I remembered this week that I’ve not posted here for a while so in the interest of (1) confirming I am alive, (2) making some fluff up to prevent the blog from looking “abandoned pending domain expiry” and (3) to get back in some kind of rhythm.

Honestly it’s been busy. Nobody wants to stand still and as we all work out what’s going to be the “new normal” there’s a lot of push for cloud, automation and remote connectivity. That means a lot of work to be done so less time to have a natter on the blog.

Hopefully I will have a new laptop to review pretty soon so watch out for that.

Speaking to a lot of people right now everyone’s at the stage where they’ve not much to talk about seen as they can’t leave their homes and…you know…do interesting things. I am looking forward to being back swimming and for a pint at the pub (not together though).

In the meantime I put a fresh lick of paint on the blog. Enjoy.

(Well there is but you know what I mean.)

In the UK we have gone into Lockdown 3: The Winter Crisis so there’s not much Round Tabling, swimming or pubbing to be done until the COVID-19 virus is brought under control. Fortunately consultancy is back in full swing so the bills are getting paid.

Priority number one and two for 2021 will be to stay safe and get the vaccine respectively. As a child my parents would always tell me to play outside and avoid any drugs especially needles. In 2021 they’re telling me to stop inside and get a jab as soon as my turn comes up. How times change.

Over Twixmas I did try my hand at building a PiHole on a Raspberry Pi 3 Model B that has been lurking in my drawer but I scrapped it after a week. I felt the omission of DNS over HTTP/TLS by default is too important to overlook. I plan to build a WiFi 6 core network at my house sometime in 2021.

Meanwhile I’ve been discussing PC builds with some good friends of mine as we’re enjoying Cyberpunk 2077. I’m currently drawing up a parts list for my next custom build I’ve provisionally called Build-V. Yes that is indeed because it’s the 5th custom build I’m intending to put together and yes that’s where all that petrol money I’ve saved is going.

Not dead. Honest.

I recently decided to update my wireless keys and I wanted to share some notes to help others understand what needs to be done to not only have a secure network but also one that performs well.

Tip 1: Choose WPA2.

WEP and WPA are both done for. In addition the 802.11n spec states that you must use WPA2 or else your WiFi won’t set a rate of any higher than 54Mbps. You also need WMM APSD enabled so don’t forget that either. Is there any counter argument left here?

If you are in an enterprise environment you should deploy WPA2-Enterprise which relies on an accounting method such as RADIUIS instead of shared paraphrases to authenticate. This makes it much easier to manage who or what gains access to the network.

Tip 2: choose a sensible length key with a mix of letters, cases, numbers and symbols.

Whilst you’re unlikely to have an issue with someone sat outside in a white van cracking your WiFi keys it’s no harm to choose a password that is something other than a word you might find in a dictionary.

Balance your passphrase complexity and length with user friendliness. A 32 digit key that looks like your cat had a rampage on your keyboard only infuriates your family and tires poor little fingers.

A passphrase 12 digits long with uppercase, lowercase, some numbers and a few symbols thrown in should suffice. Don’t write it down on a scrap of paper either!

Tip 3: Don’t rely on MAC filtering or hiding your SSID. They aren’t security settings. They’re actually management functions.

MAC filtering can be very cumbersome to maintain not to mention someone in that infamous white van mentioned above can sniff out what MAC adresses are transmitting on WiFi which can then be spoofed very easily.

Hiding your SSID in effect sets a flag to the device OS “do not display me”. Imagine of someone wrote software that just ignored such a flag? I’m sure someone hasn’t done that. Surely…

Tip 4: Segregate guest traffic and don’t hand out connection details to your core network.

If you want to offer guess access do it right. Even in a SOHO environment you should avoid the risk of someone introducing a malware bitten device into your network.

For best results your guest access needs to separate the guest traffic by using a VLAN. Consult your router’s documentation for specific details here.