New WPA3 Security Standard Introduced for Routers and Devices

The WPA3 security standard is formally finished and ready for introduction according to the Wi-Fi Alliance, which developed the protocol. The new follow-up to WPA and WPA2 is intended to replace them with a standard that, well, hasn’t been cracked yet. There’s more to say on the topic, but that’s what the announcement boils down to. WPA has been breached enough that it’s now considered generally insecure, and some high-profile attacks like KRACK and the ability to predict the Group Temporal Key have breached WPA2 as well. It’s time for a new, (temporarily) secure standard.

One of the major features of WPA3 is its resistance to offline dictionary attacks. With WPA2, if you can observe a single password exchange between a person signing on to a network and the router, you can take that data and attempt to brute-force it via an offline dictionary attack. But WPA3 no longer relies on the same Pre-Shared Key (PSK) that WPA2 used. (Note: This discussion only applies to WPA3 Personal, not WPA3 Enterprise, which didn’t rely on the same PSK algorithm in the first place).

As PCMag reports, the only way to crack into a WPA3 network should be if you’re already connected to it…which largely removes the benefit of hacking it in the first place. The Wi-Fi Alliance also notes that WPA3 includes protections that kick in “even when users choose passwords that fall short of typical complexity recommendations,” which appears to refer to this additional password obfuscation. WPA3 also remains interoperable with WPA2 networks, though this apparently means WPA2 devices can connect to routers using WPA3 without compromising the security of other connected devices. The WPA2 device, presumably, does not gain any benefit from WPA3 security changes or improvements while connected to a WPA3 router.

Alongside WPA3 in its personal and enterprise flavors, the Wi-Fi Alliance also announced Wi-Fi Certified Easy Connect, which aims to let you add an IoT device (typically one with a limited display, or without a display at all) to a Wi-Fi network using another device with an easier interface. An example would be scanning a product quick response (QR) code with your phone. Then there’s Wi-Fi Enhanced Open, which is intended to provide “improved data protections while maintaining the convenience and use of open networks.” Exactly how much protection will be provided is something we may not know until we see how shipping hardware handles the standard — there’s often a rather significant gap between how these standards are intended to be used and how they’re actually deployed.

It’s also not clear if we’ll see older devices patched to provide support for WPA3, or if that support will be particularly robust. Each time a new security standard is released, there’s an inevitable period of “well, I’ve got Product A and Product B and they’re both supposed to support this thing… but won’t connect to each other while using it.”.

Continue reading

Senators Call for 100Mbps Minimum Broadband Standard

Multiple US senators are calling for the US to adopt a 100 Mbps upstream/downstream broadband standard in 2021. The pandemic has shown a light on holes in US infrastructure, especially in rural areas.

Motherboard Vendors Unhappy With Alder Lake’s 12VXO Power Standard: Report

Intel's new ATX12VO standard should arrive with Alder Lake, but OEMs may not be entirely on board.

Valve Appears to Have a Standalone VR Headset in the Works

The prototype is suspected to be able to operate without a companion device or tracking boxes—perfect for a type of gaming that's never been exactly spontaneous.

Towards PCIe 7.0 and Blazing-Fast Storage: Why Engineers Have Hit The Gas on Interconnect Standards

PCI Express 7.0 should be released by 2025, with hardware landing somewhere between 2026 - 2028. Why has performance been growing so rapidly after sitting still for seven years? We investigate.