As students and faculty have no doubt noticed, logging into the campus wireless network is more obnoxious and intrusive now than it was last year.
Now, not only do you have to sign in and identify that the computer belongs to you, but you must also complete a quiz about Internet piracy. What you may not know is the whole registration procedure does nothing to actually prevent piracy or make those who do pirate any more accountable.
I assume that most recognize that the quiz about piracy, much like the comical alcohol education class, will do nothing to actually affect anyone’s behavior. Those who intend to pirate on the campus network will not change their mind because of an obligatory quiz.
But it’s not the quiz that is meant to deter piracy; it’s the fear of being caught that comes along with having to register your computer under your name. However, the actual implementation of the network registration makes even this deterrent basically worthless.
To understand why, it is necessary to briefly explain how network authentication technically works.
Every wireless card has a specific digital signature called a MAC address. When you first register your device with the network, the network stores your MAC address in a database along with information that identifies your computer as belonging to you.
Every other time you connect to the campus network, the network checks your MAC address against its database, and if it sees that you have registered before, it lets you use the network. Because the campus network knows your MAC address, it is able to identify you if you are pirating. Consequently, people will not pirate for fear of being caught and those who do pirate will be held accountable.
In reality, as any computer-savvy person will tell you, this technique does not work. It is trivially easy to change your wireless card’s MAC address with freely available software. It is also easy to use software to intercept the packets of network users around you which will tell you what their MAC address is.
It does not take a computer science major to figure out what to do next. You collect a few MAC addresses of other network users, then you choose one and change your MAC address to match it. If you try to get onto the network under this spoofed MAC address, the network will think you are using some other registered computer and let you use the network.
I am not saying I have done this before, but let’s just say a friend of mine has done this on multiple occasions.
This glaring hole in the way the network works defeats the very point of having anti-piracy measures in place.
Not only are those wishing to pirate still able to do so anonymously, they end up implicating innocent bystanders in the process.
The consequence of this is that even if you believe that very few people will go through the minor trouble of spoofing their MAC address, you still have no idea if someone who is “caught” pirating is actually doing so. It could just as easily be someone else who has taken on their MAC address to get through the network unidentified.
I am not a lawyer, but I have to imagine that this makes holding anyone accountable for piracy very difficult. Those with the above knowledge who are caught should be able to defend themselves by saying that someone else likely impersonated their device and that they are not to blame.
In short, the network authentication is so easily bypassed that it does not deter dedicated pirates, does not make them any more accountable, and has the side-effect of leading to false accusations of the innocent.
Sadly, I imagine those in the IT department are fully aware of this flaw, but were required by those higher up to implement something that looks like it is helping to prevent piracy.
However, given how flawed the current network is in actually preventing piracy, I think it is perfectly reasonable to be annoyed when forced to waste time on a useless quiz just so we can all make-believe that it is helping.
— Matt Bruenig, philosophy senior
