Login Prompt on a Network

Question

My dad said he wanted to make our new router ask for a password before connecting and then allow computers that already entered the password connect automatically without the password.
I told him that it's called encryption.
He said the connection speed with encryption was "too slow" and told me to look up how to do what he described.

Ironically, he was a C++ software engineer for most of his life.

How can I get the setup he describes up and running easily? Or convince him that it's impossible/not worth doing his idealism?

Note: Should have mentioned that I live in a rather distanced development so there's only 2 or 3 other WiFi networks nearby, all WPA'd.

Answer 1

I would say he's making a practical mistake (maybe two) and you're making two theoretical mistakes.

You're confusing authorization with authentication. (It's a common confusion.)

• Your dad is proposing an authorization policy: a computer that attempts to connect and that has provided a password in the past does not need to provide a password again.
• For our purposes here, a computer can be identified by the MAC address of the Ethernet interface (wired or wireless) that will connect with the router.
• However, a MAC address is not good for authentication, because it can easily be spoofed (many Ethernet cards allow you to change their MAC address at will). This is (if you're reporting his point of view correctly) your dad's practical mistake: without cryptography, you won't be getting much protection. (You will get some protection against a casual attacker.)

Notice I wrote cryptography, not encryption. Encryption provides confidentiality, that is, eavesdroppers wouldn't be able to snoop on your network. This may well be desirable, but what you're after here is authentication, and that does not derive directly from encryption (if you just encrypt a password in transit, an attacker can snoop on and replay the encrypted password and be authenticated as well). Cryptographic protocols such as SSL/TLS (the S in HTTPS), and more relevantly here WEP and WPA, provide some form of authorization as well as encryption.

It may be possible to implement your dad's authorization policy (that depends on your router model), but as I said before it wouldn't be very secure. WPA2 is the recommended security option for wifi networks (for wired networks, controlling physical access to the plugs is the usual solution; if you use PLC this may not be possible).

If am unconvinced that using cryptography would slow down your connection. It might add a little bit of latency, typically not enough to matter. As far as bandwidth is concerned, the physical medium is usually the limiting factor (if it's not, consider upgrading your router — you might get better radio equipment and so better speed even without encryption).

If you go for WPA, you would set a password in the router, and authorize any computer in possession of that WPA password to connect. You would then enter the password once on every computer that should connect (your software will remember the password for the next time, so you won't have to enter it again). That would provide a user experience similar to what your dad envisages, and a security that should be acceptable to you.

Answer 2

You can use an HTTP redirect, depending on what options your router has, it may be built in. Here is an example of how to do it in DD-WRT. It is basically the same function that many hotspots use, such as hotels or coffee-shops.
In any case, the overhead of using encryption on a router is still very low. Yes, it does reduce your speed a bit, but it won't have any effect on your internet connection speed as that is drastically lower than a typical wireless connection anyway.

Answer 3

I would say he either needs to upgrade the router or his computer if "encryption" is playing a factor in speed. IMO, encryption is vital to a secure network and in most cases is transparent to the user with modern hardware.

If he's still bent on having a password, perhaps look into DD-WRT or similar open source firmware and enable something similar to ChilliSpot for hotspot use. I cannot vouch for the security of your content when using ChilliSpot's or similar setups.