Wireless security

Wireless security is the set of rules that decides who may join a Wi-Fi network and keeps the traffic in the air private. On a wired network, an attacker has to get into the building and plug in a cable. On Wi-Fi, the signal leaks into the car park, the flat next door and the street. Security has to work even when the attacker can receive every radio frame you send.

💡 In simple terms: Wi-Fi without security is like talking loudly in a busy café: anyone at the next table can hear. Wi-Fi security does two things: a door with a lock (only people with the key get in) and a private language (even people who overhear cannot understand).

Why Wi-Fi needs its own security

• Radio goes through walls. You cannot control who is in range.
• Listening is invisible. A laptop can capture every frame without sending anything, so you never see it.
• Joining is easy. Without a lock, anyone in range can join and use your internet, reach your printers, or attack your devices.
• Fakes are easy. Anyone can set up an access point with your network's name.

Authentication vs. encryption

Two words come up constantly. They solve different problems, and good Wi-Fi security needs both.

A third goal is integrity: making sure nobody changed a frame on the way. Modern Wi-Fi encryption adds a check value (a message integrity code) to every frame, so a tampered frame is dropped.

Where Wi-Fi security sits

Wi-Fi encryption protects only the radio hop between your device and the access point. The AP decrypts each frame before sending it onto the wired LAN. To protect data all the way to a website, you need end-to-end encryption such as HTTPS (TLS) or a VPN.

Open networks and their risks

An open network has no password: anyone can join, and frames are sent without encryption. Many cafés, hotels and airports run open networks, often with a captive portal (the web page where you accept terms or enter a room number). A captive portal controls access to the internet, but it does not encrypt anything.

🔓 Newer APs offer Enhanced Open (also called OWE, Opportunistic Wireless Encryption). It still needs no password, but each device gets its own encryption keys automatically, so passive listening no longer works. It does not prove that the AP is genuine, so evil twins are still possible.

The history: WEP, WPA, WPA2, WPA3

WEP: broken, never use it

WEP (Wired Equivalent Privacy, 1997) was the first Wi-Fi security. It used the RC4 cipher with a short 24-bit “initialisation vector” added to the key for each frame. On a busy network those values repeat within hours, and researchers found ways to work out the key from captured frames. Today, free tools recover a WEP key in minutes. Any device that can only do WEP should be replaced or kept off the network.

WPA: a stop-gap

WPA (2003) was a quick fix that could run on WEP-era hardware, using a method called TKIP. It too has known weaknesses and is now deprecated. If your router offers “WPA/TKIP”, do not use it.

WPA2: the long-time standard

WPA2 (2004) introduced strong encryption based on AES, in a mode called CCMP. It comes in two flavours, Personal and Enterprise, explained below. Its encryption is still sound; its main weakness is how the Personal version uses the password.

WPA3: the current standard

WPA3 (2018) replaces the way the password is used with SAE, makes management-frame protection mandatory, and is required on the 6 GHz band. Most devices since about 2020 support it.

WPA2-Personal (PSK): how it works

In Personal mode, everyone uses the same password, called the pre-shared key (PSK) or passphrase. The password itself is never sent over the air. Instead:

1. Both the client and the AP turn the passphrase and the SSID into a 256-bit master key, the PMK (pairwise master key). Every device with the right password gets the same PMK.
2. After association, the AP and client run the 4-way handshake. Each side sends a random number (a nonce). From the PMK, both nonces and both MAC addresses, each side calculates a fresh session key, the PTK (pairwise transient key), for this one device.
3. Each side proves it got the same answer by adding a check value (MIC) to its messages. A wrong password gives a different PTK, the check fails, and the AP rejects the client.
4. The AP also hands over the GTK (group temporal key), shared by all clients, used for broadcast and multicast frames.

⚠️ The weakness of WPA2-Personal: an attacker who records one handshake can take it home and try millions of password guesses per second on their own computer, without touching your network again. A short or common password (“password123”, a phone number, a pet's name) falls quickly. A long random passphrase does not. Worse, anyone who knows the password and captured your handshake can decrypt your traffic: there is no forward secrecy.

WPA2-Enterprise (802.1X): a login per person

In Enterprise mode there is no shared Wi-Fi password. Each user or device logs in with its own credentials: a username and password, or better, a digital certificate. This uses IEEE 802.1X, a standard for checking a device before letting it on the network. Three parties are involved:

The login conversation uses EAP (Extensible Authentication Protocol). Common methods are PEAP (username and password inside an encrypted tunnel) and EAP-TLS (a certificate on each device, the most secure).

