EFF Open Wireless Movement

[LightRider]

I didn't think that WPA2 suffered from such flaws. This is surprising.

Edit: Apparently WPA2 using TKIP is vulnerable, but WPA2 using AES is not vulnerable. That is probably what they're referring to. At least I hope so.

[theymos]

I didn't think that WPA2 suffered from such flaws. This is surprising.

Edit: Apparently WPA2 using TKIP is vulnerable, but WPA2 using AES is not vulnerable. That is probably what they're referring to. At least I hope so.

AES is still vulnerable. It's a problem with key exchange. During the initial handshake, the session key is generated by hashing the pre-shared key concatenated with a random number that is transmitted from the AP to the client unencrypted. Anyone who intercepts the random number can generate the session key if they also have the pre-shared key.

EFF proposes doing the key exchange using public-key cryptography, which would be secure as long as you know the AP's public key. If you don't know the AP's public key, then it's not any more secure.

[MoonShadow]

Diving into my wireless router, I find that there are options built into it for a 'captive portal' like one would encounter in a public hotspot.  Wifidog seems to be able to supply my needs fine, with just a splash clickthrough screen and copious logging and stats.  However, it seems to require an outside server for the spash and clickthrough portion.  Does anyone know of a cheap/free solution for this?  I want users to see the disclaimer, references to the EFF open wireless movement, and notice of logging of activities.  I do have a linux machine on the same intranet, using the same router but wired, so that might be a solution.