Chapter 4 · Network Security· Beginner· ~10 min

Wireless Security

Radio doesn't respect walls. Wi-Fi and Bluetooth move data through the air, which means anyone in earshot is, in principle, on your network.

You will learn

  • What WPA2 and WPA3 actually do, and why WEP is dead
  • What an "evil twin" or rogue access point is
  • What Bluetooth's realistic risks look like
  • A few habits that protect you when traveling

The Wi-Fi versions you should know

  • WEP. Original Wi-Fi encryption. Broken since the early 2000s, can be cracked in minutes. Do not use, anywhere.
  • WPA. A transitional fix. Also broken; not in use today.
  • WPA2 (Personal). The workhorse of the last 15 years. Uses a Pre-Shared Key (the Wi-Fi password). Still common; reasonably secure if the password is strong, but vulnerable to offline cracking of captured handshakes.
  • WPA2 (Enterprise). Each user authenticates individually, usually via 802.1X with a RADIUS server. The right choice for any organization.
  • WPA3. Current. Uses SAE (Simultaneous Authentication of Equals) to defeat offline password guessing and adds protected management frames. Use it when both sides support it.

A weak Wi-Fi password is a weak network

WPA2-PSK captures can be cracked offline against wordlists at billions of guesses per second on a GPU. Use a long random passphrase, not welcome123.

Rogue APs and evil twins

An evil twin is an attacker-controlled access point that broadcasts the same name as a trusted network (your office, the airport Wi-Fi). Your device, eager to reconnect to a known SSID, joins. Now the attacker is your gateway.

Variants:

  • Open evil twin: same name, no password. Devices auto-join to any open network with a remembered SSID.
  • Captive portal trick: open Wi-Fi that pops up a login page mimicking a hotel chain or airline.
  • Rogue AP on a real network: an attacker plugs in their own AP inside your office, bridging the LAN.

Defenses: use WPA2/3-Enterprise where the network proves its identity to your device with a certificate, prefer apps that pin server identity, and don't auto-join open networks.

Bluetooth and friends

Bluetooth has its own family of vulnerabilities. The realistic ones today:

  • Tracking. Bluetooth LE devices broadcast identifiers that, without rotation, let nearby observers track them.
  • Pairing attacks. Most go after the brief moment of pairing rather than established encrypted links.
  • Implementation bugs. BlueBorne and similar have been found in Bluetooth stacks themselves, patched, but a reminder to keep firmware current.

Practical advice: keep Bluetooth off when you're not using it, prefer devices that rotate their addresses (most modern ones do), and update.

Habits that travel well

  • Forget public Wi-Fi networks after using them, so your device doesn't auto-join in the future.
  • Turn off Wi-Fi and Bluetooth when not in use, especially in transit hubs.
  • Keep mobile data as a fallback rather than chasing every open SSID.
  • Use a reputable VPN on hostile networks if you must transmit unencrypted protocols (rare these days).
  • Don't install certificates a captive portal asks you to install. Ever.

HTTPS does most of the work

Even on a hostile network, well-deployed TLS means the worst an attacker usually gets is metadata. Most of the historical Wi-Fi nightmares evaporated when the web went HTTPS by default.

Take the quiz