Re:Ask HN: I’m an FCC Commissioner proposing regulation of I...
by MarcoPerazaFCC on Tuesday September 05, 2023 @12:40PM
(#37394300)
In the 2010s, the FCC began enforcement proceedings against more than one hotel chain for using Wi-Fi deauthentication attacks against guests using their own Wi-Fi hotspots instead of the official hotel Wi-Fi networks. The claims were settled, so there's no court ruling on the matter, but our office is inclined to believe that the FCC has legal authority over such attacks. But we definitely encourage you to share your views on the record.
Re:Ask HN: I’m an FCC Commissioner proposing regulation of I...
by sokoloff on Tuesday September 05, 2023 @12:44PM
(#37394392)
I'll do that, after taking some time to actually read the relevant CFR Parts to ensure my understanding is as reasonably informed as I can.
Thanks to you and your colleague for making that process well-announced.
For the record here (and I'll add to the comments above): I'm in favor of perfect regulation that would allow the FCC to perform that hotel enforcement action, provided it didn't significantly further impair the ability of hobbyists and entrepreneurs to create prototype products that use RF communications without having to engage with the FCC or third-party certification labs at every turn/step. (I worry that perfect regulation of an unlicensed usage of the spectrum is at least very difficult and may be practically impossible and I'm pretty sure that I don't want to flip all WiFi usage over to FCC-license-required.)
> Wi-Fi deauthentication attacks, which can render useless every Wi-Fi network in an area, can be carried out by a single device with a Wi-Fi antenna.
Is the prevention of such attacks within the mandate of the FCC (so long as all other relevant RF parameters are adhered to in the device)? I understood that unlicensed ISM users must not cause interference to licensed users, and they must be tolerant of interference generated by licensed users. I read this logically to conclude that unlicensed users must also be tolerant of interference from unlicensed users. (The opposite conclusion would seem to be infeasible to enforce, if any single unlicensed user could effectively bar the operation of another unlicensed user merely by being unable to tolerate the interference emitted by it.)
A WiFi deauth attack is an attack on unlicensed users of the frequency spectrum.
I'm perfectly happy for the FCC to change the rules, provided they follow the rule-making process in that rule change. If WiFi deauth attacks are to be prevented (and if I'm correct that they are legal-albeit-anti-social now), we should go through a rigorous rule-changing process to ensure that the new rule correctly balances the desire for continued, unlicensed use and the desire for that unlicensed use to be practically useful/usable.
(By the way, I appreciate you engaging the HN community and hope that you're targeting other, similar communities who may have relevant expertise on either technical or policy matters here.)