How to secure wifi?

[cowlum]

[QUOTE} If you can, hardwire rather than than use wifi. .[/QUOTE]

This is certainly the best way to secure your wifi network..

You've gotta love wifi on a boat though, no wires to sever, limit a computers movement or connections to corrode.

If I had my way all my devices (VHF, AIS, laptop, phones etc) would connect to a wifi access point and I'd do away with wires altogether but thats off topic.

[SeanPatrick]

Originally Posted by AKA-None

You configure your system to only allow connections from specific systems

There is an option on my router to refuse any and all new connections.


You can log on to your router by typing its IP address into your browser (usually something like 192.168.1.1 or 192.168.0.1). The default username and password are usually "admin" for both or the password is literally "password". Sometimes the default logins are written on the router somewhere. Be sure to change the password after you log in. I tested my neighbors' networks once and was surprised to find how many were using the default password.


Once you're logged on to the router, there should be some security options available to you. But you may have to poke around a little to find them. Sometimes you need to switch to an "advanced mode" first to get access to all the options. You may also be able to see a list of all devices that have ever connected to your network and to whitelist/blacklist individual devices and more


My router even has the option of emailing me with activity logs and/or notifications of certain events.

[cowlum]

Originally Posted by SeanPatrick

There is an option on my router to refuse any and all new connections.


You can log on to your router by typing its IP address into your browser (usually something like 192.168.1.1 or 192.168.0.1). The default username and password are usually "admin" for both or the password is literally "password". Sometimes the default logins are written on the router somewhere. Be sure to change the password after you log in. I tested my neighbors' networks once and was surprised to find how many were using the default password.


Once you're logged on to the router, there should be some security options available to you. But you may have to poke around a little to find them. Sometimes you need to switch to an "advanced mode" first to get access to all the options. You may also be able to see a list of all devices that have ever connected to your network and to whitelist/blacklist individual devices and more


My router even has the option of emailing me with activity logs and/or notifications of certain events.

This is a good option.
Another is to set the the router to accept only the MAC addresses you specify (though not imperviable). Of course this will be annoying when you want to use your friends phones nav software in a pinch.

[CarlF]

People make the whole password thing too hard.

I use this password strength checker to pick a password that it estimates would take a 1 million+ years to crack. Length is more important than complexity. Cracking an 8 character gibberish password takes minutes while a 16 character password of simple words and numbers is extremely secure. No one tries to brute force a 16 character password - there are easier targets. As I am paranoid, I change a character before typing it into the checker

https://howsecureismypassword.net/

And more importantly:

Never use the same (or similar) password in two places

Never provide a password after clicking on a link in an email.

Never give guessable answers to "forgot password questions" - for example, What city were you born in? Toaster . Never use the same answer on different sites.

Always use two-factor security if it is offered.

[triibutu]

Cracking an 8 character gibberish password takes minutes

When talking about guessing passwords for remote systems (and not trying to crack a leaked hash locally), it's the speed of the *target* that determines how long it takes. An 8 character password can take about half a billion years to guess, if the target only accepts one try per day.

Hence, old slow routers are harder to brute force

[CyKlop]

There are lots of ways to make difficult passwords. One of the things I do is come up with a phrase, for example:

!This is a strong password and is very hard to break!

Now take the first letter, or so, from each word.

!Tiasp&ivhtb!

and note that "break" sounds sort of like br-eight-k so let's add in the 8

!Tiasp&ivhtb8!

But it's not too difficult to remember. However, the problem, as with any password scheme, is also one of _reusing_ passwords. Theoretically, we should never reuse a password for two different things/places/sites. However, our memories just aren't that good about something like that, which is why I use a password manager.

Hmm, I don't like the "a", so I'll change that too:

!Ti@sp&ivhtb8!

[cuneytm]

-Select WPA2-AES encryption with a strong password as mentioned in here
-Configure Hidden SSID ( which means your wifi zone does not appear on other device's wifi list.)
-Filtre MAC addresses. ( There are two addresses on each internet device, IP address and MAC address. You can add your device's mac addresses on your wifi device.

These things above would be hardened your wifi zone to get rid of mid-level hackers. To bypass these items a guy must be really motivated to gain access your zone.

[triibutu]

Originally Posted by CyKlop

Now take the first letter, or so, from each word.

Why weaken it? The sentence itself is a much stronger password and has a higher probability of being remembered.
If using a password manager anyway, the extra length doesn't matter.

[Anders]

Originally Posted by cowlum

This is a good option.
Another is to set the the router to accept only the MAC addresses you specify (though not imperviable). Of course this will be annoying when you want to use your friends phones nav software in a pinch.

Waste of time. All you have to do is to sniff the MAC and then change your computer to one of the whitelisted addresses.

[cowlum]

Originally Posted by Anders

Waste of time. All you have to do is to sniff the MAC and then change your computer to one of the whitelisted addresses.

Agreed but its another small hill to climb.

I think its all a waste of time, as i said before. I'd happily run an open network on my boat but all I do is push nmea data around when underway which I present to phones, tablets and occasionally the laptop. If I were 'working from home' on my boat it would be a different story.

