Mon, 23 Sep 2002 14:44:55 GMT

by Charles Miller on September 24, 2002

Cory Doctorow has made one or two posts about warchalking recently. In one of the comments on his site, he makes the claim that “...the default assumption of the Internet is that open services can be connected to. That's as true of httpds on port 80 as it is of WiFi.”

I'm sorry, but this is simply not true. It is like saying that because you can assume it is legal to walk into a shop with an unlocked door, all unlocked doors are fair game. WiFi is not WWW, and a WiFi network is just as likely to be private as it is public even if it's not properly secured. If someone forgets to lock their door, that still isn't legally an invitation to wander through their house, even if someone's graffiti'd “Come Inside!” on the steps.

firewall-wizards moderator, Paul Robertson, put it like this:

While I realize that there are people who advertise their own networks, I think that the potential for damage for folks with large networks and angry people who've “moved on to persue other opportunities” makes the whole idea bad. Couple that with people who deploy networks and don't understand the technology and it gets worse. IMO, the folks wishing to provide open access should have chosen a common SSID and perhaps even a common WEP key. People who conciously choose to make their nets open shouldn't have a problem doing that- taking the insecure default, or worse-yet having to manage keychanges and SSID changes over a large enterprise because the intern in the mail room is pissed at his boss and things it'd be cool to publish your WEP keys and SSIDs in midtown Manhattan is a bad thing. Someone's pissed off kid chalking the home “behind the VPN” access point is a bad thing. The default of attackable and exploitable until made otherwise is a bad thing, some people will take advantage of this and worse-yet will encourage others to (perhaps inadvertantly) trespass on networks that don't belong to them.

The last thing we need is some poor innocent being prosecuted for hacking because they saw a chalk with the WEP key and SSID and thought it was made by the network operator, but it was really put there by the receptionist's ex-husband.

The best thing the warchalking community can do right now is to follow Robertson's advice. Pick a standard naming scheme for open networks, and publicise it as widely as warchalking. Otherwise, it'll all end in tears, and protestations that you thought you weren't doing anything wrong are going to be soundly, and deservedly ignored.

Previously: IDEs: focus on the basics

Next: Mini-Pattern: Error Codes