That's not a password, that's a shared private key. Encrypting everyone's traffic with the same private key provides no real security benefit at all.

What would that protect against?

The only use that I see for a standard-password approach is that it would circumvent some ISPs' terms of service that say you can't run an open network. But even then, a court may find that a closed network with a password like `openwireless` (i.e. as part of OpenWireless.org) is an "open network" anyway.

Using an open network without encryption allows a passerby to listen in to all of your traffic. Unfortunately not all websites are using SSL yet.

If attacker knows network pre-shared key, and intercepted handshake, they can decrypt your traffic.

I guess I should have read the comments on this post: http://steve.grc.com/2010/10/28/instant-hotspot-protection-f...

No, because you can set up a honeypot knowing this password, and then mirror your input to the sites you visit after I collect your information.

That's possible without a password too, except that anybody in the area can MITM you instead of just people who bothered to set up honeypots. AFAIK WiFi only provides encryption on networks with a password.

Right, this would avoid Google's argument that they can sniff unencrypted data from your wifi since it's being broadcast in the clear out into the street. At least having a per-session key would count as a legal defense against drive-by sniffers.

How isn't such a setup insecure?

Using current standard consumer technology, it would have some security issues.

That's why they say:

> We're working with a coalition of volunteer engineers to build technologies that will let users open their wireless networks without compromising their security or sacrificing bandwidth.

There are a variety of technological solutions possible, many of which could be implemented in firmware (see OpenWRT). I'd guess if we dig deeper on their website, we might get to their tech plans; I am not familiar with them specifically.

Although, honestly, if you're counting on nobody being able to sniff your traffic in transit for security, you don't have enough security anyway. But still, yeah, I wouldn't want to make it that easy.

per-device (session?) keys.