Seems like a pretty useless security feature. In order to get the
information, the hypothetical hacker would have to have physical access to a
station connected to the router admin page. He or she would either have to
be looking over your shoulder when you type the WEP key, or you'd have to be
dumb enough to leave the screen with the dots on it unattended for some
period of time. The other possibility is a hacker monitoring an unencrypted
admin session with a wifi client, but then the hacker already grabbed your
WEP key itself, so the number of dots displayed is irrelevant.
Even then, a pure dictionary attack is not feasible. Most successful attacks
exploit weak IVs and predictable or observed regularities in the data. Since
there are only a few possible keylengths, if a dictionary attack actually
yielded results in a reasonable time, you could probably just run an attack
assuming a 64-bit key, and if that fails, run one assuming a 128-bit key.
I'd reconfirm that the router and the clients actually are set for the
keylength you're trying to use.
"Todrogas" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> On 9 Apr 2004 08:20:24 -0700, (E-Mail Removed) (tom williams)
> wrote:
>
> >further to replies to my initial posting:
> >
> >i typed in 26 digit/alpha hex key for wep when requested, and
> >reconfirmed correctness - yet dots for only about 10 characters show
> >up when i go back to check
>
> That, by itself, may simply be a security feature of the router. I
> have configured a router that did the same thing (don't remember which
> model). By always showing ten dots instead of the actual number of
> characters that were entered as a key it is making it hard to guess
> the password based on the length. A dictionary attack would be much
> easier if you could limit it to word or phrases of x charactor length.
Similar Threads
Linear Mode
