Wireless Security: WEP to WPA3

Wireless Security: WEP to WPA3

What you'll learn

• Tell the WEP → WPA → WPA2 → WPA3 story as cause and effect, with dates that matter
• Explain, at beginner level, why WEP fell and what SAE fixed about WPA2
• Configure a 2026-correct home network — and defend each setting choice out loud
• Explain why SSID hiding and MAC filtering are theater, framed as how security thinking matured
• Know where enterprise Wi-Fi authentication (802.1X) fits, ahead of Module 7

This lesson builds on Chapter 8 of Dr. Tahseen Al-Doori's Network Essentials, which tells the WEP story with relish — the book frames its WEP section as insider gossip, and it is a genuinely good crime story — and then hands us its era's best advice: WPA2 as the state of the art, plus a hardening checklist for the access point. We keep the crime story as act one, honor the WPA2 advice as period-correct, and finish the drama with the act the book couldn't see.

Why wireless security deserves its own lesson when wired networks got by with a paragraph: radio removes the walls. Tapping an Ethernet LAN means entering the building and touching a cable; "tapping" Wi-Fi means sitting within radio range with an ordinary laptop — the parking lot, the apartment next door, the street. Every frame of lesson 1 travels as broadcast energy that anyone can record. Encryption is not an optional extra on a medium like that; it is the wall.

Act one — WEP: the lock that looked strong (1997–2004)

Wi-Fi's designers saw the problem from the start. The original 802.11 standard shipped with WEP — Wired Equivalent Privacy — whose name states its whole ambition: make the open air as private as a wire. WEP encrypted every frame with the RC4 stream cipher using a shared key (40-bit at first, 104-bit later). On paper the arithmetic looked formidable — the book observes that brute-forcing even the short key means a search space beyond a trillion possibilities — and for a few years the industry believed the wall was solid.

The wall was hollow, and the flaw was not the arithmetic but the construction. WEP used RC4 carelessly: every frame's key was formed by gluing a short, frequently repeating value (sent in the clear!) onto the shared secret, and statistical patterns in those repetitions leaked information about the secret itself. Once researchers published the weakness — and the book recounts how the details of RC4's workings escaped into public hacker circulation — the exploit was industrialized: free tools (aircrack and its family) let anyone with a laptop harvest a busy network's traffic and recover the key, eventually in minutes. No supercomputer, no trillion guesses — just math applied to a design mistake.

The moral of act one, worth engraving: a strong cipher used wrongly is a weak system. RC4 wasn't defeated by force; WEP's use of it was defeated by observation. In 2004 the IEEE ratified the real fix (the 802.11i amendment), and WEP was formally deprecated — retired in disgrace the same year. Seeing WEP offered anywhere today is an alarm, not an option (obsolete — historically important).

Act two — WPA and WPA2: the long reign (2003–2018)

The fix arrived in two steps, because the industry faced an installed-base problem: millions of WEP devices whose hardware could not run heavier cryptography.

WPA (2003) was the emergency bridge — the strongest protocol the old hardware could carry. Its centerpiece, TKIP, kept RC4 (the chips demanded it) but repaired the construction: fresh per-frame keys, proper integrity checks, no naked repeating values. A firmware update instead of a hardware graveyard — engineering diplomacy, explicitly temporary.

WPA2 (2004) was the real successor, implementing full 802.11i: AES — the modern standard cipher you will meet properly in Module 7 — became the mandatory cipher, wrapped in a mode called CCMP that encrypts and integrity-protects every frame. TKIP was not deleted, only demoted to an optional fallback so that older hardware could still join, which is why router menus still offer "WPA2-PSK (TKIP+AES)" two decades later. Treat any TKIP option as legacy and select AES/CCMP alone. This is the moment our textbook's era crowned, and the book's verdict — WPA2 with AES as the latest and best — was simply true, and stayed true for an unusually long time: fourteen years as the recommended standard. When you meet WPA2 in the field today (and you will, constantly — it remains everywhere), you are not looking at a WEP-style scandal but at honorable aging (legacy — still widespread, no longer the recommendation).

