Mobile Fundamentals · Wi-Fi & Bluetooth · Lesson 1 of 4

Joining Wi-Fi Safely

Spot the risky networks in a crowded airport.

Pick a network

When you use Wi-Fi, your phone sends everything over radio waves, and anyone close enough can pick those waves up. What keeps your data private is encryption. It scrambles the data so only your phone and the router can read it.

An open network has no password. On most open networks that also means no Wi-Fi encryption at all. Other people on the same network can capture what your phone sends using free, easy-to-find tools. Websites and apps that use HTTPS add their own layer of encryption, so the contents of those pages stay private. Anything sent without HTTPS can be read, and an onlooker can often still see the names of the sites you visit.

Open networks have a second problem. Anyone can set up a hotspot and give it any name they like. An evil twin is a fake network named almost exactly like the real one, often with a stronger signal, so your phone connects to the attacker instead.

Some newer open networks use Wi-Fi Enhanced Open, which encrypts traffic without a password. Most public hotspots still don't.

On the simulated phone, tap each airport network to see how safe it is.

The current standard

Password-protected Wi-Fi uses a security standard to scramble the traffic between your phone and the router. There have been four main versions.

• WEP (late 1990s) has serious design flaws and can be cracked in minutes.
• WPA (2003) was a quick fix for WEP and is now outdated too.
• WPA2 (2004) was the standard for well over a decade and is still very common.
• WPA3 (2018) is the current standard.

WPA2 has two weak spots on home-style networks with one shared password. An attacker who records your phone connecting can take that recording home and test millions of password guesses offline. Also, anyone who knows the password and watches another device connect can decrypt that device's traffic.

WPA3 fixes both. Its new handshake, called SAE, forces every guess to be a live attempt against the network. Each connection also gets its own keys. If someone records your traffic today and learns the password next year, the recording stays unreadable. This is called forward secrecy.

If your home router offers WPA3, or a mixed WPA2/WPA3 mode, it's worth switching on.