Safer Internet: Connection: Encrypt Wi-Fi

Quotes

Summary

[1] Don't connect to unknown public networks, such as "Free WiFi", or hotspots with no/weak/public passwords -- to reduce data interception, ISP injections (ads), and MITM (man-in-the-middle) attacks. Read privacy policy. Some providers may track location across multiple Wi-Fi networks.
[1] Connect to Wi-Fi networks securely
[1] Set a strong memorable/typable password for your Wi-Fi network with WPA2 (encryption level) -- or WPA3 if available
[1] Router Maintenance: Set an Admin password (long random); Disable Remote Admin & UPnP
[1] Change DNS servers
[2] Troubleshoot common connection problems
[2] Router Maintenance: Backup settings; Update firmware
[3] Set phone/tablet SIM PIN
References

[1] Connecting to a Wi-Fi Network

Connect to known networks using WPA2 -- unless you're already encrypting traffic using a Virtual Private Network (VPN), and/or HTTPS: for all web sites and TLS/SSL for email.
This assumes that your device, router and destination web server have the latest security updates installed;
there are exceptions depending on your risk tolerance.
WEP (Wired Equivalency Protocol) is old and easily cracked -- barely better than no encryption
WPS (Wi-Fi Protected Setup) lets you use WPA without having to enter a long password; however, you may be vulnerable if you have not changed the pre-shared WPA key from the factory default setting, and PIN feature is enabled -- one reason why WPS is less secure than WPA2
Network figures
with no encryption (Wi-Fi, SSL/HTTPS): {Figure 1. TCYOP-4: 56; TCYOP-3: 44}
with Wi-Fi encryption: {Figure 3. TCYOP-4: 58; TCYOP-3: 46}
Connect intentionally -- not automatically -- to open (insecure) Wi-Fi networks.
By default, macOS & iOS connect automatically only to "known" networks, i.e., open or password-protected networks that you've connected to before
Automatic connections might occur in older systems or on other platforms?
For a new, unknown network, you can be prompted to join it, or to select it manually. it won't connect automatically
macOS: System Preferences > Network > Wi-Fi > Ask to Join New Networks : "on" (prompt you when a new network is avail) or "off" (you'll select manually)
iOS: Settings > Wi-Fi > Ask to Join Networks (same as macOS)
iOS: Settings > Wi-Fi > (select network > 'i' > Auto-Join -- customize for individual networks
iOS: If a friend's iOS 11 device tries to connect to your Wi-Fi network, you’ll receive a prompt that lets you send over the password by tapping Send Password
To remove a network from the list of automatically connecting "known" networks (that you've connected to previously)
macOS: System Preferences > Network > Wi-Fi > Advanced > W-Fi > (select network) > "-"
iOS: Settings > Wi-Fi > "i" (for network) > Forget This Network
Check encryption level from client: none?, WEP?, WPA? WPA2?
macOS: menubar > [option-click] Wi-Fi icon: current network stats displayed; other networks: hover to display stats
iOS: Settings > Wi-Fi insecure connection warning (right)
You could also use a utility, e.g., NetSpot (Mac, Win) that displays encryption level for nearby networks -- and signal/noise, etc.
Android, macOS, Windows: How to Check WiFi Security Encryption Type 1/24/2014

[1] Encrypting your Wi-Fi Network

Encrypt Wi-Fi networks you control WPA2 (Wi-Fi Protected Access) -- not WPA or WPA2/WPA combo -- certainly not WEP; eventually WPA3 -- with a strong password: memorable / typable occasionally by you & your guests
Weak/no password could create problems if neighbors use your connection (& IP address)
for illicit activities or excessive downloads -- not an issue (e.g., hackers in your driveway)
if your WiFi range does not extend outside, or for hard-wired devices (via Ethernet cable)
Check your router's manual (download .pdf) to locate settings and router IP address, e.g., http://192.168.1.1
Connect via web browser to router's local web server, or use manufacturer's configuration app
Use WPA2/AES rather than TKIP encryption (note: old Netgear figure shows incorrect combo setting)
Apple Airport config {Figure 2. TCYOP-4: 47; TCYOP-3: 45}
Netgear: Wireless Settings > Security Options > WPA2
TP-Link: Wireless (freq) > Wireless Security > WPA2 [screenshot]
[2] To make your network freely available to others, e.g., during a disaster, set up a separate Guest network (with no password), rather than disabling security on your regular network, if possible [screenshot]
If you set up your smartphone to share its data connection via Wi-Fi (aka 'Personal Hotspot' or 'tethering'), be sure to set a password for security and to avoid others using your data allocation.
iOS: Settings > Personal Hotspot (if Cellular Data on) > On (Wi-Fi,Bluetooth,USB); Wi-Fi Password: xxx

[1] Router: Admin Password

Set a strong admin password -- this protects the router itself -- different from the Wi-Fi password you use or supply to guests; long, random -- save in password manager!
If password is required to be short (older routers?), also change admin user name
Netgear: Maintenance > Set Password
TP-Link: System Tools > Password [screenshot]

[1] Router: Disable Remote Admin and UPnP

Turn off ability to log in and administer your router remotely -- hopefully, it was already off by default
Netgear: Advanced > Remote Management
TP-Link: Security > Remote Management [screenshot]
[3] Re-enable if you have need / expertise
Disable UPnP (Universal Plug and Play) -- hopefully, it was already off by default
TP-Link: Forwarding > UPnP (or maybe Advanced > NAT Forwarding?)
Check if disabled: F-Secure's Router Checker or ShieldsUp!! Instant UPnP Exposure Test

[1] Router/Device DNS

"What does a network administrator say after returning from work?...
DNS (Domain Name System) is a directory service that returns an IP address corresponding to a domain name, e.g., www.google.com (analogous to telephone white pages)
Change DNS name servers; e.g., Netgear w/ OpenDNS (right)
suggested servers (below) usually faster than your ISP's DNS
reliability/speed: these servers generally better than what your ISP provides
privacy: reduce ISP logging of sites visited
security: avoid ISP redirecting non-existent addresses to promotional ad sites
Several free DNS services, and their primary and secondary name servers: {TCYOP-4: 69}
CloudFlare: 1.1.1.1; 1.0.0.1
Cloudflare: malware blocking 1.1.1.2; 1.0.0.2; + adult content blocking: 1.1.1.3; 1.0.0.3;
Google Public DNS: 8.8.8.8; 8.8.4.4
OpenDNS (Cisco): 208.67.222.222; 208.67.220.220
Quad9: 9.9.9.9; 149.112.112.112
Recursive DNS: 156.154.70.1; 156.154.71.1
If set centrally in your router, all your connected devices will use the DNS servers
Netgear: Basic Settings > DNS Address
TP-Link: DHCP > DHCP Settings [screenshot]; Network > WAN [screenshot]
If you have no router (or it's someone else's), you can change DNS directly on individual devices via "Network > DNS settings"
iOS: Settings > WiFi > (network: "i") > Configure DNS
For iOS (and Android) devices, an app can manage DNS more simply, esp. for cellular data. e.g., "1.1.1.1 Faster Internet" (Cloudflare) sets up a VPN connection for DNS lookups.
macOS: System Preferences > Network > Advanced > DNS > DNS Servers
macOS: If possible, create separate network profile, e.g., Home, Travel?
You can also hide -- and encrypt -- DNS lookups by using a VPN (next section)

[2] Wi-Fi Connection Problems?

If your Wi-Fi connection seems 'stuck', first try toggling Wi-Fi connection off/on; check that expected router reconnects
macOS: (Wi-Fi icon) > Turn Wi-Fi Off/On
iOS: Settings > Wi-Fi: off/on -- note: disabling via iOS11 Control Center does not completely turn off!
If just one app not working, e.g., browser ok, but not email, close/reopen app
[2] Reset/get new device IP address
iOS: Settings > Wi-Fi > (current network "i" icon) > Renew Lease
macOS: System Preferences > Network > Advanced > TCP/IP > Renew DHCP Lease
Basic troubleshooting (step 1): Disconnect/Reconnect to router (Mac: option-click Wi-Fi icon); Turn Wi-Fi Off/On; reboot computer/device
Basic troubleshooting (step 2): Turn Off cable/DSL modem & Router; wait ~60 seconds; Modem On; wait ~30-60 seconds (for internet connection to be established); Router On; wait until Wi-Fi connection reappears on device

[2] Router: Backup Settings

If you have made numerous changes, back up router settings to ease restoration after any 'factory reset'.
Netgear: Maintenance > Backup Settings
TP-Link: System Tools > Backup & Restore

[2] Router: Update Firmware

Check your router manufacturer's web site periodically (or automatically upon login) for firmware (i.e., low-level software) upgrades -- and install them
Beyond having a good admin password, and disabling remote admin, this should further minimize security problems and attempts to weaken or hijack router, e.g., WPA2 protocol vulnerability (KRACK: Key Reinstallation Attacks) 10/16/2017; VPNFilter 5/23/2018
Netgear: Maintenance > Router Upgrade
TP-Link: System Tools > Firmware Upgrade [screenshot]
If you rent a router from your ISP, check with them about updates.
[3] Firmware in a cable modem should be updated automatically by your ISP.
Check current modem version by browsing (usually) to: http://192.168.100.1 to access diagnostic page;
check manufacturer site for recommended version; contact ISP if major discrepancy.

