justanotherguy
@dslextreme.com
| As noted above, the best use of WPA or WPA2 is via strong passphrases, at least when using pre-shared key. The better system would be to use an EAP-based system (a la RADIUS server) but that requires an AP that supports it, plus you need to set up a RADIUS server as well as client identity credentials (certificate, password, etc.). It's a lot more moving parts to manage, but it's the best way to keep rotating your Pairwise Master Key between authenticated sessions. Aside from LEAP (and perhaps MD5), I'm not aware of any tools that attack 802.1X.
But for small-scale use, WPA / WPA2 is the practical way to go, plus using an SSID that can be considered unique (something that probably won't exist in a rainbow table). Defeating WPA-PSK security is still based on dictionary attacks. |
