What is Wi-Fi Security?
Wireless network security, told as a story about letters thrown through the air and a free mailbox in the village square.
Castle letters travel down the hall. A letter thrown through the air can be caught by anyone.A wireless letter is invisible, but it flies through the air. Anyone with an antenna — even the thief next door — can catch it.
The free mailbox in the square might be a fake the thief put up.Same name, same look. Letters dropped in the fake go to the courier who opens them on the way.
A lock on every box, a badge for the castle box, guests apart, a tunnel in the square.The sealed lock (a sealed letter) makes a caught letter unreadable. The castle box checks a badge instead of a password. Guests are kept apart by a ribbon, and in the square you send only through the sealed tunnel.
The lock guards the letter; the badge guards the door.One password shared by all is soon known to the thief too. A badge is different for each person, and a leaver's badge is erased at once.
Hiding the mailbox name is just a cloth. Don't hide it — seal it.A thief with an antenna sees the waves right through the cloth. And letters to and from the shop get one more layer from the sealing promise.
Wi-Fi security = make letters thrown through the air unreadable with a sealed lock, check a badge at the castle box, keep guests apart, and never trust the free mailbox in the square — send only through the sealed tunnel.
Anyone can receive a wireless signal, so you need encryption like WPA3, per-user 802.1X authentication, a separated guest network, and a VPN on public Wi-Fi. An evil twin (rogue AP) looks exactly like the real one.
When grown-ups say it
- WPA2 / WPA3
- The mailbox's sealing lock. Makes a caught letter unreadable. The newer lock (3) is sturdier. → the sealed letter
- Public Wi-Fi
- The free mailbox in the square. Nobody knows who put it up. Never drop a letter in without the sealed tunnel.
- Rogue AP / evil twin
- The thief's fake mailbox. Same name, same look. → the courier who opens letters on the way
- 802.1X
- A badge for each person. Checks each person instead of one shared password. → a doorkeeper at every hole in the hall
- Guest network
- The guest mailbox. Can't reach the castle halls past the ribbon. → halls divided by colored ribbons
- VPN
- The sealed tunnel. From the square to the castle with no one peeking. → the sealed tunnel
- Man-in-the-middle
- Opening it on the way. What the fake mailbox does. → the courier in the middle
- Hiding the SSID
- A cloth over the mailbox. The waves still spread. A thief with an antenna sees it all — this is not security.