0
If you don’t set a password on your wifi, then not only can anyone
connect, but it’s not even encrypted. This means that even when an
open network gives you a captive portal, that could actually be an
attacker giving you a fake portal. Even if the portal is HTTPS,
because you may be connected to https://evil-fake-portal.com.
That is solved in WPA3, where even open networks become
encrypted.
Of course, the attacker can just set up a fake access point, and
you’ll connect, none the wiser. Even if the network has a password,
the attacker only needs to know that password in order to fake it.
Before WPA3, passwords can easily be brute forced offline. A few years
ago I calculated that it would cost about $70 to crack the default
generated 8 character random passwords used by a popular ISP here in
London, using some GPUs in Google Cloud. I’m sure it’s cheaper now.
That’s potentially years of free use of your neighbours wifi, for just
the cost of a couple of months of paying for your own.
But that’s illegal, of course. This post is about protecting you
against these attacks, not performing them.
If you Continue reading