Its cracks showed at the edges, and two matter for our story. First, home WPA2 authenticates with a pre-shared key (the Wi-Fi password), and its join handshake can be recorded by anyone in radio range — then attacked offline, guess after guess against a dictionary, at leisure, with no further contact with the network. A strong passphrase survives this; "sunshine123" does not. Second, in 2017 the KRACK research showed the handshake itself could be manipulated on many implementations — patchable, patched, but a loud signal that a 2004 design was feeling its age.

Act three — WPA3: the modern standard (2018–now)

WPA3 arrived in 2018 and became mandatory for all newly certified Wi-Fi devices in July 2020 (and required from the start for Wi-Fi 6 certification, as the previous lesson noted). Its headline repairs exactly act two's weak edge: the pre-shared-key handshake is replaced by SAE — Simultaneous Authentication of Equals — a cryptographic exchange in which both sides prove knowledge of the passphrase without transmitting anything an eavesdropper can grind offline. Each guess an attacker wants to try now requires a live interaction with the network — which can notice, throttle and block. A recorded handshake is no longer a take-home puzzle. SAE also delivers forward secrecy: cracking the passphrase later does not decrypt traffic captured earlier.

Two honest footnotes keep us professional. WPA3's own first act had drama: 2019 research (the "Dragonblood" findings) exposed weaknesses in the design, not merely in early code — side channels in SAE's original password-derivation step, and a downgrade attack able to push a WPA3-capable client back onto WPA2's crackable handshake wherever transition mode was running. The repair was a protocol change rather than a patch note: SAE now derives its password element by Hash-to-Element, which the Wi-Fi Alliance made mandatory. Instructive either way: every act of this story begins with confident claims and matures through public scrutiny. Security is a process wearing the costume of a product. And WPA3 deployments commonly run transition mode (WPA2 and WPA3 side by side) so older clients can still join — a reasonable bridge for homes, with the caveat that the network is only as modern as the weakest mode it accepts.

The 2026 configuration answer, then, in one line: WPA3 where every client supports it; WPA2/WPA3 transition where some don't; WPA2-AES as the floor; nothing older, ever.

The theater section: how security thinking matured

Chapter 8's hardening list includes three recommendations that deserve special treatment — not ridicule, but a respectful autopsy, because why they failed teaches more about security than most things that succeeded. The book advises: disable SSID broadcast, filter by MAC address, use static addressing. This was mainstream professional advice in its day, printed in many textbooks and vendor manuals. Here is what two decades of adversarial reality did to it.

Hiding the SSID. The theory: a network that doesn't announce its name is invisible. The reality, straight from lesson 1's machinery: the name is omitted only from beacons — it still travels, in the clear, in probe requests and the join exchange, so any passive listener with free software sees it the moment a legitimate device connects. Worse, hiding is counterproductive: your devices must now actively probe for the hidden name everywhere they go — announcing your home network by name in every café and airport — and hiding does nothing cryptographic at all. The lesson learned: invisibility that depends on the attacker not looking is not invisibility.

MAC filtering. The theory: allow only known hardware addresses. The reality, from Module 4: a MAC address is an identifier, not a credential — it is transmitted unencrypted in every frame (encryption protects frame contents, not addresses), so an attacker records a permitted MAC and presents it as their own in seconds. Modern devices then broke the scheme from the other side: iOS and Android randomize Wi-Fi MAC addresses by default, so the filter now locks out legitimate users whose addresses politely change. A control that fails open against attackers and fails closed against your own family is not a control. The lesson learned: identity you don't authenticate is decoration.

Static addressing. The theory: no DHCP, so intruders get no address. The reality: an observer who has already bypassed your encryption sees your addressing scheme in the traffic itself and assigns their own address by hand in under a minute. The lesson learned: an inconvenience is not a barrier — it only feels like one from the defender's side.

Notice the shape of all three failures: each tries to keep secrets about the network's shape (its name, its member list, its address plan) — facts the radio itself gives away — instead of keeping a cryptographic secret that mathematics protects. The maturation of security thinking between 2007 and 2026 is precisely this migration: from obscurity to cryptography, from "make it hard to see" to "make it provably hard to break even in full view." Modern guidance (government hardening guides included) is blunt: these measures are not security layers; encryption and authentication are. That is not hindsight arrogance — it is the field learning, in public, at its adversaries' pace. The book's other advice — change the default admin password, require authentication, use the strongest available encryption — was right then and is right now; and its mention of 802.1X port-based control was genuinely ahead of its class, as the next paragraph attests.

The enterprise pointer. Everything above authenticates a network with one shared passphrase. Organizations need to authenticate people: per-user credentials, revocable when someone leaves, logged when used. That is 802.1X — the port-based authentication framework where the access point defers each join decision to an authentication server (you will meet RADIUS and the EAP family in Module 7). When you see "WPA3-Enterprise" on a config screen, read: same encryption story, but identity handled properly, per user. One paragraph is all we need here; Module 7 owns the depth.

From the textbook to 2026

The book's era enters this story twice, both times honorably: its WEP crime story is act one exactly as we still teach it, and its WPA2-as-best verdict was correct for its day and for a decade after — period-correct advice, now superseded by WPA3 (certified 2018, mandatory in new certifications since July 2020). What the years demoted: SSID hiding, MAC filtering and static addressing moved from "hardening steps" to teaching examples of security theater — the field's matured judgment, reached the hard way. What the years added: SAE's offline-attack immunity and forward secrecy, transition modes as the migration bridge, WPS as a cautionary tale (a convenience feature whose PIN design proved brute-forceable — modern guidance: turn it off), and 802.1X grown from the book's forward-looking mention into the enterprise standard. The deepest continuity is the book's instinct to tell the WEP story at all — teaching security through failure analysis is exactly how the field still trains its professionals.

Watch: WiFi Password Security — WEP, WPA, WPA2, WPA3, WPS Explained

Why this video earns its place. PowerCert Animated Videos again — the course's most-used channel — compressing this lesson's entire arc into roughly eight animated minutes. It is the ideal recap format: the acts you just read, drawn as evolving locks on the same door, plus segments on WPS and MAC-based access control that connect directly to our theater section. One dating note to carry in: the video was published in 2019, when WPA3 was a newborn — hold our timeline (mandatory since July 2020, the clear 2026 recommendation) over any impression that WPA3 is exotic or optional.

As you watch, notice:

• The three-act structure appearing in animated form — WEP's fall, TKIP as the bridge on old hardware, AES-CCMP as WPA2's real fix — matching our acts one and two.
• What is said about WPA3: filter it through the timeline above, and recall that design flaws (the Dragonblood findings, disclosed after this video was made) were found and fixed in the protocol itself — the process continuing on schedule.
• The WPS segment: enjoy the convenience pitch, then apply this lesson's verdict — its PIN design proved brute-forceable, and current guidance is simply to disable it.
• The MAC access-control segment: as you watch, replay our theater autopsy — spoofing defeats it from the attacker's side, MAC randomization breaks it from the legitimate user's side.

The video reinforces visually what you just learned — the lesson is complete without it.

Activity: Router hardening audit

Time to turn the lesson into configuration. This is an audit with fixes: you will grade a Wi-Fi router against a ten-point checklist, then repair what fails. Best done on your real home router; if you cannot access one (dorm, landlord-run building), a realistic sample configuration is provided below — audit that instead, on paper.

Objective. Audit a home router against the ten-point 2026 hardening checklist, fix every failing point you safely can, and verify each fix took effect.

Setup.

• Access to your router's admin page: typically your default gateway address in a browser (Module 4 taught you to find it: ipconfig on Windows, ip route on Linux — the gateway line). Login details are usually printed on the router's label if never changed.
• Ten minutes when nobody in the household needs the network urgently — some fixes briefly disconnect devices.
• Before touching anything: note the current Wi-Fi name and passphrase, and locate the router's reset instructions — your undo path.

