WPA3 Wi-Fi still saddled with security flaws, researchers claim [u]

THE primary rule remains:   "If they want in bad enough, they will.   The trick is to make it hard enough that they go after your neighbor instead."
...  That's sort of a take off on the joke that you don't have to outrun the bear, just your friend.

GeorgeBMac said:

THE primary rule remains:   "If they want in bad enough, they will.   The trick is to make it hard enough that they go after your neighbor instead."
...  That's sort of a take off on the joke that you don't have to outrun the bear, just your friend.

Too often it seems we think we can rely on having big locks (aka "13 character passwords") on things.   But, often better is:

1)  Security through obscurity
2)  Immediate notification (such as when a sign on is attempted or a new device connected or especially if there is an invalid attempt.)

For myself, I keep MAC authorization enabled so that, if I don't know your MAC address, you aren't getting in.

I appreciate your vigilance, but you should know that it's trivial to locate a valid MAC address as they are sent with each and every packet, and they are easily spoofable since they are a virtual representation of the BiA (burn-in address). It's effectively just a speedbump for any would be attacker, and one so small that they don't even have to slow down.

To WPA2's credit, this protocol has been going strong since its release in the mid-aughts, and without a successor that greatly increases protection it looks like it'll be used for many years to come.

GeorgeBMac said:

THE primary rule remains:   "If they want in bad enough, they will.   The trick is to make it hard enough that they go after your neighbor instead."
...  That's sort of a take off on the joke that you don't have to outrun the bear, just your friend.

Too often it seems we think we can rely on having big locks (aka "13 character passwords") on things.   But, often better is:

1)  Security through obscurity
2)  Immediate notification (such as when a sign on is attempted or a new device connected or especially if there is an invalid attempt.)

For myself, I keep MAC authorization enabled so that, if I don't know your MAC address, you aren't getting in.

Your primary rule is flawed.  The concept of “more secure than your neighbor” assumes the attacker is searching for the lowest hanging fruit.  

If the attacker is specifically targeting YOU for some reason (see: every celebrity hack ever), then simply trying to be more secure than your neighbor may be a pretty low bar.

ttollerton said:

GeorgeBMac said:

THE primary rule remains:   "If they want in bad enough, they will.   The trick is to make it hard enough that they go after your neighbor instead."
...  That's sort of a take off on the joke that you don't have to outrun the bear, just your friend.

Too often it seems we think we can rely on having big locks (aka "13 character passwords") on things.   But, often better is:

1)  Security through obscurity
2)  Immediate notification (such as when a sign on is attempted or a new device connected or especially if there is an invalid attempt.)

For myself, I keep MAC authorization enabled so that, if I don't know your MAC address, you aren't getting in.

Your primary rule is flawed.  The concept of “more secure than your neighbor” assumes the attacker is searching for the lowest hanging fruit.  

If the attacker is specifically targeting YOU for some reason (see: every celebrity hack ever), then simply trying to be more secure than your neighbor may be a pretty low bar.

Unless you are rich or famous or powerful, there is no reason for a hacker to go after you and only you.  The vast majority are simply looking to hack somebody, anybody -- in the same realm as a credit card skimmer is not looking for YOUR card number.   They just want A card number.

Soli said:

GeorgeBMac said:

THE primary rule remains:   "If they want in bad enough, they will.   The trick is to make it hard enough that they go after your neighbor instead."
...  That's sort of a take off on the joke that you don't have to outrun the bear, just your friend.

Too often it seems we think we can rely on having big locks (aka "13 character passwords") on things.   But, often better is:

1)  Security through obscurity
2)  Immediate notification (such as when a sign on is attempted or a new device connected or especially if there is an invalid attempt.)

For myself, I keep MAC authorization enabled so that, if I don't know your MAC address, you aren't getting in.

I appreciate your vigilance, but you should know that it's trivial to locate a valid MAC address as they are sent with each and every packet, and they are easily spoofable since they are a virtual representation of the BiA (burn-in address). It's effectively just a speedbump for any would be attacker, and one so small that they don't even have to slow down.

To WPA2's credit, this protocol has been going strong since its release in the mid-aughts, and without a successor that greatly increases protection it looks like it'll be used for many years to come.

As I said, there are no bullet proof security schemes.   If they want in bad enough, they will get in.   The trick is to make it hard enough that they go elsewhere for easier pickings.  Finding and spoofing a valid Mac address can be done, but it would be easier, quicker and cheaper to go pick on somebody else.