TidBITS:
Don’t panic about the new Wi-Fi security problem that you’ve likely seen trumpeted on news sites. Yes, the KRACK exploits reveal a fundamental flaw in the process by which a Wi-Fi device — like a Mac, iPhone, Windows computer, point-of-sale terminal, or smart fridge — connects securely to a Wi-Fi access point. You shouldn’t underestimate how significant that is (it’s huge), but also don’t overestimate how likely it is to affect you (very unlikely).
Make no mistake – this is very bad. But it’s not as catastrophic as some make it out to be.
I guess it depends on your definition of “very bad” and “catastrophic”. Most Android phones will never have this fixed. Almost no IOT devices will ever have this fixed. Just those two means hundreds of millions of devices will never have this fixed. That’s pretty catastrophic in my books.
But the odds of any individual ever being exploited is pretty small. That’s, I think, what they were getting at. The bug is serious and the things you point out are serious, but for any given user, the odds of us being attacked are tiny. They go up, I’d imagine, in urban areas where lots of wifi points exist and if you’re a company, esp one that might have interesting information
Really, the mitigating factor these days is how many sites use SSL*.
(What are we supposed to call this, anyway? SSL, even though it isn’t? TLS, even though so few know what it is? SSL/TLS, just to tip everyone off? https, even though that looks ridiculous? ARGH. No, ARGH is not an option…)
Apple says they’ve fixed this in their latest betas.
Yet, they haven’t rolled out a patch. I’ll take Apple’s advice.