A security researcher has determined that nearly every WiFi device in the world — your phone, your computer, your router, and on and on — has a flaw in their security protocol that makes them vulnerable to hackers that could hijack them, track your activities, or worse.

ZDNet reported on the hack early Monday, saying that it was discovered by computer security academic Mathy Vanhoef and first reported on his website.

Per ZDNet:

The bug, known as "KRACK" for Key Reinstallation Attack, exposes a fundamental flaw in WPA2, a common protocol used in securing most modern wireless networks. Mathy Vanhoef, a computer security academic, who found the flaw, said the weakness lies in the protocol's four-way handshake, which securely allows new devices with a pre-shared password to join the network.

That weakness can, at its worst, allow an attacker to decrypt network traffic from a WPA2-enabled device, hijack connections, and inject content into the traffic stream.

In other words: hackers can eavesdrop on your network traffic.

The bug represents a complete breakdown of the WPA2 protocol, for both personal and enterprise devices -- putting every supported device at risk.

"If your device supports Wi-Fi, it is most likely affected," Vanhoef says.

The vulnerability, Vanhoef says, "can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on. The attack works against all modern protected Wi-Fi networks."

This includes "devices running the Android, Linux, Apple, Windows, and OpenBSD operating systems, as well as MediaTek Linksys, and other types of devices," Ars Technica reports.

"Depending on the network configuration, it is also possible to inject and manipulate data, Vanhoef says. "For example, an attacker might be able to inject ransomware or other malware into websites."

Before you think that sticking with HTTPS-protected sites will keep you safe, Vanhoef warns that "this extra protection can (still) be bypassed in a worrying number of situations."

"For example," he writes, "HTTPS was previously bypassed in non-browser software, in Apple's iOS and OS X, in Android apps, in Android apps again, in banking apps, and even in VPN apps." You can read the full explanation of the vulnerability here.

ZDNet reports that "News of the vulnerability was later confirmed on Monday by US Homeland Security's cyber-emergency unit US-CERT, which about two months ago had confidentially warned vendors and experts of the bug."

According to Ars Technica, the US-CERT alert was "distributed to about 100 organizations." It read:

US-CERT has become aware of several key management vulnerabilities in the 4-way handshake of the Wi-Fi Protected Access II (WPA2) security protocol. The impact of exploiting these vulnerabilities includes decryption, packet replay, TCP connection hijacking, HTTP content injection, and others. Note that as protocol-level issues, most or all correct implementations of the standard will be affected. The CERT/CC and the reporting researcher KU Leuven, will be publicly disclosing these vulnerabilities on 16 October 2017.

This is ordinarily the part in a news report where we tell you how to keep yourself safe and/or how officials are fixing this. However, news on either of those topics remains sparse, and ZDnet says as of this morning that "Wi-Fi should be considered a no-go zone for anything mission critical."

Ars Technica takes the matter equally seriously, saying that "people should avoid using Wi-Fi whenever possible until a patch or mitigation is in place. When Wi-Fi is the only connection option, people should use HTTPS, STARTTLS, Secure Shell, and other reliable protocols to encrypt Web and e-mail traffic as it passes between computers and access points."

Previously: Disqus Reports Breach Affecting 17.5 Million Pre-2012 Users

As long as there have been cell phones, riders of Muni's light rail system have been afflicted with the scourge of no bars (now dots, I guess) any time the vehicles plunged beneath the earth's crust. But according to the SFMTA, riders' nightmare of disconnectedness might soon be over (as long as you think well over a year counts as "soon").

"Muni tunnels still have no cell service," reads an SF Chronicle headline from 2013. In the report, an N Judah rider tells the reporter that every time the train heads into an underground tunnel, "I'm just left here on my own with my own thoughts and the people around me." A fate, we can all agree, that should be wished on no one.

At the time, the paper reported that "Muni has zero underground cell phone coverage, and there is no firm timeline for installing antennas in the downtown subway or any other tunnel...Muni officials have asked cell service companies if they would install the equipment free of charge, but have not gotten a lot of interest."

"While this is a resource we would like to provide, we have significant state-of-good-repair needs, and our main priority is to invest in our service," San Francisco Municipal Transportation Agency spokesperson Paul Rose said at the time.

"We are going to continue to work with cell phone providers and consider funding options, but the main priority is to improve service," he reiterated later.

