Wi-Fi basics and WPA/WPA2/WPA3

Overview

Security objective: the asset you are protecting is the confidentiality and integrity of everything that travels over a Wi-Fi network — logins, browsing, files, IoT telemetry — plus control of who is allowed to join. The threat is a nearby attacker who can silently receive radio frames out of the air and, if the network is weak, recover the key or the passphrase. In this lesson you learn to detect which protection a network uses and to recommend the fix, without ever attacking a real network.

Wi-Fi signals travel through the air, and radio does not respect walls. Anyone within range — a neighbouring flat, a car in the car park, a lobby — can receive the raw frames using an ordinary wireless adapter in monitor mode. Wired Ethernet at least requires physical access to a cable; Wi-Fi does not. That single fact means the network's encryption and authentication are the only things standing between an eavesdropper and your traffic.

The protocol generation the access point (AP) uses decides how strong that protection is:

• WEP is comprehensively broken and must never be used.
• WPA2 is today's common baseline. Its Personal (PSK) mode uses a 4-way handshake that can be captured and cracked offline when the passphrase is weak; its Enterprise (802.1X) mode authenticates each user separately.
• WPA3 (SAE) was designed specifically to resist offline cracking and adds forward secrecy.

This lesson has no formal prereqs — it is the entry point of the Wireless & Mobile Security category. It sets up the next lesson, "Wireless attacks, evil twins, and hardening" (wireless-attacks-defenses), where the capture-and-crack workflow and defences like 802.11w are covered in depth. Everything here is conceptual: wireless testing is only ever done on networks you own or are explicitly authorized to test.

Why it matters

In authorized professional work — a Wi-Fi security assessment, a branch-office audit, an IoT deployment review — the protocol generation is the first thing you record, because it determines both the realistic attack and the correct remediation.

Beyond the technical stakes, wireless testing sits under strict law. Capturing frames from, or attacking, a network you do not own or lack written authorization for can constitute wiretapping and unauthorized access — serious criminal offences in most jurisdictions. Professionals treat the scope document as a hard boundary: no scope, no touching the air. Understanding the generations lets you give accurate, defensible advice without ever needing to attack anything.

Core concepts

Each Wi-Fi security generation is a distinct concept. Learn them one at a time, then study the threat model that ties them together.

1. Why Wi-Fi needs protection at all

Definition. Wi-Fi (IEEE 802.11) is a shared broadcast medium: the AP and clients transmit radio frames that every device in range receives at the physical layer.

Plain explanation. On wired Ethernet a switch delivers your frames only down your cable. On Wi-Fi there is no cable — the frames are simply in the air, and any adapter in monitor mode can capture them. Nothing physically stops reception.

How it works. Because reception cannot be prevented, confidentiality must come from encryption (scrambling the payload) and access control must come from authentication (proving you know the credential before you are given a working key).

When / when-not. This applies to every wireless link. It is not true of the wired segment behind the AP, which has its own controls.

Pitfall. Assuming a hidden SSID or MAC filtering provides security. Neither encrypts traffic; both are trivially bypassed and are not access control.

2. WEP — broken, never use

Definition. Wired Equivalent Privacy, the original 802.11 encryption (RC4 with a 24-bit IV).

Plain explanation. WEP's initialisation vector is far too short and reused constantly, leaking key material. Passive tools recover the key in minutes regardless of how long the WEP password is.

How it works. IV collisions and weak key scheduling let an attacker statistically reconstruct the key from captured traffic alone.

When / when-not. Never. There is no safe configuration of WEP.

Pitfall. Treating WEP as "weak but better than nothing." In an assessment WEP is a critical finding — it offers essentially no protection.

3. WPA2-Personal (PSK) — the offline-crackable baseline

Definition. WPA2 with a Pre-Shared Key: one passphrase (8–63 characters) shared by everyone on the network, using AES-CCMP encryption.

Plain explanation. "PSK" = pre-shared key: a single password everyone types in. When a device joins, a 4-way handshake proves it knows the passphrase and derives the session keys.

How it works. The handshake exchanges nonces and a Message Integrity Code (MIC) derived from the Pairwise Master Key (PMK), which comes from the passphrase + SSID. An observer who captures the handshake can, offline, guess passphrases, derive candidate keys, and check each against the captured MIC — no further contact with the network needed. Modern GPUs test enormous numbers of guesses per second, so weak or common passphrases fall quickly.

