Unsecured Wi-Fi to Become Illegal? 418
echucker writes "News.com is carrying a story for a draft proposal for law in Westchester County in New York state that would outlaw unsecured wi-fi connections. Public internet access would require a network gateway server with a firewall and also require home/business office users to install firewalls to protect personal info, even if their connection is encrypted. Violations would carry fines of $250-$500."
Wardriving Police Cars (Score:5, Funny)
This is absurd (Score:5, Insightful)
This is the epitome of a YRO violation. Interesting it was posted under the Hardware banner.
Re:This is absurd (Score:5, Insightful)
Re:This is absurd (Score:5, Insightful)
No, it's like fining somebody for not having a fence around their property and not getting burglarized.
A locked door isn't like a firewall, it's like a secure password-protected service. Firewalls easily let you limit access to "all or nothing" - but hell, if that's as "fine-grained" as you need your security to be, you can get the same effect on a good OS just by turning off the services you want inaccessible. You can use a firewall to limit access by IP, but you could do that without a separate firewall by having clients do IP (or better, asymmetric encryption key) checks themselves. What you can't do is use a firewall to forward outside connections to an inside service and expect that service to become any more secure.
Does this have something to do with the push behind SP2? I can't imagine Microsoft wanting to widely advertise, "You need to upgrade for security reasons because pre-SP2 versions of our programs are swiss cheese!" but they did need to get the "You need to upgrade for security reasons" message out there - perhaps what got across to consumers and lawmakers was "You need to upgrade for security reasons because SP2 has the all-important magic of Firewall!"
Re:This is absurd (Score:3, Insightful)
It just is more evidence that the legislature should be regulation of last resort. Anybody who's been on their work network or a campus resnet knows that bureaucratic rule making is the least efficient kind out there. That's why we delegate power as much as possible. This doesn't work thoug
Re:This is absurd (Score:3, Funny)
Re:This is absurd (Score:4, Funny)
I don't see how you could have missed this from the start.
Re:This is absurd (Score:3, Funny)
Re:This is absurd (Score:5, Funny)
There, car analogy.
Re:This is absurd (Score:3)
Would that mean this bill is doomed?
Re:This is absurd (Score:3, Interesting)
Re:This is absurd (Score:3, Insightful)
I don't use wifi and don't know much about it. Can anyone explain this using crayons? Suppose I put a wifi card in my linux box, take it to this neighborhood, and don't take any extra special precautions. What the heck is going to happen? I'm on this network with a bunch of other people. I fire up my browser and visit Slashdot, using htt
Re:This is absurd (Score:3, Insightful)
Which might be a good reason to leave it open (Score:5, Interesting)
So when the P2P police come calling if I'd had an open wireless connection it provides an element of doubt that I am guiltiy, which is pretty handy (if you're into P2P). If I used P2P a lot I'd do it from a box that operated only through my wireless connection - then any records don't even show the MAC address of your primary computer and you could ditch the box quickly if you got The Letter.
Re:This is absurd (Score:3)
The Internet is an open global network, not a closed private network. Taking one or two feeble steps towards closing it will hurt average users much more than it will ever prevent spam or hacking.
For instance, I like getting free WiFi at cafes. Holding the cafe responsible for whatever somebody decides to do to the Internet through their hotsp
Re:This is absurd (Score:4, Insightful)
The issue is that your Corporate Overlords and their Political Henchmen want to keep an eye on you, and that is easier if all the data from and to your computer goes through a single wire. In a world full of public anonymous Wi-Fi access points, anyone could connect to anything from anywhere without giving away their own identity, allowing free exchange of information without fear of legal consequences, and making things impossible to censor (since it might be impossible to find the servers the data resides in, especially if the servers are running a P2P network like Freenet [freenetproject.org]); it is Big Brothers and Big Businesses worst nightmare.
Freedom is the worst enemy of Power, so of course powers-that-be try to crush it. This law is just another attempt of forces of darkness to crush all opposition and bring about a Digital Dark Age.
Re:This is absurd (Score:3, Insightful)
I don't see what any of this has to do with wired versus wireless networks. Packet sniffers can be used on wired networks as well. Every packet you ever send across the internet is public, and could pass through fifty different machines, none of which are guaranteed to be owned by nice people. If yo
Re:This is absurd (Score:4, Interesting)
And "some people" include such ignorant folks as Intel Corp., who operate a free-for-all access point on San Francisco's Union Square. Would the law outlaw this kind of marketing, too?
