I've been working recently on an open source wifi project. Re-imagining my network with less suspect gear. Read: cutting out leaky, phone home, likely backdoored, made and sold directly from China gear. Love China, good people and culture. Warfare and government games is another story.

Anyways....

I planned on bring up a mesh and once that was solid, just swapping the wifi name to the old wifi name. Because bunch of stuff on the network with credentials and I am not into hours of figuring out every piece of kit and doing the magic dance.

Simple swap-arooni.. so I thought.

Android stuff was random. A phone I putz around with I had to rekey. Likely my fault since I had hard IP in there, ignore DHCP. Different network segment, so no packets would route. I forget the STATIC IP thing in there. Oops. Computing while tired.

But Windows, have a few portables running it here (not mine, belong to others on the LAN). Windows, I don't know, latest shipping on professional version (ugly mess of a GUI) straight up would not allow the PCs to connect to the LAN.

In order to connect had to enter the wifi password, which was the same as before.

So MicroSloth actually is detecting MAC-ID or other data on wifi connection and noting the change. But in typical 85% nerd fashion, does good, but fails to explain the problem to the end user. End user should know someone man-in-the-middled them potentially. But it never says a lick about it.

Rekey it and off to races - same password. Zero user explanation.

So, Windows I have to give credit to. Right thing they did there. But no interface to explain to user.

Linux, desktop versions mind you of Ubuntu and Mint, both gave zero care.

Score one win for Windows.

Comments

You must log in or register to comment.

smartypants wrote on February 27, 2021 at 7:10 AM (edited on February 27, 2021 at 7:29 AM)

apple does it too, i believe, but informs via a os call if a ARP-MAC path hosts a doppelganger IP on a second MAC address, though not an error, because a machine can use more than one MAC over time to support one IP address

WINDOWS programs are far far worse for man in the middle attacks than other osses and weakened because calling https://tmobile.com in most tools allows man in middle downgrades to http (not https) for example due to trusting faked DNS trampoline chains. This can be seen in most all laptop cellphone cards (technically modem dongles) for windows, but never on mac implementations of same products.

multipath FAILOVER is another reason linux and apple allow OS to merely note these suspicious events, rather than block doppelgangers :

failover and multipathing originated on laser optical Fibre Channel and copper iSCSI originally, but now failover encompasses multiNIC world and SANS :

Understanding Multipathing and Failover: https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.storage.doc/GUID-DD2FFAA7-796E-414C-84CE-1FCC14474D5B.html

Multipathing is retarded in my opinion and pairs packets across two typologies and switches, but if going to two different SANS with two different powersupplies in two buildings and using RAID-0 and a hack... it is amusing to me. apples original top end SANS had multiple cables, multiple power cords, and multiple powersupplies and RAIDED 5-0 (five Oh) of 14 drives into two 7 drive clusters and multipathed for speed, but could run with 7 drives on one side of rack pulled or dead from powerout on half of that single rack. That was wehn apple bent over backward to appeal to fucktard IT losers with amazing technology... but the fucktards still bought slower cheaper stuff from dell.

so secure topologies are a mixed bag and may depend on if a device is used for certain wifi setup protocols, or a "WIRELESS PIN SETUP CODE". wifi printers use a "timeout grant" "easy passcode" setup mode to create a crypto handshake to a router... for example. I could see how that printer would NOT at all like a MAC to change between it and some other point, if printer was using "WIRELESS PIN SETUP CODE" mode, meant for small "internet of Things" devices.

so windows is sometimes less secure than linux or mac, not more secure

BlackWinnerYoshi wrote on February 27, 2021 at 9:40 AM

I agree, there are a dozen things Windows does better than Linux (tilde club clear net mirror, Tor v3 mirror, Tor v2 mirror, Freenet mirror, I2P mirror), but to be honest, Windows has ten times more issues than Linux, so I don't think those things should make us not switch to using Linux as the default operating system. But still, those issues should be pointed out, especially to Linux fanboys because they love to attack any suggestion, even if it's actually a valid suggestion.

spc50 OP wrote on February 28, 2021 at 12:59 AM

Won't catch me near Windows. If I could get it all out of my LAN I gladly would :)

Left using it back in the XP days. Quite an ugly and counter-intuitive OS on desktop. Probably same boring Windows on the Server side though.

riddler wrote on February 27, 2021 at 11:44 AM

I don't know if knowing this really improves security. It's wireless and not wired, so If someone knows your SSID and password they can already listen. Sure they can start feeding bogus DNS and stuff but that's what other higher level security protocol protect against. With wifi, once your password is compromised there is minimal advantage to having someone connect to a compromised router.

Rambler wrote on February 27, 2021 at 5:30 PM (edited on February 27, 2021 at 5:31 PM)

I think Android, or at least Samsung devices do this too. I don't recall resetting my home network but but if I recall correctly, even resetting the device or changing it with the same SSID and password will result in you having to re-authenticate to use the network, even if the details are the same.

I've got a friend who does Windows networking for offices, local factories, etc. He's dabbled in Linux and tried to convince me to get my Windows certs some time back because "networking just works" with Windows.

He may be right, I wouldn't know. But for the cost of licenses and software used it better work out of the box.