When / when-not. Acceptable only with a long, random, unique passphrase and where per-user accounting is not required. Not suitable when many people share the key or when the passphrase is guessable.

Pitfall. "Our Wi-Fi password is 10 characters, so it's fine." If those characters form a dictionary word or common pattern, offline cracking still succeeds. Length and randomness matter.

4. WPA2-Enterprise (802.1X) — per-user authentication

Definition. WPA2 where each user authenticates individually via 802.1X/EAP to a RADIUS server; there is no shared network passphrase.

Plain explanation. Instead of one password for everyone, each person (or device) has their own credential or certificate. The AP hands authentication off to a back-end RADIUS server.

How it works. After a successful EAP exchange the server delivers unique key material per session, so there is no single passphrase to capture and crack, and a departing user can be revoked without changing everyone's key.

When / when-not. The right choice for organisations with many users. Overkill for a typical home; requires RADIUS and certificate management.

Pitfall. Misconfigured EAP (e.g., clients that do not validate the server certificate) lets a rogue AP harvest credentials. Enterprise is only as strong as its certificate validation.

5. WPA3 (SAE) — designed against offline cracking

Definition. The current generation; Personal mode replaces PSK with SAE (Simultaneous Authentication of Equals, "Dragonfly"), a password-authenticated key exchange.

Plain explanation. SAE proves both sides know the password without letting a passive listener capture something they can crack offline. Each guess would require a fresh live interaction with the AP, which is slow and detectable.

How it works. SAE is an interactive exchange that also provides forward secrecy — recovering the password later does not decrypt previously captured traffic. WPA3 also mandates Protected Management Frames (802.11w).

When / when-not. The recommended default today. Note it has had implementation flaws (the Dragonblood side-channel/downgrade issues), largely fixed by patches — so keep firmware current. Use a transition mode only while old devices remain, since transition mode can allow downgrade to WPA2.

Pitfall. Assuming "WPA3 = unbreakable." Nothing is "completely secure"; WPA3 raises the bar dramatically but still depends on patched firmware and a decent password.

Threat model

           [ Radio range of the AP: the untrusted "air" ]
   .........................................................
   :  ((( ))) Legitimate client                            :
   :      |                                                :
   :      |  encrypted 802.11 frames (also received by...) :
   :      v                                                :
   :  ##########  ENTRY POINT / trust boundary #########   :
   :  #  Access Point (AP)                             #   :
   :  #   - advertises SSID + security (WEP/WPA2/WPA3) #   :
   :  #   - runs 4-way handshake (PSK) or SAE (WPA3)   #   :
   :  ##################################################   :
   :      |                                                :
   :      |  <== TRUST BOUNDARY: air -> wired LAN          :
   :......|.................................................:
          v
     +----------------+        +------------------+
     |  Wired LAN     |------->|  RADIUS server   |  (Enterprise only)
     |  (trusted)     |        |  per-user auth   |
     +----------------+        +------------------+

   ((( ))) ATTACKER: also inside radio range.
           - Passively captures ALL frames out of the air.
           - On WPA2-PSK: captures the 4-way handshake, then
             cracks the passphrase OFFLINE (no more contact).
           - Cannot decrypt WPA2-Enterprise/WPA3 the same way.

   ASSETS PROTECTED:  traffic confidentiality/integrity + join control.
   INSECURE ASSUMPTION that fails on WPA2-PSK: "the passphrase is
   secret enough that a captured handshake is useless."

Knowledge check.

1. What asset is protected by the AP's encryption? (Answer: the confidentiality and integrity of traffic in the air, plus control over who may join.)
2. Where is the trust boundary in the diagram? (Answer: the air interface at the AP — everything on the radio side is untrusted because any adapter in range receives the frames.)
3. What insecure assumption makes WPA2-PSK crackable? (Answer: that the passphrase is strong enough that a captured handshake cannot be brute-forced offline — false for weak/shared passphrases.)
4. Why may these techniques only be studied in an authorized lab? (Answer: capturing or attacking Wi-Fi you do not own/aren't authorized to test is wiretapping/unauthorized access — illegal without written scope.)

Syntax notes

Wireless work is command- and configuration-driven rather than a programming language. The key artefacts you will read in an assessment are the AP's advertised security and (in a lab) the tools that display it. The commands below are read-only, lab-safe — they observe your own environment; none attack anything.

