The question of what security to install on a WiFi router is becoming critically important in an era when home networks are connected not only to smartphones and laptops, but also to CCTV cameras, smart plugs, and refrigerators. Simply setting a password to access the device's web interface isn't enough, as the primary vulnerability often lies in the radio channel encryption protocol. Modern security standards differ significantly from those used ten years ago, and choosing the wrong encryption type can allow attackers access to your personal data.
Proper router configuration creates the first and most reliable line of defense for your local network's perimeter. Encryption protocols Define how data is encrypted during transmission over the air, making it unreadable to third parties. In this article, we'll examine the evolution of security standards, identify vulnerabilities in older algorithms, and determine optimal settings for modern devices.
The evolution of encryption standards: from WEP to WPA3
The history of wireless security is a constant arms race between security developers and hackers seeking vulnerabilities. The very first standard was WEP (Wired Equivalent Privacy), which emerged in the late 1990s. At the time, it was considered quite secure, but by 2001, researchers had proven that the WEP encryption key could be cracked in minutes using publicly available software.
In response to the vulnerabilities of WEP, a standard was developed WPA (Wi-Fi Protected Access), which used temporary encryption keys (TKIP). However, this protocol soon ceased to meet security requirements due to the possibility of brute-force attacks. Today, using WEP or WPA (TKIP) is a serious mistake made by users who are unaware of the security features of their Wi-Fi routers in today's environment.
The modern de facto gold standard is WPA2 (Wi-Fi Protected Access 2), which uses an algorithm AES (Advanced Encryption Standard). This standard provides reliable protection for the vast majority of users. However, the industry has already moved to the next level— WPA3, which was introduced in 2018 and addresses many of the fundamental flaws of its predecessors, such as vulnerability to brute-force attacks.
- 🔒 WEP: A completely obsolete protocol that can be hacked in minutes and should not be used.
- 🔐 WPA/WPA2 (TKIP): An outdated encryption method that significantly reduces network speed and security.
- 🛡️ WPA2 (AES): The current security standard that provides a high level of protection for most devices.
- 🚀 WPA3: A cutting-edge protocol with improved protection against password guessing and encryption on open networks.
When choosing router settings, always choose the most modern standard supported by all your devices. If an older device stops working with WPA2/WPA3, it's better to replace it than to downgrade your entire network to the vulnerable WPA/TKIP.
Why WPA2-AES is the current standard
Protocol WPA2 using an encryption algorithm AES (CCMP) has dominated the market for over a decade. Its reliability has been proven over time and in practical use in millions of networks worldwide. Unlike its predecessors, WPA2 uses 128-bit encryption, which, given a complex password, is virtually impossible to crack using brute force in a reasonable amount of time.
The main advantage of WPA2-AES is its balance between compatibility and security. Almost every device released in the last 15 years supports this standard. This means you can configure your router to use only WPA2-AES and be confident that all your devices—from an old laptop to the latest smartphone—will be able to connect to the network without any issues.
⚠️ Attention: Some routers have a "WPA/WPA2 Mixed" or "WPA+WPA2" mode in their settings. This mode allows devices using the older WPA protocol to connect, but it reduces the overall network security to the level of the weakest link. If you don't have devices older than 10-12 years, force them to use "WPA2 Only" or "WPA2 Personal" mode.
It is important to distinguish between protocol versions for personal networks (Personal) and corporate networks (Enterprise). For home use, the version Personal (PSK), where access is provided via a single password. The Enterprise version requires a separate authorization server (RADIUS) and is used in offices for individual employee access, which is unnecessary for standard apartments.
Advantages and features of the new WPA3 standard
Standard WPA3 The Wi-Fi Alliance developed this protocol to address critical vulnerabilities discovered in WPA2, specifically the KRACK (Key Reinstallation Attack) vulnerability. The key feature of the new protocol is the use of the SAE (Simultaneous Authentication of Equals) mechanism. This mechanism protects against brute-force attacks because the password hash is not transmitted over the network, even in encrypted form, during the handshake.
Another important innovation is improved security on open networks (OWE mode – Opportunistic Wireless Encryption). Even if you connect to public Wi-Fi without a password, WPA3 provides individual encryption of traffic between your device and the router. This means that other users in a cafe or airport won't be able to intercept your data, even if they're on the same network.
However, the implementation of WPA3 faces compatibility issues. Older devices manufactured before 2018 may simply not see the network with "WPA3 Only" mode enabled. Many router manufacturers offer a compromise mode called "WPA2/WPA3 Transitional," which allows both types of devices to connect. It is critical to understand that having even one older device on a WPA2/WPA3 Mixed network could theoretically open an attack vector to the entire network, although in practice this rarely happens.
- 🛡️ Brute-force protection: The SAE mechanism makes password dictionaries useless for handshake attacks.
- 📉 Reducing the risks of password leaks: Even if an attacker learns the password, he will not be able to decrypt traffic intercepted in the past.
- 📱 Simplified connection: Supports Wi-Fi Easy Connect technology for secure connection of IoT devices via QR code.
If your router supports WPA3 and all your devices are relatively new (smartphones and laptops no older than 3-4 years), upgrading to this standard is a smart move to improve security. Otherwise, WPA2-AES remains an excellent and reliable choice.