But by last August, things looked fractionally better, with Rose saying that Muni is “in the process of exploring our options for Wi-Fi or cellular service in the Muni Metro...We understand that many of our riders would be interested in this service."

And it appears that that exploration has reached a conclusion, as a press release sent by the office of Board of Supervisors president London Breed Tuesday evening announced that "Board of Supervisors President London Breed, BART, and Muni Announce Plan to Bring Cell Phone Service to Muni Tunnel."

"After months of collaboration with Muni and BART officials, Board of Supervisors President London Breed, BART, and Muni will announce a proposal to finally provide cell phone service for Muni subway riders," the release reads, saying that all will be unveiled at a 9 a.m. press conference at the "Muni Van Ness underground station, mezzanine level on the north side of Market (between All Star café and Walgreens)."

In a press release sent Wednesday morning by Breed's office, more details of the plan were revealed: Apparently, the MTA Board will next week mull a proposal to allow "BART to negotiate and enter into license agreements with telecommunications carriers on behalf of the SFMTA to extend BART’s existing underground cell infrastructure and provide Muni customers with reliable cellular coverage."

BART, the release notes, "already has an underground cellular network, used by AT&T, Verizon, Sprint, T-Mobile and Metro PCS" and "constructed the nation’s first neutral host underground cellular network that allows competing carriers to use the same equipment, extending competitive cellular markets to the underground while minimizing the amount of wayside equipment. BART and Muni will now collaborate to extend the existing BART cell network to the Muni subway."

Assuming the SFMTA Board OKs the proposal, the contract will next head to the Board of Supervisors. And after that, we'll be on our phones all the time, right? Not exactly, as according to Breed's office, "the construction to extend BART’s existing network to the Muni subway is expected to take approximately 12 to 18 months once an agreement is reached with the cellular carriers," with all costs "expected to be covered by the cellular carriers."

"It is further expected the carriers will pay annual licensing payments for operating on the network" with a contract that "could provide reliable cellular coverage for a 15-year term, plus two five-year options."

“We have heard from our riders who have asked for cell service in the subway for some time, so we are working to deliver this amenity in partnership with BART,” SFMTA Director of Transportation, Ed Reiskin says via press release.

“Providing cell service within the Muni Metro will help improve communications to our Muni riders," Reiskin said, "can assist in emergency situations, and will give the riding public an additional service they want,” and will finally, finally save that poor N Judah rider from being left with his own thoughts ever again.

Related: Why We May Never Have Wi-Fi On Muni Or BART

You'll recall how last year BART canceled that contract they had with a wi-fi service provider after five spotty years of service that drew thousands of complaints. Well, commuters and the Chronicle's Michael Cabanatuan alike have been wondering if the late-night shutdown of the Muni underground system will be coming with wi-fi installation on the Muni system, and the answer is a resounding "Nope."

As we discussed earlier, the six-month inconvenience that Muni is putting us through, cutting off train service between 9:30 and 10 p.m. every night and necessitating bus bridges, is only accomplishing some more mundane technical upgrades, including the underground radio system and emergency phone system in the tunnels.

And as officials at CalTrain, Muni, and BART all confirm for the Chron, the task of wi-fi enabling a long stretch of tracks or the interior of a steel train is logistically difficult and highly expensive, thus the promises we've had of years past — not to mention the promise of free, citywide public wifi — have not come to pass.

We should be thankful, at least, that there is some limited cell service in BART and Muni tunnels, but mostly only on BART within city limits and part of Oakland.

Muni officials, apparently, think that budget shouldn't be diverted from more important things, like the purchase of new rail cars, and I think we all should see the wisdom there. Trains that work, and that aren't overcrowded constantly, are more important than trains where you can check your Facebook.

Nonetheless Muni spokesman Paul Rose says the agency is “in the process of exploring our options for Wi-Fi or cellular service in the Muni Metro." And even though that statement alone translates to "you may see it in ten years" in SF bureaucratic speak, he adds, "We understand that many of our riders would be interested in this service."

Related: You Won't Be Able To Get Home On The Muni Underground After 10 PM Starting July 31

A giant wall will soon be at the beach to provide you shelter from the Sun's rays and a Wi-Fi signal to upload that beach bod selfie to Instagram.