The checklist (audit each point, then fix):

1. Encryption mode is WPA3 or WPA2/WPA3 transition. Anything reading WEP, WPA, or "TKIP" fails. Fix: select WPA3-Personal (all clients modern) or WPA2/WPA3 transition (mixed household); AES/CCMP only.
2. Wi-Fi passphrase is strong and unique. Twelve-plus characters, not a dictionary word, not reused from any other account, not the one printed on the label if that label ever left your control. Fix: set a long passphrase (a multi-word phrase works well); you will re-join devices once.
3. Admin password changed from the default. The book flagged this in 2007: default admin passwords are public knowledge — one web search away. Fails if the label password (or admin/admin) still works. Fix: set a long, unique admin password, stored in your password manager.
4. WPS is off. The push-button/PIN join feature; its PIN design is brute-forceable. Fix: disable WPS entirely.
5. Firmware is current. Old firmware means public, unpatched vulnerabilities. Fix: run the router's update check; enable auto-update if offered.
6. Guest network is on and isolated — for visitors and for smart-home gadgets. Same reasoning as Module 3's IoT VLAN: devices you don't fully trust get their own broadcast domain, unable to reach your laptops. Fix: enable the guest SSID with its own strong passphrase; turn on client/AP isolation if offered.
7. SSID is renamed — but still broadcast. Default SSIDs often reveal the router's brand and model (a gift to attackers matching exploits to hardware); personal data in the name (surname, apartment number) is oversharing. And per the theater section: leave broadcast on. Fix: a neutral name, broadcast enabled.
8. Remote (WAN-side) administration is off. The admin page should answer only from inside your LAN. Fix: disable remote management/cloud-management features you don't deliberately use.
9. No legacy protocols left enabled. Scan the settings for WEP options, WPA-TKIP mixed modes, or ancient "compatibility" toggles. Fix: disable; if some heirloom gadget only speaks WPA2-TKIP or worse, put it on the guest network and plan its retirement.
10. The connected-devices list contains no strangers. Review every entry (expect randomized MACs from phones — Module 4). Fix for unknowns: change the Wi-Fi passphrase (point 2) and re-join only what you recognize.

Steps.

1. Log in to the admin page and, on paper, grade all ten points before changing anything: pass / fail / can't determine.
2. Apply fixes in this order: firmware (5) first — updates sometimes reboot and reset dialogs; then encryption mode (1) and passphrase (2) together — one re-join event for the household; then admin password (3); then the toggles (4, 6, 7, 8, 9); finally the device review (10).
3. Re-join your devices to the renamed/re-secured network.
4. Re-audit: walk the list a second time and record the new grade for each point.

Expected result. A before/after scorecard with every point passing (or consciously waived with a written reason — e.g., "transition mode retained: TV is WPA2-only, retirement planned").

Verify. On a connected phone or laptop, open the current Wi-Fi connection's details: it should report WPA3 (or WPA2/WPA3) as the security type — the client's own confirmation, independent of the router's menus. Then confirm the old admin password no longer works, and that the guest network reaches the Internet but not your main network's devices (try pinging a main-network device from a guest-network phone: it should fail).

Questions.

1. Which checklist points would have appeared, worded almost identically, in the book's 2007 list — and which three period recommendations did we deliberately not carry over?
2. Why does the order "firmware before passphrase" make practical sense?
3. Point 6 echoes which Module 3 concept, translated from switch to router?
4. A relative asks why you left the network name visible "when hiding it is free." Give the two-sentence answer from this lesson.

(Answers: 1 — change the default admin password, require authentication, use the strongest available encryption: the book taught all three; we dropped SSID hiding, MAC filtering and static addressing, per the theater section. 2 — updates can reboot the router or reset pending changes, so settings applied after the update can't be silently lost; and patched firmware may add the very options — WPA3, auto-update — later steps need. 3 — segmentation into separate broadcast domains: the guest SSID is the home translation of the IoT/guest VLAN. 4 — hiding removes the name only from beacons; it still leaks in every join, and my devices would have to shout the name everywhere they go, all for zero cryptographic gain.)

