Wifi password VS MACs filtering - in terms of speed vs security

Background

First I need to say that I know about how better it is to secure the wifi network even with WEP , than to not secure it at all, and I know there is a thread asking a similar question like Is securing Wifi with MAC Filter enough? and Router password vs MAC filtering?.

However, I was told by a fellow of mine that it totally ruins the speed of the wifi by half, from 70 Mbps (without any password protection) to less than 30 Mbps (with password protection).

He offered to remove any password protection and use specific MACs list that will allow only specific devices to connect.

However, as far as I know , this allows other to sniff about everything that is transmitted, so he said there is not much to sniff as the important websites (like ebay and paypal) are already secured via SSL and such.

My question

Is he right? Why would the wifi become so slow with a password? Does it mean that I would always have to choose between speed and security to such an extend? I thought that the encryption is very fast and can't slow down the internet connection that much...

android developer

Posted 2013-10-10T22:35:03.050

Reputation: 861

Do not under any circumstances pay attention to this person. Use WPA and do not bother with MAC filtering. The overhead from encryption is minimal. – Paul – 2013-10-10T23:10:21.020

but that's the speeds that we got. i saw it too. – android developer – 2013-10-10T23:10:59.760

Please [edit] and add more details about your environment. Whatever the problem is, removing security is not the solution. – Paul – 2013-10-10T23:12:06.493

"the speeds that we got" - so you have done some of your own benchmarking? You only seem to be speculating in your question? – MrWhite – 2013-10-10T23:23:24.300

Your friend is full of it. Filtering by MAC addresses is trivial to bypass – Ramhound – 2013-10-10T23:53:59.240

1You mentioned 70 Mbps and 30 Mbps.. so you're doing internal-network speed test, not outside/internet speed test? – Darius – 2013-10-11T01:19:47.613

no, we used the website "speed-test" and one that is inside the country (bezeq : http://www.bezeq.co.il/support/Pages/speed_test.aspx ) .

– android developer – 2013-10-11T07:34:55.240

If you are only dealing with internet speeds then I do struggle with how you can possibly see any speed difference between encrypted and non-encrypted traffic. How fast is your internet connection?! I just did a crude test with my smart phone wifi (internet connection) with encryption off/on and there was no difference between the two. I get 28Mbps down in both cases. In fact this is the same whether I use a modern PC on a Gigabit ethernet connection. – MrWhite – 2013-10-11T07:50:09.330

@w3d could it be that it's a hardware problem? the router is in fact an access point , which is "WNAP-1120PE" model by "Planet" . it says "802.11n wireless PoE Access Point" . oh, and about the speed, we are connected to a 100Mbps connection (also paying quite a lot), so it's also annoying that we get much slower connection on a secure network. – android developer – 2013-10-11T08:04:11.763

I strongly disagree with the the posts first sentence: 'Protecting' a network with WEP does not add any useful protection anymore. You might as well leave it off. It does offer the illusion of protection, so it is actually worse than an unencrypted network. – Hennes – 2013-10-15T09:55:49.457

@Hennes most websites that i've read say that it's better to use WEP than to use an open network. hacking into a password-protected network should always be harder than hacking into one that doesn't have it, since the password protected one encrypts everything. – android developer – 2013-10-15T10:19:11.930

'Hacking' WEP comes down to downloading a program and running it for about 10 seconds while in range of the target network. That is not much protection. Anyone who can google can log in. Which means you will still need to encrypt all your data (e.g. use SSH, sFTP, HTTPS etc). I saw many people skip that last part since 'the network is protected anyway'. That kind of fake safety can be dangerous. I can understand though why very poor security can be better than no security at all though. – Hennes – 2013-10-15T10:26:01.130

@Hennes didn't know it's 10 seconds, but still a poor security should be better than none, right? in any case, i'm talking here about MAC filtering, and it's so weird that i can find a way to hack WEP with tools for windows but not this one... – android developer – 2013-10-15T10:56:05.650

Why not use wireshark to see which MACs are used on a wireless network? There is a windows version. The MAC address is the value in the source field, as in this picture. However showing how trivial it is to bypass MAC filtering does not help you with 'Why does my network become so slow when I enable encryption with $my_hardware?'

– Hennes – 2013-10-15T11:38:40.853

@Hennes shouldn't i first need to connect to the network before wireshark can sniff from it? anyway, you are right about the speed, which is the issue here (i was confused with another post i've written on this subject, here: http://superuser.com/questions/657567/how-to-find-the-mac-addresses-of-an-unsecure-network-on-windows-using-the-easi ) . yes, the question is how come the speed is so awful when using encrypted network against non-encrypted network.

