John Navas <(E-Mail Removed)> hath wroth:
>On Wed, 31 Oct 2007 19:27:29 -0700, Jeff Liebermann <(E-Mail Removed)>
>wrote in <(E-Mail Removed)>:
>
>>What I find amusing (or disgusting) is that any wireless provider that
>>has a functional authentication server, such as AT&T obviously does,
>>can also provide RADIUS based authentication, which the typical
>>wireless client has no problem using. The client and access point can
>>then be issues a unique one time WPA-RADIUS encryption key, and all
>>the traffic is encrypted.
>
>I suspect the issue is support -- it's bad enough when users can connect
>automatically, and it's a nightmare to support the handing out and use
>of one-time keys.
That's not exactly the way it would (should?) work. The RADIUS server
delivers the encryption key to both the access point and the client. I
have WPA-RADIUS working at several installations without any
modifications to the client computer. In all cases, the user is
issued a login and password, which are also entered in the RADIUS
server. Administering this is a PITA for a small coffee shop, but
AT&T already does everything that's necessary for their DSL customers,
so there's no added effort involved. The only changes are to convince
AT&T and Wayport to consolidate their authentication methods and to
enable WPA-RADIUS in their wireless access points. That can't be done
at this time because of bureaucracy and more important, because the
access point will not handle multiple encryption modes (WPA-RADIUS and
unencrypted). Two access points would solve that problem, but that's
a major expense that's probably not justified.
--
Jeff Liebermann
(E-Mail Removed)
150 Felker St #D
http://www.LearnByDestroying.com
Santa Cruz CA 95060
http://802.11junk.com
Skype: JeffLiebermann AE6KS 831-336-2558