11.1 Home Wi-Fi Setup, Passwords, and Guest Networks
The Handshake Is the Weakness
WPA2-PSK turns your Wi-Fi passphrase into the PMK with PBKDF2, salted by the SSID, 4096 iterations, 256-bit output. Stations then run a 4-way EAPOL handshake that proves both sides hold the PMK and derives the PTK encrypting unicast traffic. The problem: everything an attacker needs is in the air. Capture the 4-way handshake -- forced out of any client by a deauth burst -- or just the first EAPOL frame carrying the PMKID, and the passphrase becomes an offline dictionary problem. The attacker hashes each candidate, recomputes the MIC, and checks. GPU rigs test millions of guesses per second, so your passphrase -- not the cipher -- decides whether traffic captured today decrypts next month.
SAE: Every Guess Needs a Live Round Trip
WPA3 replaces the pre-shared-key model with SAE (Simultaneous Authentication of Equals), a Dragonfly-based exchange. Both sides exchange commit and confirm messages built from the password through a discrete-log hunt, and the session PMK only materializes at the end of a completed exchange. There is no captured transcript to test offline: every wrong guess costs a fresh interactive round trip with the real AP, which can rate-limit and log it. SAE also derives fresh session keys, so recorded traffic does not retroactively unlock if the password leaks later. WPA3-SAE-PK (Pairwise Keying) eases migration: the router holds a pre-provisioned public key so devices transitioning from WPA2 authenticate through SAE machinery without exposing the legacy password to offline or reflection attacks.
Where WPA3 Still Needs You
Transition mode is the gap. Most WPA3 routers still accept WPA2 clients, so the capture-and-crack path stays alive until every device supports WPA3 -- keep four or more random words regardless. WPS is worse: its 8-digit PIN falls to a brute force in hours, so disable it, along with remote administration, UPnP port pinholes, and the default admin credentials. Keep firmware current; vendor images have long histories of hard-coded backdoors.
A Guest SSID Is a VLAN Boundary
A guest network should be a real boundary, not a label. The guest SSID maps to its own VLAN and subnet, and the router refuses to bridge the two: guests get internet but cannot scan or reach the NAS, printers, cameras, or smart fridge on the main LAN, and client isolation keeps guest-to-guest traffic away too. This is what stops a visitor laptop from pivoting to devices that ship with baked-in credentials and never patch. Enable it under a distinct SSID and never share the main passphrase.
Architecture Diagram
Key Takeaways
- WPA2-PSK hands attackers a captureable handshake (or PMKID) and turns your passphrase into an offline dictionary attack.
- WPA3-SAE forces every password guess into a live exchange with the AP -- no offline cracking, plus per-session forward secrecy.
- SAE-PK protects the password when migrating legacy WPA2 devices into a WPA3 network.
- Transition mode, WPS PINs, default admin logins, and UPnP are the practical holes -- disable them and update firmware.
- A guest network is only real if it is a separate VLAN with no routing or bridging to your main LAN.