Mobile Fundamentals · Wi-Fi & Bluetooth · Lesson 5 of 5

Challenge: The Corner Cafe

Secure a small cafe's Wi-Fi and explain its tap-to-pay receipts.

Two networks, one name

You're helping Dev, who runs a small coffee shop called Corner Cup. He wants his Wi-Fi and payments to be safe for his staff and customers.

Here's his setup. Customers use an open guest network called CornerCup, with no password. Staff use a separate network protected by WPA2 with one shared password, which hasn't changed in years. At the counter, customers pay by tapping cards and phones on a contactless reader.

This morning a regular customer mentioned something odd. Her phone's Wi-Fi list showed two networks, CornerCup and CornerCup_Free. The second one had the stronger signal, and her phone joined it. Dev has never set up a network called CornerCup_Free, and his router only broadcasts the two networks he created.

The old staff password

Dev then mentions a worry. A former employee left on bad terms last month, and she still knows the staff Wi-Fi password. Dev's router can switch the staff network from WPA2 to WPA3.

He asks what WPA3 would actually change if she sat in the shop and watched the staff tablet connect to the staff network. The router also offers a mixed WPA2/WPA3 mode, but before changing anything he wants to know whether the switch is worth it.

The receipt mystery

At lunch, a customer pays by tapping her phone on the reader. She looks at the receipt and frowns. The last four digits printed on it are 4821, but the card in her wallet ends in 1093. She worries she was charged on someone else's card.

Dev checks his system. The payment went through to her bank as normal, and nothing is wrong. You explain why the digits don't match.

Who's on the network?

Before you leave, Dev opens his router's list of devices connected to the guest network. He wants to know which ones are phones using a made-up address instead of their factory hardware address. The list includes a few customers' phones, a laptop and the shop's music speaker, but the device names don't say which is which.

• 00:1A:2B:3C:4D:5E
• F4:5C:89:12:AB:CD
• 7A:12:9C:44:E0:B3
• 3C:22:FB:9A:41:07

You remember there's a quick way to tell a made-up address from a factory one, just by looking.