False Sense of Security on Protected Wi-Fi Networks
Yong Zhi Lim, Hazmei Bin Abdul Rahman, Biplab Sikdar

TL;DR
This study empirically evaluates the strength of Wi-Fi passwords in Singapore, revealing widespread weak practices like default passwords and short passphrases, which compromise network security.
Contribution
It provides an empirical analysis of real-world Wi-Fi passwords, highlighting common weaknesses and offering recommendations to enhance Wi-Fi security practices.
Findings
16% of passwords use minimal length or default settings
Prevalence of default passwords from hardware manufacturers
Weak passphrases undermine WPA2/WPA3 security
Abstract
The Wi-Fi technology (IEEE 802.11) was introduced in 1997. With the increasing use and deployment of such networks, their security has also attracted considerable attention. Current Wi-Fi networks use WPA2 (Wi-Fi Protected Access 2) for security (authentication and encryption) between access points and clients. According to the IEEE 802.11i-2004 standard, wireless networks secured with WPA2-PSK (Pre-Shared Key) are required to be protected with a passphrase between 8 to 63 ASCII characters. However, a poorly chosen passphrase significantly reduces the effectiveness of both WPA2 and WPA3-Personal Transition Mode. The objective of this paper is to empirically evaluate password choices in the wild and evaluate weakness in current common practices. We collected a total of 3,352 password hashes from Wi-Fi access points and determine the passphrases that were protecting them. We then analyze…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsNetwork Security and Intrusion Detection · Internet Traffic Analysis and Secure E-voting · IPv6, Mobility, Handover, Networks, Security