# Read-only: list the security your OWN adapter sees advertised.
# 'RSN' in the output = WPA2/WPA3; 'WEP' = critical; no privacy bit = open.
nmcli -f SSID,SECURITY device wifi list        # Linux, your own machine

# macOS equivalent (read-only): shows the security column for nearby SSIDs
# /System/Library/PrivateFrameworks/Apple80211.framework/Versions/\
#   Current/Resources/airport -s

How to read a result — the security label maps to generation:

Interpretation note: reading the label tells you the protocol, not that the network is safe — a WPA2-PSK label with a weak passphrase is still weak. The label is a starting point, not a verdict.

Lesson

Wireless networks broadcast over the air. Anyone in range can receive the frames, so security comes entirely from encryption and authentication.

The protocol generations

• WEP — Broken decades ago and crackable in minutes. Any WEP network is a critical finding.
• WPA / WPA2 — WPA2 (AES-CCMP) is still the common baseline. It has two modes:
  • Personal (PSK): one shared passphrase. The 4-way handshake can be captured and the passphrase cracked offline (covered in the next lesson). Weak passphrases fall quickly.
  • Enterprise (802.1X): per-user authentication through a RADIUS server. This is stronger because there is no shared secret.
• WPA3 — The current standard. SAE ("Dragonfly") replaces the PSK handshake. It resists offline cracking and adds forward secrecy. It has had implementation flaws (Dragonblood), but it remains the recommendation.

The 4-way handshake is the exchange that proves a device knows the passphrase when it joins the network.

Why it matters

WPA2-Personal's offline-crackable handshake is the single most common weakness in home and small-business Wi-Fi. WEP is an instant finding.

Knowing the generation tells you two things: the likely attack, and the recommendation (WPA2-Enterprise, or WPA3 with a strong passphrase).

Legal boundary (critical)

Capturing or attacking Wi-Fi you do not own — or are not authorized to test — is illegal in most jurisdictions. It can count as wiretapping or unauthorized access.

Wireless testing requires explicit written scope. This course teaches the concepts only. It does not attack real networks.

Code examples

Wireless security is a configuration topic, so the "code" here is the AP configuration and the verification of a fix, following the insecure → secure → verify shape. All commands are lab-safe and act only on hardware you own.

(1) Insecure configuration

WARNING: intentionally vulnerable — use only in a local, isolated, authorized lab. Do not deploy.

# hostapd.conf on YOUR OWN test AP, isolated lab network.
# INSECURE: WPA2-PSK with a weak, dictionary-based passphrase.
interface=wlan0
ssid=LAB-TEST-AP
hw_mode=g
channel=6

wpa=2                       # WPA2 only
wpa_key_mgmt=WPA-PSK        # Pre-Shared Key mode (one shared password)
rsn_pairwise=CCMP           # AES-CCMP encryption
wpa_passphrase=password123  # <-- WEAK: dictionary word + digits, crackable offline
ieee80211w=0                # management frames NOT protected

Why it is vulnerable: password123 is in every wordlist, so a captured handshake is cracked in seconds offline; ieee80211w=0 leaves management frames unprotected (relevant to next lesson's deauth attacks).

(2) Secure configuration

# hostapd.conf on YOUR OWN test AP. SECURE baseline.
interface=wlan0
ssid=LAB-TEST-AP
hw_mode=g
channel=6

# Prefer WPA3-SAE; allow WPA2 transition ONLY while legacy devices remain.
wpa=2
wpa_key_mgmt=SAE WPA-PSK    # SAE = WPA3; WPA-PSK kept only for transition
rsn_pairwise=CCMP
ieee80211w=2                # Protected Management Frames REQUIRED (802.11w)
sae_require_mfp=1           # SAE clients must use PMF

# Long, random, UNIQUE passphrase (generate it, do not type a word):
# generated with:  openssl rand -base64 18
wpa_passphrase=<20+char-random-passphrase-placeholder>

Once all clients support WPA3, drop WPA-PSK, leaving wpa_key_mgmt=SAE (WPA3-only, no downgrade path).

(3) Verify the fix (lab only)

The test proves the secure config rejects a weak/wrong credential and accepts the correct strong one — run against your own lab AP.

# ACCEPT case: connect your own client with the CORRECT passphrase.
# Expected: association succeeds, 'wpa_state=COMPLETED'.
wpa_cli -i wlan0 status | grep wpa_state

# REJECT case: attempt with a WRONG passphrase (still your own AP).
# Expected: association fails; no COMPLETED state; AP logs a rejected auth.
#   (Do this only on hardware you own; you are testing your OWN fix.)

