There have been quite a few postings here in the weblog about WiFi. Seems as though there is something to write about every day. Today I want to share my thoughts on two aspects of WiFi — “honeypots” and “World Wide WiFi”.

World Wide WiFi

First I’ll get the negative part out of the way. As I write this I am sitting near gate 13 at American Airlines at Orlando International Airport. There is no Admirals Club here. (I love the Admirals Clubs because they all have WiFi provided by T-Mobile — a great service). The waiting area at American in Orlando is a huge wide open area. It serves four gates and seats several hundred at least. No WiFi signal to be found. Asking people about it yields strange looks and got me thinking I was setting myself up for a "random" security search. I was lucky to find an AC power receptacle to keep my battery going during my long wait for the flight. There are pay phones but none have an RJ-11 jack. So a large number of people are "disconnected" from the world. Nothing wrong with that if you want to take a nap or read a book. If you want to or feel a need to get connected you are just plain out of luck. We are at two percent!

In 1996 a meeting was held at AT&T research at which David S. Isenberg said that although Internet telephony seemed like a toy today but some day it will be better — much better — than traditional switched telephone infrastructure. I suspect they laughed at him. In a recent article, David proclaimed that "the future of voice telephony has arrived". David’s belief was inspired by a visit to the VON 2002 (Voice on the Net) conference in Atlanta recently where he experienced a vanilla Compaq iPAQ palm-sized device with an 802.11b WiFi connection to the Internet. Using a pair of headphones and the IPAQ’s on-board microphone, David says, he was able to have a crystal clear "telephone" conversation with another person. The software he used was by Global IP Sound. He understandably was impressed and feels we have seen the tip of a very big iceberg.

Meanwhile, a company called Pocket Presence and Global IP Sound are working together to build a WiFi "softphone" application that they claim will have "better-than-PSTN quality". The software will run on PDAs and laptops. Global IP Sound said the solution was recently tested on an HP iPAQ device connected by WiFi at an Internet cafe in San Francisco to a test engineer located in Sweden. Despite traversing 18 "hops" between routers on the Internet, the company described the sound quality as "excellent" and better than mobile and traditional phones. You can find a writeup of David’s VON experience here.

Clearly, the momentum is building but the question is whether WiFi plus VON will *replace* the existing cellular and wired telephony systems of the world. Some evangelists would say yes and perhaps they are right but I tend to think that at least for the next decade we will live with multiple systems. TV has not eliminated radio — in fact digital radio is revitalizing the medium. High speed trains have not eliminated buses. The web has not eliminated the print media. I suspect that WiFi will far surpass most people’s expectations and become quite ubiquitous — but it will be additive and will coexist with the various other methods. Stu Feldman, VP of Internet Technology at IBM and a very smart guy points out that long distance rates are very low — a few cents a minute in bulk. He adds that for most people the cost of having a "traditional" wired connection is also relatively low and is accepted as part of the monthly cost of living. This is increasingly true for cellular also and the incremental cost for long distance via cellular is pretty close to zero. Stu says, "Most people won’t get rid of their phone lines or regular cell phones any time soon". Young people are getting apartments these days and not getting a wired phone at all. They use cellular for all calls. For the majority of people, however, having a multiple extensions — or even a mini electronic "switchboard" with loads of features — will remain attractive. What VoIP will do says Stu, is "stunt growth, with advantages for greenfield business and integrated enterprise functions, as well as being the obvious play for new ideas".

Honeypots

As I pointed out in , many — maybe most — Wireless Access Points have the encryption feature turned off. Once I was in a car riding up the Garden State Parkway in New Jersey with Boingo software running. As I went by the office buildings of major corporations, the SSID (name) of the WAPs would pop up on my screen — abccorp, xychq, isdept, etc. At least seventy-five percent of the WAPs did not have encryption turned on. That means I likely could have pulled over on the shoulder and gotten some free broadband Internet access. The encryption protocol that is built into most all WAPs is called WEP — wireless equivalency for privacy. Admittedly WEP is not the greatest. It uses strong encryption but it is not a well implemented protocol. Most hackers can break through it. In response to this weakness various vendors have developed proprietary protocols to fill the gap. Cisco’s LEAP protocol is an example of this. IBM and likely other major enterprises have implemented it across their company locations.
Meanwhile KPMG in London is setting up “honeypots”. The idea is to create a trap consisting of a WiFi-equipped laptop set up to detect drive-by hackers. The laptop looks to the outside world like a normal WAP, but it also contains software designed to monitor what illicit activities may be underway. The laptop will have no other network connection, but will appear to the hacker as a possible entry point to the corporate network. KPMY says that the are trying to measure the number of “wardrivers”, and the level of attack they are attempting. I am not sure where the “wardriver” terminology — a reference to people who drive by WAP and attempt to use it — came from but I don’t like it. WiFi is not about war, it is about freedom from wries and ubiquitous connectivity. Rather than setting up honeypots to see who may be trying to use your WAP, I recommend securing your WAP so people can’t use it, if that is your desire.
DSL and Cable providers don’t say much about WEP or LEAP or firewalls. In fact they don’t even acknowledge — and sometimes disavow — the existence of home LANs whether they are wired or wireless. Rather than the energy going into honeypots, I would like to see more energy go into educating consumers and businesses on how to make their wireless networks more secure. It isn’t just a matter of WEP or LEAP being turned on. The Linksys WAP has a feature that enables turning off the broadcast of the SSID. By initiating that feature, the “wardrivers” will not even see the name of the WAP to try to use it. Physical security should also be considered. Brian Carpenter, a distinguished engineer at IBM, suggests watching out for “suspicious vehicles parked near a building for several hours”. He also points out that if using WiFi in a shared building, all traffic should be “additionally encrypted”.
The promise of WiFi is significant. For years industry pundits have talked about the “last mile” being the impediment to further rapid growth in the number of Internet users. WiFi is about to break through the wall.