The four-story Shadow Wifi is monolithic structure that'll provide beachgoers with shade and free Internet service, while also raising awareness of the dangers of skin cancer. Users will have access to the network when they are anywhere within the wall's shadow, and be sent an email with health tips. To stay connected through the day, users will have to follow the shadow and stay in the wall's shade. As demonstrated in the video above, the wifi is beamed from a directional antenna that moves along with a sensor that tracks the Sun.

It's like a friendlier version of the monolith from 2001: A Space Odyssey.

"It gives [people] a really good reason to actually seek some shade: free Wi-Fi. And at the same time we are of course informing them, and potentially preventing skin cancer," said Geoffrey Hantson of Happiness Brussels. The Belgian agency teamed up with the Peruvian League Against Cancer to install the first walls at Playa Agua Dulce, according to psfk. More will be coming soon to San Francisco and New Zealand.

And if you're worried that Shadow Wifi will give you brain cancer while protecting you from skin cancer—well, it won't.

Though you may have found some free wi-fi in BART stations and on some trains the last few years, the test program under which that was being provided has now ended. As BART spokesman Jim Allison said in a statement issued this afternoon, "BART has terminated its License Agreement with WiFi Rail, Inc. (WFR)," adding that WFR service had only been offered in downtown San Francisco and Oakland and on about 5% of the train fleet. The trial program may be over, but SFist asked Allison why the contract was terminated, and this is what he said.

WiFi Rail, Inc. (WFR) offered service on a free test basis for several years in limited areas and the test concluded.

WFR has not submitted an adequate financial or technical plan for completing the network throughout the BART system. Also, the performance of the constructed portions of the network did not meet expectations.

38 of BART's 669 car fleet were equipped; also, service was available at some stations.

Going back to January 2013 BART was sounding some alarm bells about WFR, saying they were having "trouble coming up with the capital needed to fulfill the contract" and noting riders' dissatisfaction with the weak signal and connection charges they were being asked to pay. The WFR contract dates back to 2009 and was at the time billed as a 20-year agreement, as Bay City News points out.

Cell service in some stations, which dates back to 2009, will not be affected. But it seems like this might affect some of your connectivity in downtown BART and Muni stations where you may have been relying on this free wi-fi without realizing it. BART says it is "working to have mobile phone service throughout the remainder of our tunnels and underground stations, including those in Berkeley and on the Peninsula," but that won't be completed for a while.

Best of luck getting those emails out.

Update: Sacramento-based WiFi Rail is now threatening to sue saying that BART is illegally backing out of a contract. As WFR's CEO Cooper Lee tells the Chronicle, "The principal issue was trying to expand coverage, but they’ve been consistently blocking our ability to do so... The contract we have with them says that they are to let us know of any bad service and we correct it within 30 days. They haven’t done that. Instead they canceled what was supposed to be a 20-year contract with no just cause."

Well over a year after San Francisco announced a partnership with Google to put free WiFi in San Francisco parks, the service is finally ready for launch.

As reported in July of 2013, Google gave SF a $608,000 grant to pay for equipment, installation, and maintenance of the wireless network for two years. According to the Ex, a planned April launch of the service was delayed because "testing and installation took longer than expected."

It's unclear what the city's plan for managing the program after those two years are up is (calls from SFist to SF's Department of Technology were not returned at publication time), but a 2013 report from TechCrunch says that "Mayor Ed Lee says it will be San Francisco’s responsibility to maintain the network, but it will tap local commerce organization and tech partners for support."

It'll be interesting to see how that plays out, as a plan to set up free WiFi for the whole city several years ago between SF, EarthLink (remember them?), and Google crumbled over, among other things, fears that the tech companies providing the service would profit. Will SF find other tech companies willing to offer selfless support? Guess we have time to figure all that out.

The parks program will be joining SF's free public WiFi network along Market Street from The Embarcadero to the Castro, as well as multiple free hot spots around the city. All free, public, city networks, including those in public housing, City Hall, SFPL branches, and places like the DeYoung Museum and the Legion of Honor will eventually be named #SFWiFi, Miguel Gamino, acting CIO of the Department of Technology told the Ex, making the SF's network that much easier to find. If you need help figuring out how to access the network, here's the city's page on how to connect.

