News for hackers. Stuff that matters.
Re:Android saves wifi passwords in plaintext to the cloud by nwh on Wednesday July 17, 2013 @08:46AM (#6057311)
> like hardware address whitelisting

I wouldn't recommend that in any circumstance, it's completely false security really.

MAC filtering is incredibly easy to bypass, all Malory has to do is wait for another device to connect and clone their hardware's address.

Re:Android saves wifi passwords in plaintext to the cloud by yardie on Wednesday July 17, 2013 @10:47AM (#6057935)
It's also a diagnosis nightmare. The ISPs in my country used to use WEP with MAC filtering with their wifi-routers. The password was mildly complex (16 characters) and on a label on the box. Most users never changed the password. So Joe Blow connects his laptop using the password on the sticker, and it doesn't work. Imagine the same problem for a few million users.

It's false security because (especially for wifi) MAC filtering is like a verbal password that's been written down on a billboard. Everyone can read it so its not a secret.

Re:Android saves wifi passwords in plaintext to the cloud by nwh on Thursday July 18, 2013 @01:17AM (#6061896)
Heh, even the longest possibly WEP key can be broken in a few minutes with consumer hardware. At least ISPs in Australia use WPA as standard.
Re:Android saves wifi passwords in plaintext to the cloud by yardie on Thursday July 18, 2013 @05:26AM (#6062603)
They use WPA2 now and from a few years ago. The cheap wifi-routers they sent out years ago didn't have the muscle to do WPA encryption.
Re:Android saves wifi passwords in plaintext to the cloud by nwh on Thursday July 18, 2013 @06:09AM (#6062694)
Our have for a while too. Sure the password is the hash of the the routers MAC and the manufacture date, but they did try.
Re:Android saves wifi passwords in plaintext to the cloud by lrem on Wednesday July 17, 2013 @09:33AM (#6057554)
Wait until somebody else connects to have his MAC, then wait until he disconnects. Otherwise, you'll see a ton of RST flying, making your connection quite useless. That's a good enough deterrent for the typical "attacker", who just happens to need a connection here and now and saw a network using WEP.
Re:Android saves wifi passwords in plaintext to the cloud by Kurts on Wednesday July 17, 2013 @09:10AM (#6057430)
Yeah but he doesn't have the password, unless somehow he hacked Google's servers for that specific one. It's the combination of both that makes it unlikely, there are far easier/better/more practical/likely ways of penetrating wifi networks.
Re:Android saves wifi passwords in plaintext to the cloud by nwh on Wednesday July 17, 2013 @09:30AM (#6057527)
My point was, it's more an illusion of security than anything. Best not to bother at all.