Is it a good idea to have WiFi turned on all the time?

Question

One of my relatives have internet at home and she has a single desktop computer. Sometimes when family members visit her it would be convenient if their laptop could be attached to the internet and used from anywhere in the house easily. I'm planning to install a wifi router, plug the desktop computer into one of the ports and configure secure wifi access (WPA2) for the visitors.

But I wonder if it's a good idea to have wifi turned on all the time for the occasional visitors if she uses only her own desktop computer most of the time. Is it possible someone can crack this open access point regardless of the security settings? Or it's not probable so I shouldn't worry about it?

It would certainly be convenient to have a permanent wifi access, so visitors can easily connect to the home network. I'm just wondering if keeping the access point constantly open is a wise idea. What do you think? Can it be a problem or is it perfectly all right if wifi access is configured with proper security and encryption?

Solution 1

If protected by WPA2 with a strong password (e.g. not "password" or "house" but "P45Sw0rd" and "h0U53") there's no reason why you shouldn't leave it on but the power use. Ask yourself this: Who on earth would be interested in going through all the effort of cracking your WiFi network key? Are you in a government's top secret department?

If you also protect the router's configuration panel with a password, it's all pretty secure...

Read this part, and the rest of my blog post about WiFi security here: http://blog.superuser.com/2011/03/28/iron-cladding-your-wi-fi-network/

Happy reading!

Solution 2

I'd turn it off when not in use. Probably not going to be a huge security advantage if it's properly secured, but it is of some advantage. Also, there's power savings to be had and reduced EM spectrum pollution if it's off.

Solution 3

The security risk of leaving wifi on all the time is low and is overweighed by both the added security this relative will get by not being plugged directly into the Internet and by the added convenience of not having to teach this relative how to switching on and off wifi as needed. You know you'll be the first call each time a visitor needs wifi.

Do use WPA with a strong password though. Give her a USB flash drive with the password on it to lend to visitors.

Solution 4

Well, this question is hard to answer. We need to take few things into consideration.

First: Are any there crackers in neighborhood?

Second: Is there any real motive for someone to crack her network key? Remember that sometimes practice is a good answer to that question. Another would be covering tracks for illegal activities. For criminals, it's always better to have a party van come knocking at a neighbor's door than their own.

Next: What does she have to lose in case someone does gain access? There is a chance that someone may use her Internet connection for serious crimes, but I think that it would most likely be that cracker just wants to avoid paying for Internet. If her Internet connection is charged by the amount of data transfered, then this may be a problem.

Next: Is there anyone who is willing and able who wants to target specifically her? If there is, no amount of MAC whitelisting and complicated passwords are going to save her. An enemy will be able to find a way in. If not, then her best bet is to be a more difficult target than it is usual for the area. If someone is just looking for an Internet connection to use, he'd probably look for the least protected one.

Next: What are her chances of detecting intrusion? A few years back I set up a wireless network at my friend's apartment (who has very bad relationship with computer security) . He later added several more computers and everything worked fine. I was visiting him once and during conversation, he mentioned that his Internet connection was very slow lately. I decided to check his router settings. Of course he forgot the password, but I wrote it down on the router just for such occasions. After some investigation, it turned out that someone accessed his network, cracked the password for his router, changed it and had two computers running torrents connected!

So for conclusion, here are my opinions: If she is in a risky neighborhood or if she can't detect that someone is using her connection or if Internet crime is aggressively prosecuted in her area, then it's safer to leave the access point off and turn it on when needed.

If there is a low chance that someone is going to pick her as a target (for example there are unsecured or WEP networks in the area) or if she can check router logs every few weeks a most, than with a good passphrase she should be safe.

Keep in mind that MAC addresses can be changed on network hardware and even if there is no active connection, the access point may be provoked enough to emit enough packets to make the key vulnerable.

Another interesting point is the router itself and available options. If there are settings for key lifetime, they should be set to short. This way, there will be lower chance that it can be cracked, especially if activity of the network is going to be low. It would be a plus if router can send e-mail if someone keeps poking around it and if it can send its logs periodically, but such features aren't common among home routers. Another plus is if there can be set a list of IP addresses from which admin access would be allowed.

Solution 5

In theory having Wifi secured with WPA2 with access control list (based on mac address) your wifi is more/less secured. However if you are a bit paranoid (very good property of system admins and security guys) than switching router ON/OFF will be a good idea. If you need more security obstacles use Radius with PPPoE authentication which is used by some good well managed Wireless ISP (WISP). But this requires more then 5 minutes to build and more then 10 to understand how it is going on. Additionally new laptops with "wonderful Windows magnificent 7" or Vista that will be used to surf on internet will cause major configuration problems and consume your time. So it is a matter of trade off security vs. usability - as always.

View more solutions

Comments

[ogre]

You might also want to enable the setting that means you can only configure the router from a "wired" connection, if your wireless router supports this for that little bit of added safety.

[user3660103]

In my opinion, it's a bad idea to disable SSID. Computer which do connect to network will keep looking for it even when they are far from the network. The fact that SSID is hidden does not make network any harder to access from standpoint of crackers. There are numerous articles which explain why that is a bad idea, but here's one blogs.technet.com/b/steriley/archive/2007/10/16/…

[user3660103]

@BloodPhilia Well, that what you wrote is the point of my post. Unless there is someone specifically targeting Tom's relative, she should be safe.

[user3660103]

+1 for EM pollution. Not many people think of that.

[KeithB]

All of these suggestions will make it much harder for guests to access the system. It would be simpler on everybody to just turn it off when not in use.

[uxout]

While I normally agree with restricting access by MAC whenever possible, it isn't possible here. The scenario is primarily use by visitors - there's no way to have the MAC addresses until they're already there!

[nhinkle]

Some routers also have the ability to configure a schedule for when the wireless radio is on or off, so you could have it automatically turn itself off at night or something if you want.

[Brian Knoblauch]

The setup that I use is to throw the router on a power strip. That power strip becomes "the Internet" to the user. They flip the switch to turn "the Internet" on and off. Works REALLY well with computer illiterate people. They're already used to turning cable TV on/off, so this is the same thing, but for the computer.