Evan Schuman's StorefrontBacktalk

A unique password and IP address, assigned by central IT and with the password never available in plaintext to any store employee? That’s getting closer, and it is probably enough to discourage any casual digital vandals. There are too many combinations to make that any fun.

But a dedicated hacker blessed with way too much time and obsessiveness? Now we’re talking about sniffing Wi-Fi traffic, which is easily within the capabilities of even minor miscreants. Older signs that require outdated Wi-Fi encryption are easily cracked. That means just to keep a Wi-Fi-accessible sign secure, you’ll need up-to-date Wi-Fi encryption and unique, secret-from-associates passwords—and that’s true with a mobile app or a PC, no matter how locked down the PC is.

A display that’s wired into the network with no Wi-Fi access is far safer, because associates would be likely to notice someone physically working on the display (at least you hope they will). But there’s a reason wireless displays are popular: convenience.

One workaround: Use wireless displays, but never update them when the store is open and accessible to hackers who can sniff the wireless network. If the store and parking lot are empty, it should be safe to connect with the displays after hours—presuming they’re all on a different Wi-Fi channel than any other Wi-Fi you regularly use in the store. Yeah, that’ll go over big with store managers.

And that also pretty well demolishes the ease and convenience that updating the signs with a mobile app was supposed to offer anyway.

Just as it comes down to security on one side, it comes down to convenience on the other. No wires? You’re at greater risk. Anytime updates? Still more risk. Mobile apps? Probably even more risk.

It’s a tradeoff that may come down to a practical decision: Isolate the displays on the network and make them more convenient to update (by managers or miscreants), or lock them down and make them safer but harder to use. Realistically, most chains will add just enough security to make the displays safer—but not so safe that they’re really hard to use.

That will probably irritate IT security, but it’s worth remembering that any customer with a marker can leave graffiti in a store, no matter how good network security is. Besides, it could be worse: Considering how much access some chains have handed directly to trouble-making customers—remember those naughty videos at Best Buy?—even just a password starts sounding relatively secure.