Per a document released by SF's Department of Tech, here are the parks that'll have the WiFi. All, except for Dolores and Boedekker Parks should be up and running today:

1. Alamo Square
2. Balboa Park
3. Bernal Heights Recreation Center
4. Boeddeker Park (WiFi should be available about 30 days after the park's reopening, expected in November 2014)
5. Chinese Recreation Center
6. Civic Center Plaza
7. Corona Heights
8. Crocker Amazon Playground
9. Duboce Park
10. Eureka Valley Rec Center
11. Gene Friend Rec Center/SoMa
12. Hamilton Rec Center
13. Huntington Park
14. Joseph Lee Recreation Center
15. Justin Herman Plaza
16. Margaret Hayward
17. Marina Green
18. Minnie & Lovie Ward Rec Center
19. Mission Dolores Park (WiFi won't be available until after construction is completed, which will be "some time in 2015")
20. Mission Rec Center
21. Palega Recreation Center
22. Portsmouth Square
23. Richmond Recreation Center
24. St Mary’s Playground
25. St Mary’s Square
26. Sue Bierman Park
27. Sunnyside Playground
28. Sunset Playground
29. Tenderloin Children’s Rec Center
30. Union Square
31. Upper Noe Recreation Center
32. Washington Square

According to the Ex, the average speed of SF's public WiFi is 10-15 megabits per second down and 7-10 Mbps up. If those speeds are consistent, we at SFist might actually get dressed, leave the house, and start writing for you from the great outdoors.

Super-psyched about this development? You can always head to the Tenderloin Rec Center at 11 a.m. today, where Supervisor Mark Farrell and Mayor Ed Lee will be joined by Rec and Park General Manager Phil Ginsburg and Gamino to officially kick off the program. Or you can just head to the park, get online, and let us know how it goes!

Delightful. The dream of working remotely from Dolores Park might soon become a beautiful, frolicking reality. The fine folks at Google unveiled plans today to give San Francisco parks free wifi -- 31 of them, in fact. For those of you with old unlimited data plans, and thus disallowed to tether, today is a red-letter day.

Google will pay an estimated $600,000 over the next two years to install wireless connectivity in Dolores Park and Civic Center Plaza, just to name a couple. Free wifi should be available by April 2014.

TechCrunch has more:

Google’s $600,000 gift will pay for equipment, installation, and maintenance of the wireless network for two years. After that, Mayor Ed Lee says it will be San Francisco’s responsibility to maintain the network, but it will tap local commerce organization and tech partners for support. If the public’s reaction to to the “Free Wi-Fi In The Parks” program is positive, Google’s gift could pave the way for wider Wi-Fi. Google has paid for limited wireless networks in neighborhoods of New York and Boston, and also set up a paid fiber-optic network in Kansas City.

During the announcement in Balboa Park Mayor Ed Lee said, "We are behind. I call us the innovation capital of the world but we need to catch up. This is where the relationship with the private sector is so important to us.”

Best of all this means that, providing the weather glows, no more having to go to a cafe and pay for 1-2 hours worth of wireless when your home connection breaks down.

Years ago, if you recall, the city had plans with Google and Earthlink to provide us with free wireless. Alas, that never came to fruition for fears of tech companies profiting. Google, though, has promised this time around that the wifi will come with "no strings attached."

Oh, speaking of Google, the company also had some sort of new Chromecast / Nexus 7 tablet announcement today in Dogpatch. They served lots of bacon and english muffins in chaffing dishes. That was our takeaway. (Read more.)

[TechCrunch]
[KGO]

Part of the plan to make San Francisco run exclusively on sunshine and eco-righteousness, the city plans on erecting 360 new Muni bus stops "that'll further the causes of both solar power and blanketed Wi-Fi at the same time." According to the September issue of Popular Mechanics, the stops will be kind of cool. Details are as follows:

Serving the Public: San Francisco’s high-tech bus stops will channel an estimated 43,000 kilowatt-hours per year into the city’s grid. Built-in Wi-Fi routers will help the city create a comprehensive wireless Internet network.

Paying Its Way: Each bus stop costs about $30,000. City officials say Clear Channel Outdoor has an installation and maintenance contract with the SFMTA. The company foots the bill and gets saleable ad space.

Conserving Juice: The new shelters’ LED lights use 74.4 watts—four and a half times more efficient than the 336 watts used by the old shelters’ fluorescent lighting.

Woo hoo, right? But, the free Muni wifi won't be with us until 2013. And, by that time, we'll all be using the computers implanted in our eyeballs and brains, rendering today's laptop and wireless connectivity useless.

Thanks, periqueblend, for the tip.

