let me just quickly jump in and correct you on this... :-) the new encryption standard is called WPA, _is_ available, and has already been for quite some months... netgear and d-link are two brands which offer WPA comp. products. but there are for sure others... -- regards, Georges Toth

Georges Toth wrote: Indeed, lots of products are on the market since months that pretend to be 'WPA compatible' or 'WPA ready'. However, the complete WPA standard was not published until very recently. I made a study on that around march, and WPA consortium was at that time raising concerns about some products that pretended to be "WPA compatible" such as Cisco devices, saying that at the current situation of the standard, those device could not even become WPA compliant without some hardware change... Actually, it's the fault of the WiFi consortium, that recognised some devices and vendors as "WPA compliant" before the standard was published. This is due to the fact that the WiFi market was about stopped for professional users because of the absence of security (WEP encription is no security at all since years). Those devices, sold as WPA compliant, are just expected to be WPA compatible or able to communicate with true WPA devices running in degraded mode. So, once again, there is a huge difference between what you see on the box (commercial view) and what is actually inside (technical view). A search on the web shows me that the status of the WPA standard gets updated recently, indeed: http://arstechnica.com/news/posts/20040625-3933.html: "True 802.11i implementations will be better known as WPA2, and while some products already support WPA, few will be able to handle the AES encryption scheme, and may not be upgradeable. More testing is expected to continue throughout the summer, with major rollouts beginning in the fall." (06/25/2004) So, as you see, WPA was so heavily used on products BEFORE the actual publication that it is now published as WPA2. As written in this paper, I don't think true WPA device are already on the market (or it is very recent). They are more expected later this year. Devices that pretend to be WPA compatible are actually not supporting the full security scheme that might gives the whished level of security. Some specialists says what I mean even about WPA: http://searchnetworking.techtarget.com/originalContent/0,289142,sid7_gci954…: "[...] said the improved encryption that WPA offers over its predecessor, Wired Equivalent Privacy (WEP) is helpful, but there are many more factors for businesses to consider." [...] "After shedding VPNs for less cumbersome technology, many companies are returning to them [...]. From a security perspective, some firms are smartly beginning to view a Wi-Fi network as a kind of remote access, rather than simply an extension of the wired network." [...] "You should treat a wireless LAN like an untrusted network outside of the firewall," [...] Anyway, the full story is on http://www.wi-fi.org. I still consider a WiFi network at home as a RJ45 outlet outside of my home. I wouldn't consider using that technology without adding my own encription level on it, even for home use. Now, you're warned. The decision is yours. This doesn't prevent you from trying first with some borrowed hardware before purchasing, because the performances are often degrading very rapidly with distance and true buildings (not american ones). So George, you are right when you say WPA is available from months, but it's unfortunately not true WPA or WPA2 I'm affraid, and so it is NOT secure as we could expect. -- Brent Frère Private e-mail: Brent(a)BFrere.net Postal address: 5, rue de Mamer L-8280 Kehlen Grand-Duchy of Luxembourg European Union Mobile: +352-021/29.05.98 Fax: +352-26.30.05.96 Home: +352-307.341 URL: http://BFrere.net

Pascal Steichen wrote: WPA is the replacement of WEP, that is NO SECURITY. Several articles have been published from 2000 on how to crack WEP, and at least two implementations of those exploits are freely available as free software on the web. More than that, the design is so broken that when they extended the key length from 64 to 128 bits, the effect on the exploit was to double the average duration of the cracking process. The IT manager of Astra came last year to Bureautech with his Linux-running laptop. From the entrance to Plan-Net booth, he already cracked the Luxexpo (FIL at the time) wireless network. Use of a radius server is indeed advised if you want the full feature of WPA. However, I read an article recently that showed that the use of a simple shared secret was dangerous if the key was weak (a password or a passphrase). It recommended a random-generated long key. For sure, this is uneasy to use, but reversely, you can consider that using WPA with long, random generated key might be safe... until it is cracked again. On corporate building outside walls in big cities, such as London, you have chalk writings made by teenagers that gives the technical details about the wireless network, so that they can freely browse the web from the street using the (secured, private, inside, ...) company LAN and Internet access... WEP is NO SECURITY at all, since years, and that is the very reason why the WiFi vendors build this WiFi consortium and developped a new standard: WPA. Now, what worth WPA (the true one, also called WPA2) ? No idea. Let's see what will happend... If I would really NEED this even at home, I would try to add a VPN between the two sides of the WiFi link. Just my Eurocent. (by the way, the plural for cent is cent, as the plural for Euro is Euro, following international treaty of 1997 and ECB rules.) -- Brent Frère Private e-mail: Brent(a)BFrere.net Postal address: 5, rue de Mamer L-8280 Kehlen Grand-Duchy of Luxembourg European Union Mobile: +352-021/29.05.98 Fax: +352-26.30.05.96 Home: +352-307.341 URL: http://BFrere.net

Yes your all true, but hey did already some try to crack a WEP communication, if it's on low traffic network like home, with is generally switched off even, the probability is rather low that you get the key in the right time to use it. i KNOW that WEP is not secure, but hey it's better then nothing, and combined with ACL and only swithing on the net when you use it its pretty OK. My advice was ment for his kind of environment, but of course WPA (or you sure that WPA is not only auth ?) and VPN is far better. -- Pascal Steichen pascal.steichen(a)lilux.lu Lilux ASBL http://www.lilux.lu