# CONFIRM WPA3/PMF is actually negotiated, not silently downgraded:
# Expected key_mgmt=SAE and pmf=1 for a WPA3-capable client.
wpa_cli -i wlan0 status | grep -E 'key_mgmt|pmf'

Expected output (illustrative shape): for the accept case wpa_state=COMPLETED; the confirm step shows key_mgmt=SAE and pmf=1, proving the client negotiated WPA3 with protected management frames rather than falling back to WPA2-PSK. If it shows key_mgmt=WPA-PSK, the client downgraded and you should investigate the transition-mode risk.

Line by line

Walking through the three-part configuration example:

Insecure config

• wpa=2 selects WPA2. On its own this is a reasonable protocol choice.
• wpa_key_mgmt=WPA-PSK puts it in Personal (shared-passphrase) mode — the mode whose handshake is offline-crackable.
• rsn_pairwise=CCMP sets AES encryption (good), but encryption strength does not save a weak passphrase.
• wpa_passphrase=password123 is the fatal flaw: a dictionary word plus digits, present in common wordlists, so a captured handshake is cracked almost instantly.
• ieee80211w=0 leaves management frames unprotected.

Secure config — what changed and why

• wpa_key_mgmt=SAE WPA-PSK adds SAE (WPA3). SAE removes the offline-crackable step; WPA-PSK stays only so legacy devices can still join during transition.
• ieee80211w=2 makes Protected Management Frames required, and sae_require_mfp=1 forces SAE clients to use them.
• wpa_passphrase=<20+char-random-placeholder> replaces the dictionary word with a generated random string, so even the WPA2 fallback path resists cracking.

Verify — how the values prove the fix

The key insight: fixing WPA2-PSK weakness is not one change but three complementary ones — stronger protocol (SAE), management-frame protection (PMF), and a strong random passphrase — and the verify step distinguishes a real WPA3 negotiation from a silent downgrade back to the weak path.

Common mistakes

Real mistakes, why they are wrong, and how to correct and recognise them.

Mistake 1 — "A long password makes WPA2-PSK safe."

• WRONG: relying on length alone, e.g. SummerHoliday2024!.
• WHY WRONG: offline cracking uses wordlists and rules; predictable phrases fall regardless of length.
• CORRECTED: use a randomly generated passphrase (e.g. openssl rand -base64 18) and prefer WPA3-SAE which removes the offline attack entirely.
• RECOGNISE/PREVENT: if a human chose and can remember the passphrase without a manager, it is probably guessable.

Mistake 2 — Treating a hidden SSID or MAC filter as security.

• WRONG: "we hid the network name and filter MACs, so we're protected."
• WHY WRONG: SSIDs leak in probe/association frames and MACs are sent in the clear and easily spoofed; neither encrypts traffic.
• CORRECTED: rely on WPA2/WPA3 encryption and authentication for security; treat hiding/filtering only as minor tidiness.
• RECOGNISE/PREVENT: ask "does this encrypt traffic or authenticate users?" If no, it is not a control.

Mistake 3 — Deploying WPA3 in permanent transition mode.

• WRONG: leaving wpa_key_mgmt=SAE WPA-PSK forever "for compatibility."
• WHY WRONG: transition mode keeps a WPA2-PSK path an attacker can force clients onto (downgrade), reintroducing the offline attack.
• CORRECTED: use transition only while legacy devices exist; move to SAE-only as soon as possible.
• RECOGNISE/PREVENT: inventory clients; schedule a date to drop WPA-PSK.

Mistake 4 — Assuming WPA2-Enterprise is automatically safe.

• WRONG: enabling 802.1X but not validating the RADIUS server certificate on clients.
• WHY WRONG: a rogue AP with a fake RADIUS can capture credentials if clients accept any certificate.
• CORRECTED: pin/validate the server certificate and CA on every client profile.
• RECOGNISE/PREVENT: test-join with an untrusted cert; a secure client should refuse.

Mistake 5 — Confusing "scanner passed" with "secure."

• WRONG: a Wi-Fi audit tool reports "WPA3 detected" so the network is declared secure.
• WHY WRONG: detecting the protocol does not verify passphrase strength, firmware patch level, or transition-mode downgrade risk. Passing a scan is not proof of security.
• CORRECTED: check passphrase policy, firmware version, and that WPA3+PMF is actually negotiated.
• RECOGNISE/PREVENT: never report "secure" from a single tool label; nothing is ever "completely secure."

