Wireless security: WPA3, rogue access points and evil twins

A wired network has a physical boundary: to plug in, you need to be inside the building. Wi-Fi has no such wall. Its radio signal passes through windows and into the street, and any device in range can listen. Wireless security is about two things: protecting what travels over the air, and making sure the network you join is the one you think it is.

From WEP to WPA3

The Wi-Fi Alliance introduced WPA3 to fix weaknesses in WPA2. WPA3-Personal replaces the old pre-shared key handshake with SAE (Simultaneous Authentication of Equals). With WPA2, an attacker who records a device joining the network can take that recording away and try millions of password guesses offline. SAE makes that offline guessing impractical: each guess needs a live exchange with the network. WPA3 also requires Protected Management Frames, which make it harder to knock devices off the network with forged disconnect messages. WPA3-Enterprise adds an optional higher-strength mode for sensitive organisations, and Wi-Fi Enhanced Open (OWE) encrypts traffic on open, password-less networks such as café hotspots, although it does not prove who runs the hotspot.

Rogue access points

A rogue access point is a wireless access point connected to a network without permission. Sometimes it is innocent: an employee plugs a cheap router into the office network for better coverage, silently creating an unmanaged, often poorly secured, door into the internal network. Sometimes it is deliberate, a small device hidden on a desk or behind a printer to give an attacker remote access. NIST’s guidance on wireless LAN security, SP 800-153, recommends that organisations regularly scan for unauthorised access points and keep an inventory of authorised ones.

Evil twins

An evil twin is a fake access point that imitates a legitimate one, usually by copying its network name (SSID). MITRE ATT&CK lists it as an adversary-in-the-middle technique. Devices remember networks by name and try to rejoin them automatically, so a laptop that once used “Airport_Free_WiFi” may happily connect to an impostor with the same name. Once connected, the attacker controls the network path: they can watch unencrypted traffic, show fake login pages (“sign in again to use the Wi-Fi”), tamper with DNS answers or try to reach the device directly.

• An evil twin is easiest to set up for open networks: there is no password to know.
• Copies of password-protected networks often use weaker or no security, because the attacker does not know the real password.
• HTTPS still protects the content of your web traffic, but many apps, older protocols and captive portals are not so careful.

Defenses that work

On a Mac, Apple also protects Wi-Fi at the system level, for example by supporting WPA3 and using private, rotating Wi-Fi addresses on newer versions of macOS so that networks cannot easily track the device.

How FireAI’s Coffee Shop Armor fits in

FireAI includes a feature called Coffee Shop Armor that applies several of these defenses automatically. It checks how each Wi-Fi network is secured: open, weak (old encryption such as WEP or WPA1) or strong (WPA2 or WPA3). On an open or weak network, it switches FireAI to Coffee shop mode, which blocks incoming connections, file and screen sharing to other devices, and unencrypted mail or FTP. It only ever makes FireAI stricter: it never overrides a stricter mode you chose and never switches back down by itself.

It also warns you when a network with a name you have used before appears with weaker security than last time: the classic sign of an evil twin. FireAI is honest about the limit. A fake network with a copied name and a strong password looks the same as the real one from outside, so the warning catches the common case, not every trick. That is why a strict mode on unfamiliar networks remains the safe default. To read the Wi-Fi name at all, macOS requires Location access; FireAI uses it only to recognise networks.