Should WPA2-AES be presumed insecure? (What is the "Hole196" vulnerability?)

Question

I saw it mentioned in an answer here about firesheep, but I've never heard of it -- Should WPA2 be presumed insecure?

In short, WPA2 is still fairly secure against external threats. Insiders though - people who have your network's SSID & PSK - can sniff the wireless traffic of others on your network. — Iszi, Sep 14 '12 at 01:55

score 5 · Accepted Answer · edited Mar 17 '17 at 13:14

WPA2-AES should be considered secure against "outsiders": people to whom you have not given the cryptographic key / passphrase.

WPA2-AES is not secure against "insiders". People who you have given the cryptographic key can access the network and may be able to eavesdrop on communications of other users. However, usually this is acceptable and beyond the scope of what we are expecting the network to do for us.

See also How do I protect myself against 'hole 196'? and this summary of hole196.

Also, make sure you read about the vulnerability in Wifi Protected Setup (WPS). Probably you'll want to disable WPS. See, e.g., this question for some citations where you can read more about the WPS vulnerability.

Should WPA2-AES be presumed insecure? (What is the "Hole196" vulnerability?)

1 Answers1