Debugging tips

When wireless behaviour surprises you in a lab, work through these.

Common issues and steps

• Client connects but you expected WPA3. Check wpa_cli -i wlan0 status | grep key_mgmt. If it shows WPA-PSK, the client downgraded via transition mode — confirm the client actually supports SAE and firmware is current.
• Association fails for every client. Verify rsn_pairwise=CCMP matches client capability and that ieee80211w is not set to required (2) for a legacy client that cannot do PMF. Temporarily set ieee80211w=1 (optional) in the lab to isolate the cause.
• AP starts but no SSID appears. Check the regulatory domain/channel and that the adapter supports AP mode (iw list shows AP under supported interface modes).
• nmcli/airport shows the wrong security label. Re-scan; cached results can be stale. Compare against the AP's own config file.

Questions to ask when it fails

1. Is this hardware and network mine / in scope? (If not, stop.)
2. What generation does the AP actually advertise vs. what I configured?
3. Did the client negotiate what I intended, or silently downgrade? (Check key_mgmt/pmf.)
4. Do the AP logs show a rejected auth for the wrong-passphrase case (proving the reject path works)?
5. Is firmware current — could a known bug (e.g. Dragonblood-class) explain odd SAE behaviour?

Reading logs. On the AP, hostapd logs association attempts, EAP/SAE exchanges, and rejections. Grep the log for the client MAC to trace a single join from authentication through the 4-way handshake to COMPLETED (or the point it failed).

Memory safety

Security & safety — detection and logging for wireless.

Wireless attacks are best caught at the AP/controller and on the wired side, because the radio itself is uncontrolled. As a defender, log and monitor:

What to log (per event):

• Timestamp (with timezone) of each association/authentication attempt.
• Source: client MAC and, where available, the radio/BSSID and channel.
• Resource: SSID/BSSID targeted.
• Result: success / failure, and the security decision (which key_mgmt negotiated — SAE vs PSK).
• Correlation id: a session/association id to tie the 4-way handshake or SAE exchange together across log lines.
• Anomalies: bursts of deauthentication/disassociation frames, repeated auth failures, and duplicate MAC/BSSID pairs (possible evil twin / spoofing).

What to NEVER log:

• The Wi-Fi passphrase or PSK/PMK, EAP passwords, or RADIUS shared secrets.
• Session keys, PTK/GTK material, or private keys/certificates.
• Full decrypted user payloads or unrelated PII you do not need for the security decision.

Events that signal abuse:

• A flood of deauth/disassoc frames (classic precursor to handshake capture or an evil-twin push) — one reason 802.11w/PMF matters.
• The same SSID appearing on an unexpected BSSID/channel (possible rogue/evil-twin AP).
• Many failed authentications from one MAC, or many MACs cycling quickly (spraying / spoofing).
• A WPA3 network suddenly seeing WPA2-PSK associations it did not expect (downgrade attempt).

How false positives arise:

• Legitimate roaming between APs looks like rapid re-association.
• A microwave/ interference or a client with a flaky NIC causes benign repeated auth failures and deauths.
• Guest devices with randomised MACs (privacy feature) look like many short-lived clients. Tune thresholds and correlate with known device inventories before alerting, and always confirm testing was authorized before treating capture activity in your own lab as an "attack."

Real-world uses

Authorized real-world use case. A consultancy is engaged (with signed scope) to assess a retail chain's branch Wi-Fi. The tester walks each site, records the advertised security per SSID, flags any WEP or open networks as critical, checks whether guest and corporate SSIDs are properly separated, and confirms the corporate SSID uses WPA2-Enterprise or WPA3 with PMF. The deliverable is a prioritised report with remediation and retest steps — no traffic from customers or third parties is captured beyond the agreed scope.

Professional best-practice habits

Beginner focus: correctly classify a network's generation and give the right recommendation (kill WEP, strengthen or replace WPA2-PSK, prefer WPA3).

Advanced focus: design WPA3-Enterprise with certificate validation, PMF, VLAN segmentation, and a wireless intrusion detection system (WIDS) that flags evil twins and downgrade attempts — all within an authorized scope.

Practice tasks

All tasks are conceptual or lab-only on hardware and networks you own or are explicitly authorized to test. No task involves touching a third-party network.