Enterprise also brings a risk: a device must check the server's certificate. If users are trained to click “Connect anyway” on a certificate warning, an evil twin with a fake RADIUS server can collect their passwords.

WPA3: what it fixes

SAE instead of PSK

WPA3-Personal replaces the pre-shared key method with SAE (Simultaneous Authentication of Equals), sometimes called the Dragonfly handshake. Before the 4-way handshake, the client and AP run an exchange in which both prove they know the password and agree a brand-new random master key, without revealing anything that could be tested offline.

WPA3-Enterprise works like WPA2-Enterprise with PMF required, and adds an optional 192-bit mode with stronger ciphers for governments and banks.

What an attacker in range can see

Encryption hides the contents of data frames, but not everything. Wi-Fi headers have to stay readable so radios know who a frame is for.

Guest networks

A guest network is a separate SSID for visitors. Its job is to give guests internet access without access to your own devices. A good guest network:

• Uses its own SSID and password (or a captive portal), changed regularly.
• Puts guests in a separate subnet or VLAN, for example 192.168.50.0/24 instead of the staff 192.168.1.0/24.
• Has firewall rules allowing only internet access, blocking the internal LAN.
• Turns on client isolation, so guests cannot reach each other either.
• Optionally limits bandwidth, so guests cannot slow down work.

This idea of splitting a network into zones with rules between them is covered in depth in Network segmentation and Firewall basics.

Other wireless threats to know

🙈 Not real security: hiding the SSID and MAC address filtering. Hidden SSIDs are revealed as soon as a device joins, and MAC addresses travel unencrypted, so an attacker simply copies an allowed one. A hidden SSID can even make your laptop broadcast the network name wherever it goes, looking for it.

A real-world example: the shared office password

A ten-person design studio uses WPA2-Personal with the password Studio2019, written on the kitchen whiteboard. A contractor who worked there last year still has it on his laptop.

1. Anyone who ever saw the whiteboard can still join, and the password has never changed because changing it means updating every device.
2. The password is short and guessable, so a captured handshake could be cracked offline.
3. Because it is WPA2-Personal, anyone with the password who recorded traffic could decrypt it.

The fix: staff move to WPA3-Enterprise (a cloud-hosted RADIUS service tied to their work accounts), so a leaver is removed by disabling one account. Visitors and the contractor get a separate guest SSID with WPA3-Personal and a long passphrase changed every month. The office printer and NAS stay on the staff network only.

When Wi-Fi security goes wrong: troubleshooting

Useful commands

C:\>netsh wlan show interfaces
    Name                   : Wi-Fi
    State                  : connected
    SSID                   : Home-WiFi
    BSSID                  : 02:00:00:00:a0:01
    Radio type             : 802.11ax
    Authentication         : WPA3-Personal
    Cipher                 : CCMP
    Band                   : 5 GHz
    Channel                : 36
    Signal                 : 91%

C:\>netsh wlan show profile name="Home-WiFi" key=clear
Profile Home-WiFi on interface Wi-Fi:
=======================================================================

Security settings
-----------------
    Authentication         : WPA3-Personal
    Cipher                 : CCMP
    Security key           : Present
    Key Content            : maple-river-lantern-orbit-42

$ nmcli -f SSID,SECURITY,SIGNAL dev wifi list
SSID             SECURITY          SIGNAL
Home-WiFi        WPA3              91
Office-Guest     WPA2 WPA3         74
Flat12           WPA2              60
Airport-Free     --                45
Old-Printer      WEP               30

$ nmcli dev wifi connect Home-WiFi password wrongpass123
Error: Connection activation failed: Secrets were required, but not provided.

Practical checklists

Common mistakes

• Thinking a captive portal is security. It controls internet access but encrypts nothing.
• Leaving an old WEP or TKIP setting “for compatibility”. One weak setting weakens the whole network.
• Short or shared-forever passwords. With WPA2 they can be cracked offline, and leavers keep access.
• Relying on hidden SSIDs or MAC filters. They stop nobody who is trying.
• Guests on the same LAN as staff. A guest's infected laptop can then reach your file server.
• Ignoring certificate warnings on enterprise Wi-Fi. That is exactly what an evil twin relies on.
• Assuming Wi-Fi encryption protects you on the internet. It stops at the access point.

Knowledge check

Where to go next

This completes the Wireless Fundamentals unit. Wireless security is one part of protecting a network: continue with Basic network security, then Firewall basics, VPN basics and Network segmentation. To review the radio side, revisit Wi-Fi basics and Wi-Fi frequency bands.