0

As we all know, HTTPS is a way to protect against session hijacking.

Suppose this isn't an option for some application. Further suppose, users connect to the web-application using a strongly encrypted (WPA2) wifi network.

Fact: WPA2 protects against third parties, which didn't connect correctly to the wifi network.

But does WPA2 additionally protected each legitimate user against each other legitimate user? Does each legitimate user has a securely isolated channel to the wifi router?

Or does the wifi router works more like a hub: If the wifi router needs to send data to a wifi client, it broadcasts it to all clients - so that each client can read the data?

Speaking of web application programming: Do we need to use HTTPS in a WPA2 protected wifi network to protect each wifi client against each other wifi client?

1 Answer 1

1

In Wi-Fi, as the transmission medium is the air, every STA could intercept data from others STA. So, for this point, you can compare a Wi-Fi network to a hub.

In fact, the 802.11 stack take care of the PHY and the MAC/LLC layers.

802.11 stack

Moreover, the WPA/WPA2 encryption is just here to protect foreign STA to read your Wi-Fi network frames.

It's very easy to test, use wireshark with two STAs on the same AP. You should be able to see frames form the other STA.

So if you want to protect a web application on a network which use Wi-Fi (and/or hub but not only), the use of HTTPS is strongly recommended.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.