– android developer – 2013-10-15T11:57:19.120

No, there is no need to connect to the wireless network to sniff the data. Since it is being send though the air you just need to be in the same area. When the data is encryption (WEP or otherwise) you might not get much readable data, but the MAC address is an unencrypted part, so you can always read that. After that you go though the computer version of these steps

– Hennes – 2013-10-15T12:02:23.777

@Hennes i know that in theory this is correct. i just asked about wireshark. are you sure it's capable of doing those things without connecting to any network? if so, please write how to do it in an answer for the link i've written, and i will check it out and tick it if it's correct. – android developer – 2013-10-15T17:02:34.567

You are talking a lot about WEP encryption!? Are you actually using WEP on your network?! This could be contributing to your problem. You should not be using WEP, you should be using WPA2+AES instead. Not only is WPA2 much much more secure (and supported by all WiFi certified hardware since 2006), it is also much much quicker on new hardware! – MrWhite – 2013-10-15T18:55:06.507

@w3d no i'm not. i spoke the truth. i didn't lie. i only wrote what i've found info about. however, i will ask again which type of encryption method was used – android developer – 2013-10-15T22:12:02.713

Answers

MAC filters are by no means strong, if an adversary can sniff you network over a period of time, so you are correct there.

As for speed, it depends on a number of factors, but mainly comes down to how much you are taxing your device, and how fit it is for your usecase. Encryption carries overhead with it, so the manufacturer designs their devices to have sufficient resources for the performance you want. In fact, wireless N was designed to use WPA2 or better and runs faster than with lesser encryption protocols.

if you have newer hardware, and a modest number of clients generating reasonable loads, I would expect you to see little to no difference over unencrypted. if you have an older router however, or your clients are out of control, the overhead could drown your router.

Frank Thomas

Posted 2013-10-10T22:35:03.050

Reputation: 29 039

it is WPA2 and wireless N that were tested. How could it be that the speed was drastically slower compared to no password at all? do you consider MAC filters enough for home usage? – android developer – 2013-10-10T23:10:27.273

@androiddeveloper MAC address filtering does nothing, unless you can be certain no malicious person will ever be in the vicinity of your home. Ever. – Paul – 2013-10-10T23:13:26.140

2@androiddeveloper it's kit possible your benchmarking process is flawed – Ramhound – 2013-10-10T23:56:16.403

we've tested both using the "speed-test" website, and one that is inside the country: http://www.bezeq.co.il/support/Pages/speed_test.aspx

– android developer – 2013-10-11T07:37:22.863

It's fairly trivial to defeat a MAC whitelist. A search for "mac address changer" will turn up a variety of options, and airmon-ng is commonly used to find out what MAC addresses are connected to a network.

As for encryption slowing you down, this is unlikely unless you're really using ancient hardware. Anything else will do the crypto in hardware, and should be designed with full throughput in mind.

But, if in doubt, it should be easy enough for you to run a quick test.

jjlin

Posted 2013-10-10T22:35:03.050

Reputation: 12 964

How do you use this tool in order to get the mac address of a network ? i wish to show that it's totally insecure. – android developer – 2013-10-11T08:06:23.510

1@androiddeveloper: Basically: airmon-ng start wlan0 (enable monitor mode); airodump-ng mon0 (monitor packets sent by actual users); wait a while for airodump to capture users' MAC addresses; airmon-ng stop mon0 (turn off monitor mode), ip link set wlan0 down (turn off WiFi), ip link set wlan0 addr ab:cd:ef... (copy-paste an actual user's MAC address from airodump's output), and you're done. Takes about 2-3 minutes if someone else is using the network. On Linux one doesn't even need a "MAC address changer" – it's a basic OS feature, accessible through ip link. – user1686 – 2013-10-11T11:01:15.727

"airmon-ng" doesn't exist (should be in the "bin" folder right?). since most people still use windows on their PC, i assume that if it's really needed to use linux, that would narrow down the chance of being hacked. having to use a terminal is also not mainstream and i doubt that will convince anything about how not-sufficient it is to use mac filtering. – android developer – 2013-10-11T11:50:22.103

even on linux (which i've ran now), when going to the terminal after downloading the package, i can't see any executables named "airmon-ng". – android developer – 2013-10-11T12:16:58.577

You can boot a distribution like Backtrack from USB pretty easily. – jjlin – 2013-10-11T16:23:10.583

(Ignoring the hilarious argument that "having to use a terminal is not mainstream"...) As an alternative, iw dev wlan0 interface add mon0 type monitor and iw dev mon0 del can be used to manage monitor interfaces, and Wireshark or tshark or tcpdump to collect MAC addresses. – user1686 – 2013-10-18T23:36:36.380