Usability vs. Security: The Everlasting Trade-Off in the Context of Apple iOS Mobile Hotspots

Please always quote using this URN: urn:nbn:de:bvb:29-opus-47556
  • Passwords have to be secure and usable at the same time, a trade-off that is long known. There are many approaches to avoid this trade-off, e.g., to advice users on generating strong passwords and to reject user passwords that are weak. The same usability/security trade-off arises in scenarios where passwords are generated by machines but exchanged by humans, as is the case in pre-shared key (PSK) authentication. We investigate this trade-off by analyzing the PSK authentication method used by Apple iOS to set up a secure WPA2 connection when using an iPhone as a Wi-Fi mobile hotspot. We show that Apple iOS generates weak default passwords which makes the mobile hotspot feature of Apple iOSPasswords have to be secure and usable at the same time, a trade-off that is long known. There are many approaches to avoid this trade-off, e.g., to advice users on generating strong passwords and to reject user passwords that are weak. The same usability/security trade-off arises in scenarios where passwords are generated by machines but exchanged by humans, as is the case in pre-shared key (PSK) authentication. We investigate this trade-off by analyzing the PSK authentication method used by Apple iOS to set up a secure WPA2 connection when using an iPhone as a Wi-Fi mobile hotspot. We show that Apple iOS generates weak default passwords which makes the mobile hotspot feature of Apple iOS susceptible to brute force attacks on the WPA2 handshake. More precisely, we observed that the generation of default passwords is based on a word list, of which only 1.842 entries are taken into consideration. In addition, the process of selecting words from that word list is not random at all, resulting in a skewed frequency distribution and the possibility to compromise a hotspot connection in less than 50 seconds. Spot tests show that other mobile platforms are also affected by similar problems. We conclude that more care should be taken to create secure passwords even in PSK scenarios.show moreshow less

Download full text files

Export metadata

Additional Services

Share in Twitter Search Google Scholar Statistics
Metadaten
Author:Andreas Kurtz, Felix Freiling, Daniel Metz
URN:urn:nbn:de:bvb:29-opus-47556
Series (Volume number):Technical reports / Department Informatik (CS-2013-02)
Document Type:Report
Language:English
Year of Completion:2013
Publishing Institution:Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU)
Release Date:2013/07/11
Tag:Authentication; Password; Security; Smartphone; Usability; Wireless Hotspot
SWD-Keyword:Sicherheit; Benutzerfreundlichkeit; Drahtloses lokales Netz; Smartphone; Passwort
Institutes:Technische Fakultät / Technische Fakultät -ohne weitere Spezifikation-
CCS-Classification:D. Software / D.4 OPERATING SYSTEMS (C) / D.4.6 Security and Protection (K.6.5)
K. Computing Milieux / K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS / K.6.5 Security and Protection (D.4.6, K.4.2)
Dewey Decimal Classification:0 Informatik, Informationswissenschaft, allgemeine Werke / 00 Informatik, Wissen, Systeme / 004 Datenverarbeitung; Informatik
open_access (DINI-Set):open_access