<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:12pt">Interesting question. I am trying to remember back to my Network Design 101, where we used wireshark on a wired network. It was my impression that all that you needed was to see the traffic and wireshark was happy. It is really good security to keep people off of your Wi-Fi by whitelisting the allowed MAC addresses but I don't see where this would stop someone from seeing any open and unencrypted traffic. I would be concerned that someone would get enough information to log onto their private website via a route other than the local Wi-Fi. I would even question just where the security of https comes into play. Is there some open traffic before the http turns into https that would allow some evil-doer to cause trouble?<br><br>I will be following this thread with interest. Next year I will get
taking a security class at my local tech school. You can be sure I will bring this whole story up for classroom discussion.<br><br><div><span><br></span></div><div style="display: block;" class="yahoo_quoted"> <br> <br> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 12pt;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> On Sunday, January 12, 2014 1:32 PM, Homan Chou <homanchou@gmail.com> wrote:<br> </font> </div> <div class="y_msg_container"><div id="yiv7957023495"><div dir="ltr"><div class="yiv7957023495gmail_extra">A lot of businesses offer free wi-fi access within their walls as a perk of being there.</div><div class="yiv7957023495gmail_extra"><br></div><div class="yiv7957023495gmail_extra">I have a friend that is a business owner that does NOT offer it because
of "security" reasons. In fact, in order to get on his wifi, he can't just give you the password, he actually has to whitelist your MAC address into his router or something like that.</div>
<div class="yiv7957023495gmail_extra"><br></div><div class="yiv7957023495gmail_extra">His web developer set it up this way because their custom point of sale program is just a website. And they don't use https. So my question is, if that website login form was accessed over non-secure http is the login just send in plain text in packets? Could someone theoretically observe that with wire-shark without even being logged in to the wi-fi network? Or do you need to be connected to the wi-fi router in order to be able to do that?</div>
<div class="yiv7957023495gmail_extra"><br></div><div class="yiv7957023495gmail_extra">I think it's the former but I'm not a wire-shark expert, can someone confirm? (Either way I will tell him he needs https). And I want to encourage him to provide free wi-fi, and if his POS is secured over https it shouldn't make his business anymore vulnerable than he is now, is that correct?</div>
<div class="yiv7957023495gmail_extra"><br></div><div class="yiv7957023495gmail_extra">Homan</div><div class="yiv7957023495gmail_extra"><br></div><div class="yiv7957023495gmail_extra"><br></div><div class="yiv7957023495gmail_extra"><br></div></div></div><br><br></div> </div> </div> </div> </div></body></html>