Oh, and a hint: Put your phone no. or eMail in your SSID and I will personally thank you when I use your AP.
Alex
Re:This is absurd (Score:2)
Re:This is absurd (Score:2)
Re:This is absurd (Score:2, Insightful)
You can't feasibly control every method of connecting to the internet. Besides, people with the ability to hack into OmniCorp's servers are going to have no trouble getting past a wep key!
Re:This is absurd (Score:2)
I agree with that. I just wanted to point out that the analogy with leaving your front door unlocked doesn't hold.
Re:This is absurd (Score:5, Interesting)
Yes, I have worked as a mortgage loan officer for such a place. Yes, I insisted on that being changed (to extremely computer clueless management). Yes, I eventually quit for these and other questionable practices.
Re:This is absurd (Score:3, Interesting)
There are laws that address the practices of institutions & business that house these types of personal information. I currently work in IT at a large insurance company, and each company wireless router is specifically configured in a secure fashion.
Businesses have an obligation to secure confidential information.
The problem is that we're talking about the impact on individuals.
Re:This is absurd (Score:5, Insightful)
Re:This is absurd (Score:3, Informative)
(...or am I missing a Simpsons reference?)
Re:This is absurd (Score:3, Insightful)
I'm not sure I agree with your analogy. If someone owns something which is both desirable & dangerous (ie handguns, swimming pools, etc) they are required by either laws or insurance premiums to secure it.
I belive the same argument can be made for the internet. Sure the concequences aren't as severe (children having access to unfiltered content & computer virii instead of, well, death and injury), but neither
Re:This is absurd (Score:2)
Re:This is absurd (Score:4, Interesting)
BULLSHIT.
The writers of bots and viruses are responsible for those outbreaks!
The writers of the host operating systems that were *shipped* with obscene numbers of security holes are responsible for those outbreaks!
The users who are uninformed (ie - the box/manual doesn't say the software comes with security holes) are NOT responsible for the spread of malicious activity.
That's like saying the people who ride public transportation are responsible for the negligent amounts of polutants that city buses put into the air.
Let's start enforcing the laws we have.
Jail time for those who write viruses and bots.
Every time a new virus or bot hits the net, fine the company that sold the bug filled software that enabled the bot to run. Make the manufacturer responsible for the problems their incompetance (or negligence) caused.
If a car manufacturer sells vehicles that crash all the time, they are forced to do a recall.
If a hardware manufacturer sells computers / laptops that have a material defect that can cause harm or property damage, they are forced to recall.
If a software company releases software that causes (through bugs, incompetence, negligence) damage, financial harm, or physical harm (ie bad software controls for automatic equipment) they are somehow held NOT responsible?
If I write a piece of software designed to do a specific task, then state in the EULA that it may not be suitable for that purpose, and that in the end, it's the users responsibility to determine suitable (and in some cases, safe) functionality in that task, I get off with no responsibility or accountability?
I believe that any member of government who says that people in general should be fined because they take a product and use it by just plugging it in and running it as it was shipped by the manufacturer is, to put it bluntly, bull shit. It's just another ploy by less than intelligent, power hungry law makers blindly trying to find a culprit (in all the wrong places - as usual) and make some money off of it.
Re:This is absurd (Score:3, Funny)
It is now illegal to use passwords of less than 26 characters, or those containing only letters of the alphabet
It is now illegal to drive a car with clear-text license plates
It is also illegal to speak on your mobile in English. Klingon is permitted until normal people learn it, at which time you'll have to switch to Esperanto.
All medicine bottles will be made from titanium and fused shut. If you can't open it - well, you just discovered what 'survival of the fittest' means.
I used
Re:This is absurd (Score:2)
Also, what exactly constitutes secure? Encryption? Password? If this goes through, what's to stop a sleazy hardware manufacturer from putting out an access point with very poor sec
Re:This is absurd (Score:4, Interesting)
It seems to me this would mostly benefit ISPs who don't want people sharing their broadband connections with everyone on their block. Won't someone think of the lost monthly fees?! Not that this would necessarily prevent connection sharing; but a mere firewall won't do much to prevent information stealing either.
