shouldn't this issue be getting addressed via 802.1X?
>>
>> Regards,
>>
>> Joe
>
>
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Fed-talk mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden