Wi-Fi security

Radio goes through walls, so anyone nearby can pick up Wi-Fi signals. Wi-Fi security does two jobs: it decides who may join, and it encrypts the traffic between each device and the access point.

WEP, the first attempt, has been broken for twenty years and can be cracked in minutes; never use it. WPA2 is still common and sound with a good passphrase. WPA3 is better: it protects against an attacker recording the start of a connection and guessing the password offline, and it encrypts each device's traffic separately even on open networks that support it.

WPA2 and WPA3 come in two kinds. Personal (also called PSK) uses one shared passphrase, which is right for homes. Enterprise gives every person their own login, checked by a server, so one leaving doesn't mean changing the password for everyone.

Open café and hotel Wi-Fi often has no encryption at all between you and the access point, and anyone can set up a fake network with the same name (an evil twin). HTTPS still protects the sites that use it, but it's worth using mobile data or a VPN for anything sensitive, and having devices forget networks you don't need.

For a home network: use WPA3 (or WPA2 if a device needs it) with a long passphrase; change the router's admin password from the default; keep its firmware updated; turn off WPS, whose PIN can be guessed; and put guests and smart devices on a separate guest network so they can't reach your laptops.