I'll admit my main reason for thinking this is cynicism.
Re:allowing an unlocked house & meth lab (Score:5, Interesting)
In that case, I would like to propose compulsory content analysis and blocking on all backbone routers. Because you never know when someone somewhere might use the Internet for something distasteful.
I suspect that the proposed legislation has zero chance of getting anywhere.
Re:allowing an unlocked house & meth lab (Score:2)
Cornwallis: You dream, general.
(Taking a moment to quote my favorite movie that reminds me of the people we once were, The Patriot.)
We no longer have the chutzpah to stand up against the tea act
~Rebecca
Re:allowing an unlocked house & meth lab (Score:2)
Re:Unlocked == asking the WAP and getting "OK" (Score:3, Interesting)
Re:This is absurd (Score:3, Insightful)
This is why a prefer the "insurance company" approach: we WON'T fine you for leaving your door unlocked, but we won't pay up if it is unlocked and you get unlawful entry either.
Remember you can walk into most buildings, but once you see the sign "authorized personnel only", have a need of a key (electronic or otherwise), or an employee of the building indicating you can not pass you know that this is where you stop, unless you have busin
Firewall? Nahh.. (Score:3, Interesting)
Is this because of the telco's? (Score:5, Insightful)
These legislators have gotten downright dangerous, I also wonder, how uesful is an open network for hacking?
If you were up to no good is an open AP the way to do it?
Re:Is this because of the telco's? (Score:4, Informative)
The short answer, YES.
The long answer, if its not a honeypot and you can evade physical detection, YES. The former may be harder to detect on the fly, but the latter is as simple as hiding in plain sight in the parking lot of an apartment complex or frat house.
~Rebecca
Luckily it is just a proposal. (Score:5, Insightful)
Re:Luckily it is just a proposal. (Score:2)
Re:Luckily it is just a proposal. (Score:5, Informative)
Re:Luckily it is just a proposal. (Score:2)
Re:Luckily it is just a proposal. (Score:2)
This law would be impossible to enforce anyway.
Not really, now you get paid $250-500 per site found as a war driver. Get 1000 open access points and that could be $500000 in gross revenue. So cops can now play PC games in the car while looking for open WAP. Guess they are tired of giving seat belt tickets. A new use for NetStumbler.
Make Unsecured OS Illegal too!!! (Score:3, Funny)
Re:Make Unsecured OS Illegal too!!! (Score:2)
Speeding also illegal, as is cheating on taxes (Score:5, Insightful)
To me, this sounds like one of those "I'm protecting your children from Teh Internets" moves that politicians do periodically when they have to remind the masses that its time to vote.
How about holding someone responsible (gasp) for any malicious activity that originates FROM their network?
Illegal, but trackable (Score:2)
The speeders are a moving target and you have to be there at the same point in time, while the WIFI sitting in your bedroom is not. The cops have plenty of time to slowly ( and quietly ) cruise around town finding them. Then triangulating them down to the street address, with a warrant to search in hand.
Re:Speeding also illegal, as is cheating on taxes (Score:2)
Re:Speeding also illegal, as is cheating on taxes (Score:3, Insightful)
Now there's a good idea. Actually, don't we have that already?
In related news... (Score:3, Insightful)
Re:In related news... (Score:3, Insightful)
Right. That'll work. (Score:5, Funny)
Re:Right. That'll work. (Score:2)
If that was the case, you'd be be better off doing like Wonko the Sane from So long, and thanks for all the fish and build a house called The Outside of the Prison. It'd be a helluva lot easier than getting all the idiots into prison.
Will they also require we lock our front doors? (Score:5, Interesting)
If I want to leave my data connection open for any number of reasons, that's my business. If I want to leave my front door open or not lock my car, that's my business too...
Ridiculous.
stupid stupid stupid (Score:5, Insightful)
Open you laptop and you'll get 'do you want to attach to PublicWifi?'
It's firewalled off, URL filtered, and aside from http(s), DHCP, DNS, SSH and VPN, nothing else can get through. Further, those ports will only attach to outside IPs. All traffic is monitored, and there are notices in all meeting rooms that Your security is Your problem.
This is a solution that protects OUR network, has zero admin overhead, and still permits the resource...So that's now illegal?