For the record, I'm very aware hacking happens. Im a systems engineer by trade and have had my company issued laptop hacked to gain domain access. The hackers gained my admin password by getting on the network through a support centre users account which had the password summer2018, then they used a windows patch vulnerability to pull the admin password from my laptop. The department responsible for laptop patching got in trouble and the company pleaded with its employees to use good passwords. None the less, I don't worry about my boat wifi.

edit: I do run a password on my boat so I guess my money isn't where my mouth is

[ggsail42]

Oh! Finally something on this forum that I know something about and can contribute something for a change instead of asking dumb questions! I still have to have a day job and I do cybersecurity for a living.

First, you won't ever stop hacking "attempts". Bots and programs are out there trying every single way in to everything. You can thwart successful attempts, however, by following these basic rules:

Wifi Router
- Turn off SSID Broadcast. This is the name of your wifi router and if you know it, that's all that needs to know it. The run of the mill kid won't find it as a result. (I can still find it, but most of us hackers out there boating would rather be sailing or diving than hacking!)
- As others said, put a strong password on it and bonus points for the XKCD comic. Pick 4 random words, uses spaces. Make it easy to type and remember.
- Use WPA2 Encryption with said strong password.
- Keep your wifi router up to date with the latest firmware. Yes, wifi routers can have vulnerabilities too.

Home / boat devices
- Update your Microsoft Windows machines every 3rd Tuesday of the month. (Patches come out 2nd Tuesday, but a good idea to wait and make sure nothing causes problems first).
- Setup your windows machines to use the Windows Defender and Firewall. I'm not a Windows fan, but these actually work quite well.
- Don't click links. If your bank send you an email, go to your bank site directly. Trust but verify.

General recommendations
- Use a password manager like LastPass or 1Password. It will help you not reuse passwords and also recognize that you are actually on the site you mean to be on before entering your bank credentials!

There are two main ways bad actors get in - first by tricking you to click on a link, and second by you forgetting to patch something. The first is more common than the second.

If you are on Social Media - be careful what you click on there as well.

Feel free to DM me if you want more specific details for your setup (but don't send TOO many details!). Happy to help!

[ggsail42]

Originally Posted by CarlF

People make the whole password thing too hard.

I use this password strength checker to pick a password that it estimates would take a 1 million+ years to crack. Length is more important than complexity. Cracking an 8 character gibberish password takes minutes while a 16 character password of simple words and numbers is extremely secure. No one tries to brute force a 16 character password - there are easier targets. As I am paranoid, I change a character before typing it into the checker

https://howsecureismypassword.net/

And more importantly:

Never use the same (or similar) password in two places

Never provide a password after clicking on a link in an email.

Never give guessable answers to "forgot password questions" - for example, What city were you born in? Toaster . Never use the same answer on different sites.

Always use two-factor security if it is offered.

While I actually do know who Mark Burnett is, and this site is fine, please, never, never, never type your actual password into a site like this. It might go on a registry of passwords to be tried for "brute force" attempts!

[ggsail42]

Originally Posted by CyKlop

There are lots of ways to make difficult passwords. One of the things I do is come up with a phrase, for example:

!This is a strong password and is very hard to break!

Now take the first letter, or so, from each word.

!Tiasp&ivhtb!

and note that "break" sounds sort of like br-eight-k so let's add in the 8

!Tiasp&ivhtb8!

But it's not too difficult to remember. However, the problem, as with any password scheme, is also one of _reusing_ passwords. Theoretically, we should never reuse a password for two different things/places/sites. However, our memories just aren't that good about something like that, which is why I use a password manager.

Hmm, I don't like the "a", so I'll change that too:

!Ti@sp&ivhtb8!

I'm afraid the hackers know this one. What they look for is when they are able to crack a site and get the plain text passwords (ie, LinkedIn) they look for the email addresses associated with patterns like this and then try to work out the pattern (using computers to do all of this). So if you use the same pattern and just swap out a few letters for what site it belongs to, you can pretty much count on that password also being compromised.

[ggsail42]

Originally Posted by Stu Jackson

Why does anyone need to remember any passwords? If you're using different ones for each "account" most people connect to bunches of different places, so for the average Joe, there may be anywhere from a dozen or more. Who can remember all of these? Wouldn't a prudent person write them down somewhere?

Yes! For someone who is at home, on land, with reasonable security (and who trusts the folks they live with), writing down your passwords in a book that stays by your computer is certainly reasonable. As my father would say "If someone breaks into my home, I will honestly have bigger concerns." He lives with my mother in a gated community. So this is probably true.

For us boaters, some of us full time (not me yet, but soon!) if you need to write down your passwords, please consider using LastPass or 1Password. There is even a mobile app so you don't even have to remember it on your phone! LastPass is free for browser use. I do not work for either company.

[ggsail42]

Originally Posted by jim King

how about using a VPN?

A VPN (Virtual Private Network) will prevent your internet service provider and any other computers on your network from being able to see any of your computer browsing requests "in transit".

I use one as part of my job so my data from my work computer to my office is encrypted. If my son should happen to try and use a software tool to read my information as it passed across our home network, he could see nothing but jumbled info from my work computer.

But from my home computer, he couldn't see much more. For instance, when I do a Google search, the connection is encrypted (https) and even my post on this forum when I hit "send" is encrypted.