Wireless networks transmit data through the air as radio waves, which anyone nearby could potentially intercept. WEP, WPA, and WPA2 are security protocols that encrypt Wi-Fi traffic to prevent eavesdropping and block unauthorised access. Understanding these protocols forms part of the KS3 computing network security curriculum.
Why do wireless networks need special security?
A wired network sends data through a physical cable. To intercept that data, an attacker must physically connect to the cable — a significant barrier. A wireless network broadcasts data as radio waves in all directions. Without any protection, any device within range (typically 30–50 metres indoors, further outdoors) can receive those signals and read the data.
This makes wireless networks inherently more vulnerable than wired ones. The solution is encryption: scrambling the data so that even if someone intercepts the radio signals, they cannot understand the content without the encryption key. Wi-Fi security protocols provide this encryption automatically when a device connects using the correct password.
What is an SSID and why does it matter for security?
An SSID (Service Set Identifier) is the name of a Wi-Fi network — the name you see in the list of available networks on your phone or laptop. SSIDs are broadcast publicly by default so that devices can find the network.
Hiding the SSID (disabling SSID broadcast) is sometimes suggested as a security measure, but it provides only very weak protection. Any moderately experienced attacker can discover a hidden SSID by observing the devices that connect to it. Proper encryption (WPA2 or later) is far more effective. Using a distinctive, non-personal SSID is a sensible practice — including your home address or full name in the SSID is unnecessary and mildly risky.
What was WEP and why was it abandoned?
WEP (Wired Equivalent Privacy) was the original Wi-Fi security standard, introduced in 1997. Its name reflected its goal: to give wireless networks the same level of privacy as a wired connection.
WEP used a 40-bit or 104-bit encryption key. By 2001, researchers had discovered serious flaws in how WEP used its encryption algorithm. A major problem was that WEP reused parts of its encryption key in a predictable way, making it possible to crack the key by collecting enough packets — a process that took minutes with freely available tools by the mid-2000s.
WEP was officially declared insecure by the IEEE (the standards body) in 2004. It should never be used on any network today.
| Protocol | Year | Key length | Status |
|---|---|---|---|
| WEP | 1997 | 40 or 104 bits | Broken — do not use |
| WPA | 2003 | 128 bits (TKIP) | Deprecated — avoid |
| WPA2 | 2004 | 128 bits (AES) | Current standard |
| WPA3 | 2018 | 192 bits | Recommended for new devices |
How does WPA improve on WEP?
WPA (Wi-Fi Protected Access) was introduced in 2003 as an emergency replacement for WEP, designed to run on the same hardware (a software update) while fixing WEP's worst vulnerabilities.
WPA used a protocol called TKIP (Temporal Key Integrity Protocol), which generates a new encryption key for each packet transmitted. This removed WEP's critical flaw of reusing key material predictably. WPA also added a message integrity check to detect if packets had been tampered with.
However, TKIP itself was later found to have weaknesses, and WPA is now considered deprecated. Many modern routers no longer support it.
What makes WPA2 the current standard?
WPA2 (Wi-Fi Protected Access 2), introduced in 2004, replaced TKIP with AES (Advanced Encryption Standard) — a much stronger encryption algorithm. AES uses 128-bit keys and was adopted by the US government and security community as a reliable, mathematically robust cipher.
WPA2 comes in two modes:
- Personal (WPA2-PSK): Used in homes and small offices. Everyone uses the same pre-shared key (the Wi-Fi password). When you type the Wi-Fi password on your phone, that is the PSK.
- Enterprise: Used in large organisations such as schools and businesses. Each user has their own login credentials (username and password or certificate), managed by a central authentication server. This means one compromised password does not expose the entire network.
How should you secure a home Wi-Fi network?
Good practice for a home network:
- Use WPA2 (or WPA3) encryption. Check your router settings and confirm the security mode is set to WPA2-AES or WPA3 — never WEP or WPA (TKIP).
- Use a strong, unique password. The Wi-Fi password should be at least 12 characters long and not based on your address, name, or other guessable information.
- Change the router's admin password. Routers have a separate password for accessing the configuration page (often
adminby default). Change it — an attacker on your network who reaches the admin page can reconfigure everything. - Keep the router's firmware updated. Security vulnerabilities in router software are discovered regularly; firmware updates fix them.
- Disable WPS. Wi-Fi Protected Setup (WPS) is a convenience feature that can be exploited to gain access without the password.
Frequently asked questions
What is the difference between WPA2-Personal and WPA2-Enterprise?
WPA2-Personal (also called WPA2-PSK, for Pre-Shared Key) uses a single shared password for all users. It is suitable for homes and small networks. WPA2-Enterprise uses a separate username and password or digital certificate for each user, authenticated by a RADIUS server. Schools and workplaces use Enterprise mode so that revoking one user's access does not require changing the password for everyone.
Can someone crack a WPA2 password?
WPA2 itself is not broken in the same way WEP was. However, a weak or common password can still be guessed. An attacker who captures the initial connection handshake (when a device first connects to a router) can run a dictionary attack — trying thousands of common passwords offline. A strong, random password of 12 or more characters is effectively immune to this attack within any realistic timeframe.
What is WPA3 and do I need it?
WPA3 was introduced in 2018 and provides stronger protection than WPA2, particularly for networks using weak passwords. It uses a protocol called SAE (Simultaneous Authentication of Equals), which makes dictionary attacks far harder even if a weak password is used, and it provides forward secrecy — meaning that even if a password is later compromised, past recorded sessions cannot be decrypted retroactively. Most new routers and devices support WPA3. For KS3 and GCSE, WPA2 is the focus of the curriculum.
Why does connecting to a public Wi-Fi network carry risks?
Public Wi-Fi networks (in coffee shops, airports, hotels) are usually open — no password — or use a shared password known to many people. An attacker on the same network can potentially intercept unencrypted traffic. Using a VPN (Virtual Private Network) on a public network encrypts your traffic before it leaves your device, protecting it from eavesdroppers on the same Wi-Fi. For sensitive activities such as banking, avoid public Wi-Fi or always use a VPN.
Explore wireless networking and cyber security with Professor Turing's guided tutoring at aitutors.me.