Re:stupid stupid stupid (Score:2, Informative)
Re:stupid stupid stupid (Score:2)
How so? If I have some packet filter inspect the packets and automatically disconnect the user when suspicious packets are exchanged, isn't it both monitored and zero admin overhead?
Well, driving without a... (Score:2, Interesting)
Re:Well, driving without a... (Score:3, Insightful)
default passwords (Score:3, Interesting)
Drat! (Score:2)
Fortunately, he doesn't seem to mind the amount of pr0n I download.
Invasion of rights (Score:2)
What is next, banning of the neighborhood BBQ? Cant share that meat and beer you bought with your friends that live across the street. noooo
So who gets to enforce it? (Score:5, Funny)
Here's the Big Brother part... (Score:4, Interesting)
I wonder who is really behind creating THAT database?
Tyranny for your own good (Score:2)
"It would seem that if despotism were to be established among the democratic nations of our days, it might assume a different character; it would be more extensive and more mild; it would degrade men without tormenting them."
and
"Thus it every day renders the exercise of the free agency of man less useful and less frequent; it circumscribes the will within a narrower range and gradually robs a man of all the uses of himself. The principle of equality has pre
Equivalent of seatbelt laws? (Score:3, Interesting)
Re:Equivalent of seatbelt laws? (Score:2)
it's actually more ridiculous than the seatbelt laws. Consider that if you were in an accident and not wearing your seatbelt, public services (fire, ems, etc.) would be engaged to either pull you out or scrape you off, depending on the severity of the accident; so you could make a case that the public good is enhanced if everybody wore their seatbelt.
Securing an open WiFi access point doesn't secure any additional publi
Re:Equivalent of seatbelt laws? (Score:2)
Re:Equivalent of seatbelt laws? (Score:3, Insightful)
Suppose you've got a person who was just in a car wreck and you've got a child who was just pulled from a burning building who is in serious need of medical attention. The county only has one free ambulance at this point in time, who do they go get? Well if the guy in the car wreck had worn his seatbelt and not been thrown through the windshield, they could just go get the kid. But since the guy in the car was thinking only of himself and didn't
As if it isn't enough already? (Score:4, Insightful)
Ok.. I just turned on WPA.... (Score:5, Insightful)
Do they have standing? (Score:4, Insightful)
Yep and then they will tell you what crypto to use (Score:4, Interesting)
1st step: let's force a broken security model (WEP) on all users.
2nd : limit the allowed encryption so all government agencies can come and look into your house
it's like telling someone how to run their servers
wha if I like all my access points running without any crypto and just have a tunnel inbetween my machines, and not ruoute any packets into the net that does not come from that "internal net" or VPN ?
What if i want to see wardrivers trying to mess with my access points?
What if I run Linux or BSD as an access point with my own security measures ?
What if I just hate big brother telling me how to run my home network ?
It's like the safety belt issue : I wear it as once it saved my whole family's life in a nasty crash, however I know people who are scared of it as they were stuck in a car in a rollower accident and they choose to crush their head instead of burning in a car upside down tangled in a seatbelt
Where does the FCC fit in here? (Score:4, Interesting)
Enforcement...and Job Creation (Score:2)
So, I assume the common beat cop doesn't have the skills to determine whether the protocol on a running wireless setup therefore the police departments will have to hire new people. But, with budget cuts there is no more money so they will prob
Re:Enforcement...and Job Creation (Score:2)
We already have something like that, but I don't think it's a law. it's called Citizen's Arrest. [wikipedia.org] And if you're witnessing a felony, you're legally empowered to arrest those you witness doing the felony. Now they'd have to make this a felony, and with fines like that, I doubt it's even a class c felony. It's most likely a misdemeanor.
Do lawmakers know enough to legislate this? (Score:2, Interesting)
bet the telcos are behind this (Score:2)
That's all well and good, Andy but I run an open network and frankly, if somebody breaks into my network that's my problem. I don't need people like you to tell me what to do.
The draft proposal offered this week would compel all "commercial businesses" with an open wireless access point to have a "network gateway server"
Re:bet the telcos are behind this (Score:2)
And they're shocked, SHOCKED, I tell you, to find that their network has been pwned within half an hour
Re:bet the telcos are behind this (Score:2)
I don't mind this (Score:2, Insightful)
- terrorists could potentially drive up, connect, and unleash an attack on infrastructure (power grid, etc.).