[3] Set Device SIM PIN

On some devices, e.g., iPhone, iPad*, you can lock your SIM card so that cellular data can't be used without entering a PIN -- whenever you swap SIM cards or restart. To enable, disable or change your SIM PIN:
iPhone: Settings > Phone > SIM PIN
iPad: Settings > Cellular Data > SIM PIN (*Wi-Fi + Cellular models)

References

{TCYOP-4: 55-77; {TCYOP-3: 44-47}
sections: Refs: Android; Cellular; DNS, IP; iOS; ISP; macOS; Modem, Router; Wi-Fi; Windows
topics: DNS hijacking, domains, IPv4 address crisis, KRACK, radiation, speed tests
"If a packet hits a pocket on a socket on a port,
And the bus is interrupted as a very last resort...
"Oh, the network outside is frightful,
But on campus, it's so delightful...
Wikipedia: router; Network Address Translation (NAT); Internet of Things (IoT)
Wikipedia: NAT: telephone number extension analogy
HowStuffWorks: How Routers Work; Router Quiz; How Network Address Translation Works
HowStuffWorks: How Home Networking Works; Home Networking Quiz
Home Networking (Wydea): intro video: 0:44; modem; router; longer video 3:16; cables; Wi-Fi range; WPA; switch vs. router; powerline; sharing
Wikipedia: IP (Internet Protocol) address; IPv4 (IP version 4): ~4.3 billion (2³²); adopted: 1981; currently, running out of addresses
Wikipedia: IPv6 2¹²⁸ (~3.4x10³⁸) addresses; spec. published 1998; this amounts to approximately 5x10²⁸ addresses for each of the 6.8 billion people alive in 2010. While these numbers are impressive, it was not the intent of the designers of the IPv6 address space to assure geographical saturation with usable addresses. Rather, the longer addresses simplify allocation of addresses, enable efficient route aggregation, and implementation of special addressing features.; World IPv6 Launch
HowStuffWorks: What is an IP address?
Wikipedia: Subscriber Identity Module (SIM card)
What Does 'Wi-Fi' Stand For? It’s Complicated
some sources say it’s ‘wireless fidelity.’ But that’s not exactly true; MF; 5/7/2024
Steps to Simple Online Security: 10: Secure Your Wi-Fi NYT; 4/15/2022
How to Turn Off Amazon Sidewalk
opt out Echo and Ring devices from internet-sharing mesh network; Wired; 6/8/2021
Why Public Wi-Fi is a Lot Safer Than You Think due to the widespread deployment of HTTPS encryption on most popular websites, advice to avoid public Wi-Fi is mostly out of date and applicable to a lot fewer people than it once was -- assuming software up to date; domain lookups still visible; EFF; 1/29/2021
Speed Up Your Internet by Limiting Bandwidth-Hungry Apps LH; 7/16/2019
The Land Where the Internet Ends To find real solitude, you have to go out of range. But every year that's harder to do, as America's off-the-grid places disappear; Green Bank, WV; 6/21/2019
Why Do Internet Speed Tests Report Different Results? LH; 5/17/2019
The Top 10 Ways to Deal with a Slow Internet Connection
10. Check your speeds (and your internet plan);
9. Give your hardware the universal fix (turn off/on);
8. Know your hardware's limitations;
7. Fix your WiFi signal;
6. Turn off or limit bandwidth-hogging apps;
5. Try a new DNS server;
4. Call your internet provider;
3. Optimize your web for a slow connection;
2. Work smarter;
1. Don't worry about it; LH; 5/16/2019
How the Internet Travels Across Oceans NYT; 3/10/2019
Military Carrier Pigeons in the Era of Electronic Warfare transport data on microSD cards; 1/24/2019

