Wireless Security Issues

In Chapter 5, I extol the virtues of having a wireless network in your home or small business but only briefly touch on security. Here is a more complete discussion of the subject.

Are AirPort wireless networks secure?

A wireless network is not as secure as a network connected exclusively by wires.

An all-Macintosh network can be made more secure than a network with both Macs and Windows machines, because such a network at present requires compatible security settings, and the Mac offers a wider set of options than Windows.

If your network includes both Macs and PCs and you use the 40-bit WEP encryption provided by the AirPort Extreme Base Station, you are protecting yourself to a very significant degree while maintaining Windows compatibility. You can also hide the name of the network from outsiders and even limit network access to only your own hardware. The AirPort base station also allows you to reduce the transmitter power, thus reducing range and the potential for eavesdropping or unauthorized access.

tip

I am always surprised by how many wide-open networks are out there. These are convenient if you need to check your e-mail and happen to luck into one, but they are potentially bad news for their owners.

My own network is password and 40-bit WEP protected, and while it would be nice to have stronger protection, I am not terribly concerned.

Will other people be able to use my wireless Internet connection?

Other people won't be able to use your wireless connection, but only if you choose a good network password.

For an extra level of security, select "Create a closed network" on the AirPort tab of the AirPort Admin Utility (Figure 7.12) to hide the name of the network. A user then must also know the exact name of the AirPort network to join it.

Figure 7.12. Selecting the "Create a closed network" option in the AirPort Admin Utility increases security by requiring users to know the name of your network (it's coursey in this example) in order to connect.

You can also prevent authorized access by telling your AirPort base station to connect only to devices with specific 12-digit AirPort IDs. You will find these numbers on the labels of your AirPort cards; enter the numbers in your AirPort Admin Utility (Figure 7.13). You will also find a 12-digit ID on each of your Windows wireless adapters.

Figure 7.13. You can lock down your network by allowing only certain wireless cards to connect to your AirPort Extreme Base Station. This takes a little effort and makes it difficult for guests to use your wireless network, but it works.

Alternatively, you can do nothing and share your bandwidth with the neighbors. You can do this by either not giving your network a password (a really bad idea) or sharing the password you've created. Do this only if you really trust the people you give the password to and then be ready to change the password on the base station (and all your computers) if the need arises.

As mentioned in Chapter 5, you may run into legal problems if you share your connection. Your agreement with your ISP may include a clause intended to prevent this sort of sharing. In my mind, such sharing, done over the long term, is unethical. It costs a lot of money to install and support a broadband network, and the carriers are entitled to a fair return.

Is my DSL or cable-modem connection secure?

The security of your DSL or cable-modem connection is related to the question of whether you should use a firewall (the answer is yes).

In the Finder, open the Go menu and select Connect to Server. You can then look around the network for anything you don't recognize as your own. Some cable-modem networks are notoriously open, allowing everyone in a neighborhood to see each other's computers. This is why you should use a firewall and strong passwords.

In general, if you don't need file sharing (or any of the other features on the Sharing System Preferences pane), turn it off for greater protection.