That's a reasonable position to take for networks in general like coffee shops, but if I'm paying WeWork to provide office infrastructure, I expect the network to not be malicious, just like I expect not to need to boil and chlorine-treat the water I get from their water fountains.
Application layer security doesn't just mean VPNs. What websites are you connecting to with sensitive information that don't use HTTPS with HSTS preload nowadays?
Here's one from just yesterday: the password reset form for sched.com, which the Linux Foundation uses for schedules, is HTTP. I had to follow this link to upload my slides for a talk I'm giving at a LF conference next week.
Yes, the ideal, which we should all be actively working towards, is HTTPS. That doesn't mean that the world is already there.
What is a "proper service" in this case? Many company networks routinely allow access using fairly straightforward and rarely rotated passwords. Of course, access to actual company resources like email require 2FA etc.
But as others note, the main purpose of having a password at all is to stop casual passersby from leeching off your network.
So now there’s significant complexity to getting on the network. Seems like a poor choice for a co-working space. And, as I say, plenty of large companies with competent IT departments don’t seem to think that’s necessarily.
And how about when you’re having a meeting with outside people who need to get onto a network?
Most universities and schools have a similar setup. No idea how WeWork works but I assume you have some sort of user account already (how do you pay them otherwise?) that you can use to authenticate yourself. Then your AP just needs to talk to a auth gateway (usually RADIUS) which then talks to your actual auth backend (LDAP, AD, or whatever online login form they use).
For guests you either generate guest account or just have a guest network. We don't care if guests fight over the guest network because there aren't that many of them around at any one time... the problem is that actual WeWork customers shouldn't be fighting over insecure APs.
Every WeWork member has a dedicated account which is tied to their company and badge (which is used for building access). This account is also used for reserving rooms.
Fair enough. Although I'm familiar with quite a few situations where most people just use a single network for wireless (whether employees or guests) and confidential company resources are put behind SSO and/or VPN using 2FA.
Others do have separate networks of course and maybe that makes sense in the case of something like WeWork that probably has more people who aren't employees/paying customers coming in and out and getting on the network than the typical company office does.
I think the problem is that providing internet access is part of WeWork's core product. It doesn't matter if your accountant's office just has one shitty wifi connection for everyone -- you'd still go visit them even if they didn't have wifi. But literally the entire point of WeWork is renting space to work, with internet. They should be held to a higher standard in this regard, IMO.
> So now there’s significant complexity to getting on the network
Not really, every OS (even Network Manager does a good job) has support for the WPA enterprise login flow. You basically get 1 prompt to trust a cert, then enter your username + pass (usually tied to AD) which you can save to your OS keychain. I've never had to fiddle with the one at my corporate network since first signing in months ago.
I don't know about the actual security benefits, but I do know it stops the typical "capture the handshake & game over"
> And how about when you’re having a meeting with outside people who need to get onto a network?
You set up a crappy rinky-dink "FooBarGuest" network with a PSK that has no real access to the rest of the network and pretty much can just be used for web browsing.
