<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; "><BR><DIV><DIV>On Nov 21, 2005, at 9:42 AM, Ross Hosman wrote:</DIV><BR class="Apple-interchange-newline"><BLOCKQUOTE type="cite"> <P align="LEFT"><SPAN lang="en-us"><FONT size="2" face="Arial">So my question is pretty simple.</FONT></SPAN><SPAN lang="en-us"></SPAN><SPAN lang="en-us"> <FONT size="2" face="Arial">You have</FONT></SPAN><SPAN lang="en-us"></SPAN><SPAN lang="en-us"> <FONT size="2" face="Arial">all these major companies such as google/earthlink/sprint/etc.</FONT></SPAN><SPAN lang="en-us"></SPAN><SPAN lang="en-us"> <FONT size="2" face="Arial">building wifi networks. Lets say I want to collect peoples information so I setup an</FONT></SPAN><SPAN lang="en-us"></SPAN><SPAN lang="en-us"> <FONT size="2" face="Arial">AP</FONT></SPAN><SPAN lang="en-us"></SPAN><SPAN lang="en-us"><FONT size="2" face="Arial"> with the same ssid as google</FONT></SPAN><SPAN lang="en-us"></SPAN><SPAN lang="en-us"><FONT size="2" face="Arial">�</FONT></SPAN><SPAN lang="en-us"></SPAN><SPAN lang="en-us"><FONT size="2" face="Arial">s ap so people connect to it and I log all of their traffic. Most</FONT></SPAN><SPAN lang="en-us"></SPAN><SPAN lang="en-us"> <FONT size="2" face="Arial">people won</FONT></SPAN><SPAN lang="en-us"></SPAN><SPAN lang="en-us"><FONT size="2" face="Arial">�</FONT></SPAN><SPAN lang="en-us"></SPAN><SPAN lang="en-us"><FONT size="2" face="Arial">t check beyond the ssid to look at the mac address but even that could be spoofed. Is there anyway to verify a</FONT></SPAN><SPAN lang="en-us"></SPAN><SPAN lang="en-us"> <FONT size="2" face="Arial">certain ap beyond mac/ssid, will there be in the future? How do these companies plan to mitigate this threat or are they just going to hope consumers are smart enough to figure it out?</FONT></SPAN></P><P align="LEFT"><FONT class="Apple-style-span" face="Arial" size="2"><SPAN class="Apple-style-span" style="font-size: 10px;"></SPAN></FONT></P></BLOCKQUOTE></DIV><DIV>You're making an assumption that all these services will work like any old AP or traditional WISP, perhaps one with open SSID, which may or may not be true.�</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>As far as open SSID is concerned, as you probably already know, there's nothing much other than VPN client from a machine you trust to some place you trust that is going to help you.� Such is the nature of the beast.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>As far as other abuse prevention voodoo and other operation and implementation specifics, I somehow doubt anyone will spill their�guts here.� One path to find a few of the answers is to discuss this very subject with the equipment vendors in this space, which shouldn't infringe on any proprietary information of the operators.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>This is still a very much evolving technology as well, so, expect fairly rapid developments to address needs as they emerge.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>Best regards,</DIV><DIV>Christian</DIV><DIV><BR class="khtml-block-placeholder"></DIV></BODY></HTML>