News for hackers. Stuff that matters.

A comment on Key Reinstallation Attacks – Breaking WPA2 by Forcing Nonce Reuse. Parent comment

Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by firewall-bad on Monday October 16, 2017 @01:58PM (#15485246)
"is there any mitigation for this other than ditching my handset and switching to an iPhone or waiting (hopelessly) for a patch from my vendor."

Using a VPN is the best way to mitigate this until your device is patched, assuming you trust your VPN provider or run your own VPN.

Edit: Actually, even if you don't trust your VPN provider, you'll be protected against this attack (KRACK), given their client is implemented properly.

[ Parent | on HN ]
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by krrrh on Monday October 16, 2017 @04:21PM (#15486346)
> given their client is implemented properly.

Unfortunately this is a big part of trusting your VPN provider. It’s shocking how bad the situation is, especially it seems on those marketed via Android apps. [1]

[1] https://arstechnica.com/information-technology/2017/01/major...

[ Parent | on HN ]
Re:Key Reinstallation Attacks – Breaking WPA2 by Forcing Non... by firewall-bad on Monday October 16, 2017 @05:18PM (#15486714)
Well the VPN ecosystem has an enormous long tail - the paper you cite tested 283 (!) apps. It's unfortunate but somewhat expected that a significant number, especially the ones that haven't been around for long, would have issues.

I'm sure, given the size of that list, that they tested some of the biggest players on the VPN space. I think it'd be good to know which apps were tested and didn't show any issues, especially in light of Krack and the Android bug on wpa_supplicant.

[ Parent | on HN ]