If it goes wrong.

• Locked out after changing the admin password: use the router's physical reset (hold the recessed button per the label), then redo the audit from scratch — annoying, instructive, harmless.
• A device won't join WPA3-only: it has no SAE support — usually older hardware, since WPA3 only became compulsory for newly certified devices in July 2020, though plenty of budget IoT gear has shipped since then without it, certified against nothing. Switch to WPA2/WPA3 transition mode, note the waiver on your scorecard, and record which device forced it, so the waiver has an owner and an expiry date.
• Can't find a setting: router UIs vary wildly; search the model's manual for the checklist term (WPS, remote management, guest network). If the feature truly doesn't exist, record "not available" — that too is audit data, and on a very old router it argues for replacement.
• No admin access at all (ISP-locked or landlord gear): audit the sample configuration below instead, and grade what you can observe of the real network from a client (security type, WPS behavior, guest SSID presence).

Sample configuration (paper audit fallback). HomeBox 3000 admin panel reads: Wireless mode: WPA2-PSK (TKIP+AES) · SSID: HomeBox3000-7F2A (broadcast: on) · WPS: enabled (PIN + push-button) · Admin login: admin / (label password, unchanged) · Firmware: v2.1 (2023-06, "check for updates" never run) · Guest network: off · Remote management: enabled (ISP support) · Connected devices: 9, two unrecognized. Grade all ten points, write the fix list in priority order, and defend your top three priorities in one sentence each. (Strong answers put encryption mode, WPS, and admin password at the top; remote management is defensible if the ISP genuinely uses it — a judgment call worth writing down.)

Reset/cleanup. None needed if the audit succeeded — the changes are the deliverable. Keep the scorecard; the capstone's security review reuses this checklist.

Check yourself

1. Arrange the causal chain: KRACK · WEP deprecated · SAE · RC4 misuse published · WPA2 crowned · TKIP bridge. Put these six in historical order and state, in one clause each, how each led to the next.
2. A café's network offers "WEP" and "WPA2" modes. A colleague says WEP is fine "because nobody serious attacks cafés." Rebut in two sentences using act one's moral.
3. An attacker in a parking lot records a WPA2 home network's join handshake and drives away. What can they now do that they could not do against WPA3, and which property of SAE is responsible?
4. Your neighbor proudly lists their security: hidden SSID, MAC filter with 14 approved addresses, WEP "because the printer needs it." Rank the three problems from most to least severe and justify the ranking.
5. Why is "WPA2/WPA3 transition mode" simultaneously good advice for a home and a compromise worth recording in an audit?
6. A 40-person company asks whether to keep one shared WPA3 passphrase for staff. Name the failure modes of the shared secret and the technology that answers them (depth deferred to Module 7).

Answers

1. RC4 misuse published (WEP's construction flaw becomes public) → TKIP bridge (WPA repairs the construction on old hardware, 2003) → WPA2 crowned (AES-CCMP replaces RC4 entirely, 2004) → WEP deprecated (the standard formally retires the broken design, 2004) → KRACK (2017 research exposes the aging WPA2 handshake) → SAE (WPA3's 2018 handshake removes the offline-attack surface that made handshake capture profitable).
2. WEP's failure isn't about attacker motivation — the key falls out of the math to anyone running free tools against recorded traffic, in minutes. A broken lock is broken for casual passersby too; act one's moral is that WEP is not "weaker security," it is no security with extra steps.
3. Against WPA2-PSK they can run an offline dictionary attack against the recorded handshake — unlimited guesses, no further radio contact, success determined only by passphrase strength. SAE removes that: its exchange gives an eavesdropper nothing to grind offline, so every guess needs a live, observable, throttleable interaction — and forward secrecy keeps previously captured traffic sealed even if the passphrase later falls.
4. WEP is catastrophic (encryption that actively fails — everything on the network is effectively public); the MAC filter is theater (spoofable in seconds, and randomizing phones will fight it), but at least breaks nothing cryptographic; the hidden SSID is mildly counterproductive (leaks anyway, makes devices probe everywhere). Severity follows what the control was trusted to do: WEP is trusted with everything and delivers nothing.
5. Good: it lets older WPA2-only clients keep working while modern clients get SAE — a pragmatic migration bridge. Compromise: the network still accepts the weaker handshake, so it inherits WPA2's offline-attack exposure for those joins; an audit records it so the waiver is a decision with an expiry, not a forgotten default.
6. One shared secret: no way to revoke a leaver without re-keying everyone, no per-person accountability, and the passphrase spreads to personal devices and sticky notes. The answer is 802.1X (WPA3-Enterprise): per-user credentials checked by an authentication server — revocable, logged, individually issued. Module 7 builds it.

