Jeers! to TiVo for taking three years to figure out WPA

This afternoon, I received the latest TiVo newsletter. My TiVo and I have been drifting apart for years, in large part because TiVo seems to be falling behind. Today’s newsletter bragged about how the current TiVo software update now has WPA:

MORE SECURITY: Choose either WEP or WPA security for your wireless networks (WPA requires the TiVo Wireless Network Adapter) [Networking nerds cheer.]

Actually, we don’t cheer you. We wonder what took you so long.

A serious network engineer would never use WEP, because it is unsafe at any key length, and we’ve known that for more than six years. WPA was announced on October 31, 2002. (I remember that date because I was speaking on wireless security the day after the announcement, and the audience asked about it.) WPA-certified products have been available since 2003.

In 2003, my home wireless LAN was running WPA. When I discovered that my TiVo could only support WEP, I grudgingly pulled an Ethernet cable into the living room because I didn’t feel the need to downgrade my network security to WEP.

In September 2004, I was invited to be part of a security panel at the Wi-Fi Security Seminar in Washington, D.C. Before the panel took the stage, I vividly remember talking with David Cohen of Broadcom, who was leading the marketing efforts for the Wi-Fi Alliance on WPA2. In our discussion, David pointed out that many consumer electronics devices were supporting WPA, and that there was no reason why anybody needed to use WEP. When I pointed out to him that TiVos only supported WEP and that they had no apparent plan to support WPA, he was shocked. I never imagined that the situation would remain unchanged for the next two years.

To add insult to injury, the upgrade doesn’t help the TiVo customers who are already using 802.11. TiVo WPA support doesn’t work with just any wireless adapter like the one that most users already have stuck into the USB port. Oh no, it requires the use of the TiVo-branded wireless adapter! The TiVo adapter lists for $60, which is a pretty high price premium over a “standard” USB-to-802.11 network adapter. With careful shopping, you can get a regular Linksys/D-Link/Netgear adapter for $20 or less.

Leave a Reply