[ALERT] Nine WiFi Security Mistakes to Avoid

Is Your WiFi Wide Open?

Several years ago, I got Verizon's FIOS high-speed Internet service at my home. And then something curious happened. Cars were stopping in front my house, and staying for 10 or 20 minutes. There was no reason for anyone to stop there, so my spider sense began to tingle. After checking my wireless router, I found that Verizon had left it wide open. Without a wifi password, anyone could connect! I locked down the router's wifi signal with a password, and my daily stream of visitors stopped.

MISTAKE #1: Failing to put a password (also called an encryption key) on your WiFi lets anyone within range of your wireless router join your network. If file and printer sharing are also enabled, random passersby may be able to sift through files on every computer on your home or office network. Unencrypted WiFi also allows eavesdropping on your Internet traffic, even if the snoop is not connected to your network. Data passing between a computer and a wireless router is broadcast in all directions as far as several hundred feet.

Moochers on unsecured WiFi networks may slow the traffic of authorized users, or even download illegally while leaving the network’s owner with the legal consequences. For these reasons, it’s vital to set up your wireless network to use one of the encryption methods built into all wireless routers.

MISTAKE #2: While you're locking down your wifi signal, don’t make the mistake of choosing WEP encryption, the oldest and weakest encryption method. It can be cracked in about two minutes using software easily found online. Unfortunately, WEP is sometimes the first option on a router’s list of available encryption methods, so don’t be lazy and choose it for that reason. Use the WPA3 method for the best protection. If your router doesn't offer WPA3, the WPA2 protocol is the next best choice.

(See my related article Is Your Wireless Router REALLY Secure? to learn how a couple in Minnesota almost got framed for harassment, trafficking in child p**n, and threatening the Vice President -- all because they used WEP encryption on their wireless router.)

MISTAKE #3: Weak encryption keys (wifi passwords) are a related mistake. Strong encryption is of no use if a hacker can obtain your password by brute force attempts or by simply guessing it. Some wireless routers come with a default (factory set) password like "admin" or "password". And sometimes, internet service providers will set your wifi password to your home phone number. Passwords like these are trivial for even the most clueless hackers to guess. It's also common for the router's login credentials and/or wifi password to be listed on a sticker applied to your router.

Let me clear up a common point of confusion here. Your internet router has a username and password that you'll need if you want to login and change any settings. One of those settings is the wifi password. So there are TWO passwords being discussed here, and both are important. Your Internet Service Provider should have given you the router's username and password, if they supplied the router. Otherwise, look for it in the materials that came with your router.

Strong passwords should be at least 12 characters long and include a mixture of upper/lower case letters, digits, and special characters. For example, the password "M@ry Had a L1ttl3 L4mb" is a much better choice than "123456" or "qwerty". You needn't worry about entering this password over and over. Typically, you'll only need the wifi password when setting up a new device such as a laptop, tablet, smartphone, or wireless printer. (See Hey, Is This Your Password? to find out if your password is one of the 25 most common and easily guessed.)

I cannot provide detailed instructions for your specific router; but in most cases you'll start by connecting to your router by entering this address: http://192.168.1.1 in your web browser, and then providing the admin username and password. If you need help logging into your router, or changing the settings once logged in, contact your ISP or look for instructions online.

MISTAKE #4: Disabling the firewall built into most modern routers in hope of getting faster Internet is a fourth mistake. Firewalls keep unauthorized outsiders from getting into your network. They do not appreciably slow your Internet connection. Do not disable your router’s firewall. (See Do I Really Need a Firewall? to learn more about firewalls.)

MISTAKE #5: Relying on stealth alone to escape hackers’ attention is a mistake that some people make. Some people think that they can get away without encryption or a password on their wifi, just by hiding their wifi router's SSID. Yes, most routers have a setting to disable the broadcasting of the router’s SSID (name) so that other WiFi users within range won’t “see” it on the list of available wireless connections. Disabling the SSID isn't a bad idea. It will make your wifi signal invisible to most casual passers-by. But the SSID is included with many kinds of Internet traffic, so a hacker with free "sniffer" software can intercept and discover your router’s SSID.

MISTAKE #6: Similarly, using MAC address filtering to allow only specific devices to connect to your network isn't a reliable method either. MAC addresses are easily spoofed and, like SSIDs, are embedded in Internet traffic that can be intercepted. Another downside of using MAC address filtering is the inconvenience involved. You'll need to update your list of allowed MAC addresses whenever you want to connect a new device, or to allow a guest access to your WiFi. MAC address filtering is a good supplementary security precaution in some cases, but do not rely on it alone.

MISTAKE #7: Don't assume your Web browsing is private when out in public. If you're using wifi to access the Internet at a coffee shop or other public place, you should know that any unencrypted traffic flowing in or out of your phone or laptop is visible to nearby persons. As long as you're accessing a web page with an address that begins with https, the data you send and receive is protected from sniffers and snoopers. That little "s" is your assurance that your connection is encrypted.

MISTAKE #8: Router firmware must be updated just like any other software. Firmware updates to fix security vulnerabilities are provided by the hardware vendors. Unfortunately, most routers are not supported longer than two years after that make/model was released. How long have you had your router? How old was it when you got it? Check the manufacturer's website to see if there are any firmware updates available for your router, and instructions for applying them. Don't download firmware updates from any other source.

Even better, use a router that updates itself! See my article Does Your Internet Router Auto-Update? for some tips on selecting an auto-updating router.

MISTAKE #9:Are you monitoring your network for suspicious activity and wifi leeches? See Detect and ZAP Your WiFi Leeches to learn how to check your wireless network for unauthorized users.

Your thoughts on this topic are welcome! Post your comment or question below...