Authorization checklist (complete before any lab task):

• The AP and all client devices are mine (or I have written authorization).
• The lab is isolated (its own SSID/subnet, not shared with neighbours).
• I am only observing/configuring my own equipment.
• I have a reset plan to restore original settings afterwards.

Beginner 1 — Classify from labels.

• Objective: given five advertised security labels (Open, WEP, WPA2 (PSK), WPA2 (802.1X), WPA3 (SAE)), rank them worst→best and give a one-line recommendation for each.
• Requirements: produce a table (label → verdict → recommendation).
• Constraints: no scanning of others' networks; use the labels as given.
• Hints: WEP and Open are the worst; SAE is best.
• Concepts: protocol generations, verdicts.

Beginner 2 — Explain the offline attack in words.

• Objective: write a 4–6 sentence explanation of why WPA2-PSK can be attacked offline and WPA3-SAE cannot.
• Requirements: mention the 4-way handshake, the captured MIC, offline guessing, and SAE's live-interaction requirement + forward secrecy.
• Constraints: no tools, no real capture — explanation only.
• Hints: the key word is "offline."
• Concepts: handshake, PMK, SAE.

Intermediate 1 — Harden a config (lab).

• Objective: starting from the insecure hostapd.conf in this lesson, produce a hardened version.
• Requirements: enable SAE, require PMF (ieee80211w=2), and replace the passphrase with a generated random one; document each change and why.
• Input/Output: input = weak config; output = hardened config + change log.
• Constraints: your own lab AP only.
• Hints: openssl rand -base64 18 for the passphrase.
• Concepts: SAE, PMF, transition mode.

Intermediate 2 — Verify no downgrade (lab).

• Objective: with a WPA3-capable client on your own AP, prove the client negotiates SAE+PMF rather than downgrading to WPA2-PSK.
• Requirements: capture key_mgmt and pmf from wpa_cli status; show the accept (correct passphrase → COMPLETED) and reject (wrong passphrase → no COMPLETED) cases.
• Constraints: your own equipment; do not attack anything.
• Hints: if key_mgmt=WPA-PSK, transition mode allowed a downgrade.
• Concepts: negotiation, downgrade risk, verification.
• Defensive conclusion: remediate by moving to SAE-only once legacy devices are gone, then re-verify.

Challenge — Assessment mini-report.

• Objective: for a fictional lab site with three of your own SSIDs (say one WEP test AP, one WPA2-PSK, one WPA3), write a short finding report.
• Requirements: for each SSID give title, severity (justify why — exploitability/impact, not "everything is critical"), affected component, safe reproduction (label observation only), impact, remediation, and a retest step proving the fix.
• Constraints: lab-only; all APs are yours; no third-party data.
• Hints: severity depends on exploitability and impact — WEP outranks a WPA3 firmware-update recommendation.
• Concepts: reporting template, severity reasoning, mitigation verification.
• Defensive conclusion: end with a remediation + verification plan for each finding, not just the weakness.

Summary

Main concepts. Wi-Fi is a broadcast medium — anyone in range receives the frames — so encryption and authentication are the only protection. The protocol generation decides strength: WEP is broken (critical finding); WPA2-Personal (PSK) shares one passphrase and its 4-way handshake can be captured and cracked offline when the passphrase is weak; WPA2-Enterprise (802.1X) authenticates each user with no shared secret; WPA3 (SAE) is designed to resist offline cracking and adds forward secrecy plus mandatory PMF.

Key configuration/commands. wpa_key_mgmt=SAE enables WPA3; ieee80211w=2 requires Protected Management Frames; read the negotiated result with wpa_cli status (key_mgmt, pmf); generate strong passphrases with openssl rand. Read advertised security with read-only tools like nmcli device wifi list on your own machine.

Common mistakes. Trusting passphrase length over randomness; treating hidden SSIDs/MAC filters as security; leaving WPA3 in permanent transition mode (downgrade risk); skipping RADIUS certificate validation in Enterprise; equating a scanner label with "secure."

What to remember. Kill WEP; treat WPA2-PSK as only as strong as its passphrase; prefer WPA3 or WPA2-Enterprise; verify the client actually negotiated WPA3+PMF rather than downgrading; log auth results, deauth floods, and rogue BSSIDs while never logging passphrases or keys; and never touch wireless you do not own or are not explicitly authorized to test. Nothing is ever "completely secure" — recommend defence in depth and keep firmware patched.

Practice with these exercises

• Classify an 802.11 frame as mgmt/ctrl/data
• Extract the BLE Complete Local Name from an advertisement