So many recalls afoot these days, we're starting a new column! Today's recall news: a reader passed along these pictures of today's rather-sparsely attended Recall Peskin rally on the steps of City Hall. Looks like they got about a quarter of the 40 folks who signed the Peskin recall petition in the first place -- and it looks like we're the only people who even have news of the event up anywhere online.

Our source called it "a show of farce," reporting that the only excitement was a moment when the videographer (pictured at left) was asked if he was a Peskin agent, you know, like that George Allen macaca incident. No response, and then the speaker was like, "he didn't deny it." Oooh. Also, as you can tell from the less-than-lusty "Recall Peskin" chants on the audio clip below, it might be a challenge getting those 3300+ signatures for the recall petition.

powered by ODEO

In other recall news, Kim Knox from Left in SF has filed an ethics complaint against the people running the McGoldrick recall because adorable gadfly Kimo Crossman discovered they're not properly registered as lobbyists.

Not to be outdone, the folks running Recall Daly say in response that they've filed an ethics complaint too, over the politicking in Supervisor Chris Daly's blog. We're like, wow, Daly finally updated his blog yesterday!

After the jump: pictures of the excellent signage at the Recall Peskin rally, including "Peskin Doesn't Care If You Can't Have A Pet."

Not that we'd want to give him any ideas, however.

In the not-so-happy side are homelessness, crime, and housing, all of which were listed as concerns. According to the pollsters crime wasn't even listed by many people in 2003, but is now listed as the top concern by 24%. Homelessness was listed as a concern by 41% of the residents, housing was at 25%, and public education was at 24%.

Also, according to the survey:
-63 percent of San Franciscans want the San Francisco 49ers to remain in San Francisco
-Fifty-one percent are for a public-private wireless Internet network, 19% want a city-run WiFi network.

The question seems to be a matter of who should run the WiFi-- should a company control it or should the city run it they. The key hitch to having it built and controlled by the city, besides the fact we can barely keep our streets clean, is finding the $10 million dollars to pay for it all. The Google and Earthlink deal had them building all the infrastructure for free. That's free, as in zero, nada, zilch dollars. Chris Daly is leading the push to go city-wide and asked the Controller’s Office to somehow find the $10 million or so to run the WiFi. Hey, what about trying under the cushions at all the couches in City Hall? On the other hand, the Google/Earthlink set up sounds kind of crappy.

Of course, this wouldn't be a debate in the city without some sort of catty little quips. Jake McG said the Board should consider every proposal because "Room 200 does not have a license to do dictatorship work, and that's why this is before us today." And Chris Daly added that we shouldn't necessarily go with the Earlthink/Google deal just because "they're popular, and they're snappy dressers." Surprisingly, Byorn held back in his comments back and just said the usual political spin. Come on, Peter-- what kind of debate is it in this city if everybody just makes bland, political comments?

Anyways, Left In SF has a pretty good summary of the pros and cons of the Mayor's proposed plan.

So you're Alex Tourk. Everything is fine and honky dorky until your wife, out of the blue, admits to having a fling with not only your boss but one of your best buddies. Even worse, it appears the everyone in the city (except us) knew about it but you didn't. Man, that's one hell of a bad week. Whenever we see these storylines on TV or in the movies, it always ends badly, like in people being shot and killed badly.

So where are we with all of this? Well everybody is still loving the story. It's in this week's Newsweek and Time. Wonkette finally weighed in on it (says a commentor: "Oh this is SF. They love making mountains out of mole hills at every perceived ethical lapse.") and the story even made Perez Hilton. SFGate reports they had their biggest date ever in terms of page views. When the images from SFGate linked to Drudge, the site slowed to a crawl. But with a story this juicy, how could people not be into it?

The first immediate question is what's next for the Gavster? As he tried to get back to his job, the question is just how good of a job can he do? As the Chron says, now that he's been taken down a notch or two, a lot of things he wants to work on-- homelessness, health care, the WiFi deal-- is considerably more of a challenge due to either distractions or a lot of people being even less willing to help him. Already, one fund raiser has been cancelled with the possibility of another being cancelled too. But as even Newsweek says, San Francisco is a fairly forgiving place. Says Wille Brown, a man who knows a few things or too about catting around: "being a hedonist is not a disability in San Francisco.” And God love San Francisco for that. On the other hand, some people are geting huffy over it.

Picture from SFGate