- peidophiles could drive up, and transmit their data, then leave... with nobody knowing who they are, and it being pretty much impossible to track down.
- lauching of a virus or bot attack.
No longer is traceroute a good solution to find out who is at the end of the line. Anyone can find any open
Re:I don't mind this (Score:2, Funny)
Re: (Score:2)
No it wouldn't (Score:3, Interesting)
It's allowed to be unencrypted, it just has to be running a firewall. Which is stupid. Really stupid.
I don't live in America, so this won't effect me. I just still think it's stupid. I run my own connection free of firewalls anywhere in the chain. Sure, if someone can be bothered, they could get into my files, as long as they spent long enough with a bruteforce. Hell, I even allow root connections via ssh. Unless someone's seriously personally interested in cracking my machine, I don't need one, I only run MacOS, Linux and BeOS on the net, I'm not worred about malware or viruses. My wireless data is encrypted, but it won't keep anyone out, the encryption key is exactly the same as the SSID
The only reason I have that is so the (computer illiterate) people a few houses over don't connect accidentally, and use my bandwidth for no reason. Hell, I've connected to their router and changed its channel and such to produce the minimum interference between them.
I don't care if a guy nearby has lost his net for a bit, and so uses mine for a backup. I don't care if someone driving through switches to my connection.
If someone is using too much of my bandwidth, I'll just block their MAC address for a bit. Sure, they can crack that. If they do, I'll just change my WEP password. They're bored enough to crack that as well? Fine, I'll just stop my router from giving anymore DHCP leases than I use. Meanwhile, I'll track down where they are, using the many machines and people I can pull up to pinpoint where wireless traffic is. Then, I'll go over and kick the shit out of them.
So far, no one's ever done anything with my connection that's pissed me off. I've had people talk to me on rendezvous with iChat (Or whatever it's called now, the LAN chat thing) and thank me for letting people connect.
I like sharing my internet. I once set up a directional antenna so that a friend some ways over could use it when his cable company had screwed things up.
And we pay these jackasses salaries'? (Score:2, Insightful)
Do the same here... (Score:3, Insightful)
Our politicians should do what matters for the ordinary folks like fixing health-care and other services, then legislate on matters like these. Is that too much to ask for?
Phone Companies Must Be Behind This (Score:3, Insightful)
Seriously though, one poster asked jokingly why they aren't banning insecure OS's and it sounded funny, but it does point out a problem with the bill. Certainly people running insecure OSs are just as bad for spam, and illegal activities as are free wireless, yet nobody is proposing a bill to fine those users. Naturally, if someone proposed this, MS would throw a shit fit.
Internet Traffic Ticket (Score:3, Insightful)
Violations would carry fines of $250-$500."
About time. I figure the only way law enforcement is going to enforce internet good practices is if it becomes like traffic tickets. Get caught, pay the fine. This is a good idea unless you want your access point open.
Re: (Score:2)
Industry Regulation (Score:3, Insightful)
People were talking about this being like getting fined for leaving your door unlocked. How about fining a landlord who doesn't provide locks on the doors? With the prevalence of wireless "internet router" units, many of which include basic firewall functionality, it wouldn't take much of an upgrade to make this work well. Anything that provides 802.11[bg...] should have a firewall built in and come with a VPN client - anything on the airwaves is then firewalled AND encrypted. How much would this really cost the industry? How much would it benefit the public?
battle of the law enforcement agencies (Score:3, Interesting)
OK, then when the law hops in and screams bloddy murder because they can no longer tap into our traffic, THEN what do we do?
They're all idiots. It's just that simple.
Simple solution. (Score:4, Insightful)
are they also going to make it illegal to (Score:2, Insightful)
ah, local politicing (Score:3, Insightful)
1) take down all open wireless networks (sources of free Internets)
2) install municipal subscription service at $9.99-$59.99/mo
3) PROFIT
Unenforceable (Score:3, Insightful)
Re:Great idea! (Score:5, Insightful)
Although depending on the wording of the law, this could be used to hinder anonymous internet access. Example - if you are providing a public internet access then unsecured could be interpreted as allowing access without identity verification.
And another bit of privacy is lost.
Except... (Score:4, Insightful)
Re:Great idea! (Score:3, Insightful)