Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The business plan of a project I'm involved in assumes selling certain WiFi-enabled devices to end users. All these devices originally have an unencrypted connection and a standard SSID. The problem is that although the user can connect to it and set both a new SSID and a WPA passphrase, these are being sent to the AP in plain text and thus can be intercepted by anyone nearby with a sniffer. What's the best solution to this problem, and why?

  • Initially set up an encrypted wireless network at the device and supply the user with a printed passphrase
  • Buy an SSL certificate for the AP's default IP address or local domain name (the APs aren't supposed to work as a router and have a captive portal & dnsmasq installed, so all of them can pretend to be myunit.example.com, as far as I understand)
  • Something different

Thank you.

share|improve this question

3 Answers 3

up vote 2 down vote accepted

I would opt for the sticker with the passphrase on the box. It's simple and effective and also works with the growing amount of devices without Ethernet ports.

share|improve this answer
    
I'm inclined to agree, this really appears to be the optimal solution. Thanks. –  dpq Jun 24 '11 at 12:41

Have the client configure the AP via a wired connection rather than a wireless connection.

share|improve this answer
1  
Not a good idea in times when more and more people start to use things like tablets etc., that might not have an ethernet port. –  Sven Jun 24 '11 at 12:24
1  
Back in the day you had to plug them into a serial port and configure them with a terminal before you could access them any other way. If you are worried about security, then you use a hard line for the initial setup. –  psusi Jun 24 '11 at 12:26
    
@SvenW: The OP should then provide instructions for configuring the AP that specify using a wired client/connection. If I buy a new WAP from Linksys, DLink, etc. the instructions specify using a wired connection for configuration. That seems like a pretty standard approach. Your point is well noted though. –  joeqwerty Jun 24 '11 at 12:28
1  
AVM Fritz boxes, which are kind of the standard device for DSL access in Germany, use stickers with default WPA(2) keys with great success, and I guess Linksys etc. will be forced to adopt this method in order to avoid customer frustration because they have to find a device with an ethernet port. –  Sven Jun 24 '11 at 12:41

If the browser interface supports SSL that will take care of preventing prying eyes when you go to set the WPA password. For this, you don't need to buy a certificate, you can just use a self signed one. Of course, you still have to have a password to log into the management interface, so you are right back where you started.

In the end, you either need to use a wired connection or preset a password and write it on the unit.

share|improve this answer
    
+1. Not to mention that you'll have the client browser balking at the self-signed cert and having to explain to the customer how to "accept" it in their particular browser, etc. At the end of the day, every WAP manufacturer on the planet specifies using a wired connection for the intial configuration. –  joeqwerty Jun 24 '11 at 12:34
    
As SvenW already noted, using a wired connection would create problems users that don't have a laptop around and would rather use their smartphone or tablet to configure the AP. Besides, the AP is a part of a more complex product that isn't advertised as an AP at all, and the image of this product would be damaged by having to use wired connection. –  dpq Jun 24 '11 at 12:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.