What is a KRACK attack?
The KRACK (Key Reinstallation Attack) attack is a vulnerability in the WPA2 protocol that allowed an attacker within range of the network to intercept and potentially manipulate data transmitted between the client and the router. WPA3 completely eliminates this vulnerability at the protocol level.
Setting up a password and network name (SSID)
Choosing a strong password is the foundation of your WiFi network's security. Even the most advanced WPA3 encryption protocol will be useless if you use a password like "12345678" or "password." Passwords should be complex and contain mixed-case letters, numbers, and special characters. The optimal password length for WPA2/WPA3 is at least 12-15 characters.
The choice of network name is equally important. SSID (Service Set Identifier). By default, routers are often named based on the device model, for example, "TP-Link_A4B2" or "ASUS_RT_AC51." This name tells a potential attacker the exact model of your router, making it easier to find vulnerabilities specific to that firmware. It's better to give your network a neutral name that doesn't indicate the owner or model of the equipment.
Bad SSID examples:
- Ivan_WiFi
- Apartment_5_B
- TP-Link_8821
Good examples of SSIDs:
- Blue_Sky_Network
- System_Failure_404
- Loading...
You should also consider hiding the SSID. In this mode, the router stops broadcasting the network name, requiring users to manually enter the name and password to connect. While this isn't a complete security measure (professionals can easily detect hidden networks), it reduces the likelihood of neighbors or random passersby trying to connect to your router.
Additional security measures: MAC filtering and guest networking
Besides encryption, there are additional tools that can strengthen perimeter security. One of them is filtering by MAC addressesEach network adapter has a unique identifier. In the router settings, you can create a "whitelist" of devices that are allowed to connect. All other devices, even those with the password, will be unable to access it.
However, relying solely on MAC filtering is not recommended. MAC addresses are transmitted in cleartext and can be easily intercepted and "cloned" by an attacker. However, when combined with a complex WPA2/WPA3 password, this creates an additional barrier. A much more useful feature is the organization Guest network (Guest Network).
A guest network creates a virtual separation: guests connect to the internet via a separate SSID and password, but have no access to your primary devices (printers, NAS storage, smart home devices). This is critical, as guest devices can become infected with viruses that attempt to spread throughout the local network.
| Function | Level of protection | Impact on convenience | Recommendation |
|---|---|---|---|
| Complex password (WPA2/3) | High | Low (entered once) | Necessarily |
| Hiding the SSID | Short | Average (must be entered manually) | As desired |
| MAC filtering | Average | High (difficult to add new ones) | For advanced users |
| Guest network | High (insulation) | Low | Recommended |
Using a guest network segment is a best practice for a modern home where friends' phones, children's tablets, or temporarily visiting relatives often connect to the Wi-Fi.
Updating firmware and disabling WPS
Router software, or firmware, also requires attention. Manufacturers regularly release updates to patch security holes. Old firmware may contain vulnerabilities that allow remote control of the router. Checking for updates should become a regular routine.
One of the most dangerous features that is often enabled by default is WPS (Wi-Fi Protected Setup). It's designed to simplify connecting devices by pressing a button or entering a PIN. The problem is that the WPS PIN is only 8 digits long and can be brute-forced in a matter of hours, giving an attacker complete access to the network password.
⚠️ Attention: Never use the WPS function to connect devices. If your router has a WPS option in its settings, it should be completely disabled. This will close one of the most common security holes in home routers.
To update the firmware, go to the router control panel (usually at 192.168.0.1 or 192.168.1.1), find the "System Tools" or "Administration" section, and select "Check for updates." Some modern models can update automatically, which is the preferred option.
☑️ WiFi Security Checklist
FAQ: Frequently Asked Questions
Can my neighbor hack my WiFi if I use WPA2?
Theoretically, yes, if the password is simple and easy to guess. The WPA2-AES protocol itself is considered cryptographically secure when used with a complex password (more than 12 characters, including multiple characters and symbols). It can only be cracked by brute-force, which, with a strong password, would take hundreds of years. However, if you have WPS enabled, your neighbors can exploit this vulnerability.
Will my internet speed decrease when I enable WPA3?
On modern routers and devices (Wi-Fi 5 and Wi-Fi 6), the impact on speed is negligible. However, if you have older devices that don't support the new encryption standards, they may either fail to connect or perform slower in compatibility mode. For older devices, it's best to use a separate guest network with WPA2.
Should I change my WiFi password regularly?
From a modern cryptographic perspective, if you use WPA2/WPA3 with a strong password and you don't suspect it has been compromised, regularly changing it is not necessary. Frequent password changes are inconvenient, as they require reconnecting all devices in the home. Change the password only if you sell the router, someone moves out, or if you suspect a hack.
What to do if your router doesn't support WPA3?
Don't panic. WPA2-AES is still the industry standard and provides reliable security for 99% of users. The key is to avoid using WEP or WPA(TKIP). If your router is more than 5-7 years old, you might want to consider upgrading to a more modern model with Wi-Fi 6 support and the latest security protocols, but your current router is still safe to use.