Correct way to set up an open wifi hotspot

[xox101]

Ok folks, here is question for you. Put a password on a public wifi hotspot or not?

A little background info-

I administer the wifi in my local cafe bar. Mainly cause no one else was willing to do it! I originally set it up about three years ago as an open wifi network. Myself and the bar manager discussed whether or not we needed a password but as anyone who came into the bar would get access to it and with the difficulties of getting both full time and part time staff to remember the password and actually be civil when asked for it by someone who was drunk we decided against the idea of a password.

The bar is situated on a street that leads to nowhere except the side gate of the local bus station and a busy four lane road so no passing foot traffic.

The upstairs is also part of the bar.

The area directly behind the bar is where the buses park. The actual station is a hundred or so yards away.

There is nothing to the right hand side of the bar and to the left is a couple of shops with the bar's own pump room in between.

The bar itself is made out of concrete slabs so very little signal gets past the walls.

The router is turned off every night when the bar closes and turned on again with the lights the next morning.

I originally set the wifi up using a BT Homehub 3 on an Infinity connection. After burning through four or five of these useless pieces of junk I got my hands on a TP Link TL-WR2543ND and installed DD-WRT on it.

DD-WRT has Isolation Mode turned on in the Wireless Settings as well as the firewall obviously. It is extremely stable.

Myself, two of the bar managers and the owners daughter have the admin password for the router. In case it needs to be reset which is very rarely.

I log in to the router at least once a week (yes,I spend a lot of time in the bar!) to check nobody has been tampering with the settings or tried to install something nasty.

We have no sign in or opt in page nor are we interested in gathering information.

I have been questioned quite a few times now by the bar management and others as to why we have an open network. I'm told that setting up a password would "secure" the wifi. Each time I explain that putting a password onto a wifi network only secures that network from those who do not have the password. As it is a public bar and the wifi is for the patrons (completely separate from the bars own business network) anyone who comes into the bar has access to the wifi. So if we had a password it would make no difference. The password would be given to anyone who asked for it. Therefore in my mind there is no difference in the so called "security" of having a password. In my opinion putting a password on a public wifi hotspot under these conditions is a complete waste of time.

Am I right or wrong? Discuss.

[BigEasy]

In my opinion putting a password on a public wifi hotspot under these conditions is a complete waste of time.

Make a password for wifi. Then ask managers to print password at bar's signboard. It's the same things as give it to anyone who asked for it munus processes of asking and giving.

[Fred Barclay]

I like BigEasy's suggestion. There are lots of people (such as myself) who can't or won't step foot in a pub/bar, but could still be outside and connect to your wifi. Having the password only visible to those inside the bar will deter outsiders.
Now of course, as you said, very little wifi signal gets outside--but surely some does, right?

Besides, someone else could set up a malicious access point, make it look very much like yours, and then fool a good deal of the patrons (who likely aren't in their sharpest frame of mind) to connect to that access point, and then steal their info. For example, if your wifi is Bob's Pub Wifi, then the cracker might call his "Bob's Pub Free Wifi" or "Bob's Guest Wifi"--surely this will fool several patrons!

Setting a password would help differentiate your wifi from the cracker's, since he's likely to set up an open network. Your guests will (hopefully) remember that a password is needed, and connect to yours. Besides, surely some of them will have questions: "Why is there Bob's Pub Wifi and Bob's Guest Wifi?" which will tip you off that you've got a malicious network nearby.
If both of your networks are open, then very few people will bother with figuring out which they should use.

[BigEasy]

Every insider sooner or later became outsider. And he certainly has tongue and neighbor friends. So, it's doesn't practycal matter passworded wifi or not.
If manager want it then try do it as as said above

[Greenbike]

Might there be legal issues to consider?

An opt in page might provide you a bit of legal cover. "I promise to use this wifi connection solely for legal purposes and not to hold this business responsible for problems such as viruses, malware, data loss ...." CLICK HERE.

And if your wifi connection was ever used for something illegal or questionable, not having a password might be used by an attorney to paint the business as irresponsible in a civil action.

[xox101]

Many thanks for the replies folks.

I have had a chat with the main bar manager (the only one who understands what the hell I am talking about!) and we have come to the conclusion that a password will be set. This is purely to do with the legal issue, if we run an open network could we be accused in court of not taking proper precautions against illegal downloading? I really do not see the difference between having a password and not having one as anything illegal could be done as soon as the person who wants to do it has the password. And as a bar advertising free wifi we really cannot start picking and choosing who we give the password to! Apart from the sheer logistics of doing something like that, the number of bar staff most of whom are part time who would have to be told who is allowed the password and who isn't, we could then face a legal challenge on the basis of discrimination. A minefield indeed.

We had also considered an opt in page but the main problem with that is getting it to work on all devices. These sorts of pages are notorious for causing problems, they are supposed to automatically open a browser on the user's device with the terms and conditions. Again without me being there every day and night it would be impossible to train all the bar staff in how to solve a problem like this over multiple devices. On a Friday and Saturday night 99% of the devices connected to the router are mobile. No way to ensure that an opt in page would work on very single device. We have though thought of another solution. Old fashioned pen and paper! There is no reason why we couldn't put up a notice spelling out the terms and conditions of wifi usage. People would of course be free to ignore this but it would go some way to protecting us legally.

The problem of a man in the middle attack has bothered me for quite a while. But again a MITM attack could be carried out with or without a password. Makes no difference really.

And also the idea of someone standing outside downloading something they shouldn't? Again the problem of trying to prevent somebody doing that rears it's head. Even if we actively refuse to give someone the password there is nothing stopping that person asking somebody else. After all a secret is only a secret when only one person knows! A wifi password is exactly the same!

We get a lot of tourists in the bar. It is close to one of the big hotels here and the bar itself has been mentioned many times on various tourist blogs and sites. So a lot of strange faces sometimes. Who is intent on doing something bad and who isn't, how do we know?

So a password it is, at least then we will be seen to be doing something even if in my mind it actually makes absolutely no difference!

[Neil Edmond]

I think a posted password makes the most sense for your situation. It's still free wifi to any patrons who wish to use it, but not freely available to just anyone in the near vicinity. Not much diff, i know, but it's not a big hassle either.

[RobbertPaulson]

You could also check out an AP such as Ruckus or Meraki if you have a bit of budget for this to do it correctly. Both of these APs have a social media login. Basically you create a facebook page for your business and wifi. When the patron connects to the wifi a facebook page will open. They must first check-in to the bar to get online. So with this you get customers to post to their Facebook that they are at your bar, and you still get the captive portal and you can display your legal notice.

I believe this also works with other social media, such as twitter, linkedin, and google plus depending if you go with Ruckus or Meraki. I think there are other manufactures and models, that could be considerably cheaper, that are capable of doing this as well, those are just the two I am familiar with. I'm pretty sure Netgear also makes some.

[xox101]

Going to check these out, thank you. Ultimately the budget depends on what *they* decide to give me. Trying to get the senior management in the bar (two women around the same age as me, 50's) to understand that wifi is now a prerequisite for those under thirty is akin to banging my head against the wall. They simply do not understand the technology nor why the younger generation needs wifi no matter where they go. To be honest they still treat it as a novelty.

So the budget is going to remain the same as normal...an occasional free pint if I'm lucky!