Key terms

• WEP — Wired Equivalent Privacy (1997, shipped in the original 802.11 standard): RC4 misapplied; publicly broken, deprecated 2004; historically vital, operationally dead.
• RC4 — the stream cipher WEP misused; the case study in "strong cipher, weak construction."
• WPA / TKIP — the 2003 bridge: repaired RC4 construction that old hardware could run; explicitly temporary.
• WPA2 / AES-CCMP — the 2004 standard: modern cipher, encryption plus integrity; the book's period-correct "best," today's widespread legacy floor.
• Pre-shared key (PSK) — one passphrase authenticating the whole network; home mode's convenience and its weakness.
• KRACK — 2017 handshake-manipulation research against WPA2 implementations; patched, but a signal of age.
• WPA3 / SAE — the 2018 standard (mandatory in new certifications since July 2020): a handshake immune to offline guessing, with forward secrecy.
• Transition mode — WPA2+WPA3 side by side; the migration bridge, only as modern as its weakest mode.
• WPS — push-button/PIN joining; brute-forceable PIN design; modern verdict: disable.
• Security theater — measures that feel protective without resisting a real adversary: hidden SSIDs, MAC filters, static-addressing "barriers."
• 802.1X — port-based, per-user authentication via an authentication server; enterprise Wi-Fi's answer to the shared passphrase (Module 7).

Summary

• Radio removes the walls, so encryption is the wall: that single fact drives this whole lesson.
• Act one: WEP fell not to brute force but to flawed construction — a strong cipher used wrongly is a weak system; deprecated 2004.
• Act two: WPA bridged old hardware (TKIP), WPA2 delivered the real fix (AES-CCMP) and reigned justly for fourteen years — the book's advice was right for its era.
• Act three: WPA3's SAE ended offline passphrase grinding and added forward secrecy; mandatory in new certifications since July 2020; its own early flaws were found and patched — security is a process.
• The theater trilogy — hidden SSIDs, MAC filters, static addressing — failed because it protected observable facts instead of cryptographic secrets; its autopsy is how security thinking matured.
• The 2026 line: WPA3 where possible, transition where necessary, WPA2-AES as the floor, WPS off, nothing older, ever — and per-user 802.1X where organizations need identity.
• You audited a real router against ten points and verified the fixes from the client side — configuration as evidence, not hope.

Next lesson

The module now leaves the building entirely: what happens between your walls and the rest of the world — circuits, packets, and a half-century of wide-area technologies whose ideas outlived their hardware. Bring your sense of history; the next lesson is almost entirely made of it.

Sources and further study

• Al-Doori, T., Network Essentials, Chapter 8 — the WEP story, the WPA2-era verdict, and the period hardening checklist this lesson audits with 2026 eyes.
• Wi-Fi Alliance, "Security" — https://www.wi-fi.org/discover-wi-fi/security — the certification body's current WPA3 requirements and guidance.
• Wi-Fi Alliance, "Wi-Fi CERTIFIED 7" — https://www.wi-fi.org/discover-wi-fi/wi-fi-certified-7 — where WPA3 requirements meet the newest generation.
• Module 7 ahead: encryption fundamentals (AES, key exchange) and authentication (802.1X, RADIUS, EAP) — the machinery this lesson pointed at.