Wi-Fi

Wikipedia: Wi-Fi: Wireless Local Area Network (WLAN); 802.11
Wikipedia: WPA/WPA2 (Wi-Fi Protected Access); WEP (Wired Equivalency Protocol) obsolete
Wikipedia: WPS (Wi-Fi Protected Setup) avoids long passcodes; convenience for users; can be vulnerable if PIN feature enabled
HowStuffWorks: How WiFi Works; Quiz
Take Control: Apple Wi-Fi Network
Forgot Your Wi-Fi Passwords?
here's an Easy Way to Find Them Again; Giz; 8/30/2024
11 Ways to Upgrade Your Wi-Fi and Make Your Internet Faster
1. Move Your Router; 2. Use an Ethernet Cable;
3. Change the Channel or Band; 4. Upgrade Your Router;
5. Get a Wi-Fi Extender; 6. Use Your Electrical Wiring;
7. Add a Password to Your Wi-Fi; 8. Cut Off Unused Devices;
9. Check Your PC; 10. Restart Your Router?
11. Call Your ISP; Wired; 1/22/2024
What is Wi-Fi 7? Everything You Need to Know Wired; 1/8/2024
Your Computer Secretly Stores All Your Wi-Fi Passwords. Here's How to Find Them CNet; 3/22/2023
Do This to Seamlessly Connect Guests to Your Wifi NFC, QR; LH; 11/21/2022
How to Share Your Wi-Fi Password Wired; 8/7/2022
Traveling? Beware of Unsecured Hotel Wi-Fi Networks OSXD; 7/28/2022
How to Force Open a Public Wi-Fi Login Page (Captive Portal) OSXD; 6/26/2022
How to make sure your hotel's Wi-Fi is fast enough USA; 5/27/2022
These Things Are Blocking Your Home’s Wifi Signal LH; 5/26/2022
Wi-Fi 7 Is Coming, and Here's Why You Should Care
IEEE 802.11be Extremely High Throughput (EHT); Giz; 2/16/2022
The Best Ways to Boost Your Wifi Signal for Free LH; 2/2/2022
How to Share Your Wifi Password
And, iOS, Mac, Win; LH; 12/20/2021
The Truth About the Quietest Town in America
The National Radio Quiet Zone limits wireless communications.
But a journey to its center in Green Bank, West Virginia reveals a town at odds with itself.
Wired; 8/3/2021
How to Share Your Wi-Fi Password
between Apple devices with visitor in your Contacts and vice versa;
QR code; Wired; 7/25/2021
Did weak wi-fi password lead the police to our door?
BBC; 5/23/2021
How to name your Wi-Fi networks for best Mac, iPhone, and iPad roaming
WPA2 settings; separate names useful if you have a lot of older equipment that bogs down the 5 GHz network; MW; 5/5/2021
Wi-Fi's biggest upgrade in decades is starting to arrive Wi-Fi 6E (6GHz) devices are now being certified; Verge; 1/7/2021
Check If the Wifi Is Going to Suck Before You Arrive Lag app; LH; 9/15/2020
5 Simple Ways to Improve Your Wi-Fi
1. Reposition your router;
2. Use an Ethernet cable instead;
3. Buy a new Wi-Fi router, extender or mesh networking kit;
4. Consider using a Wi-Fi hot spot (or your phone);
5. Upgrade your internet plan;
NYT; 8/24/2020
How to turn your home Wi-Fi password into a QR code for easy sharing TNW; 7/20/2020
Desperate for Wi-Fi, Many Have Nowhere to Go but a Parking Lot With cafes and libraries closed, Americans without internet access are sitting outside them to get free and fast connections; NYT; 5/5/2020
How to Check Your Wifi Signal Strength LH; 4/27/2020
What You Need to Know About Wifi 6E LH; 4/24/2020
Flaw in billions of Wi-Fi devices left communications open to eavesdroppng Cypress and Broadcom chip bug; Ars; 2/26/2020
[2] Ten rules for placing your Wi-Fi access points Ars; 2/24/2020
You Need More Than HTTPS to Stay Safe on Public Wifi hackers can see metadata: domain names, size of files/pages, non-https sites & services; LH; 2/21/2020
Find the WiFi Password For Almost Any Airport Lounge Using This Free Map LH; 1/20/2020
[2] How to Find the Login Page on Public Wifi LH; 1/13/2020
Tired of hearing about Wi-Fi 6? Great, let’s talk about Wi-Fi 6E doubling Wi-Fi's usable spectrum; Ars; 1/6/2020
How Can I Find Out If Someone's Stealing My Wifi?
Low-tech method: Check your wireless router lights;
Network admin method: Check your router device list;
Detective method: Use a network monitoring software tool;
Moving forward: Beef up your wifi security; LH; 10/4/2019
[2] How to Reveal Your Saved Wifi Passwords in Windows or macOS LH; 9/19/2019
Wi-Fi 6 is barely here, but Wi-Fi 7 is already on the way in 2024; CNet; 9/3/2019
Wi-Fi 6 Will Be Here Soon. What Is It? Wired; 8/29/2019
Ask About a Hotel or Airbnb's WiFi Before You Book speed, caps, cost; LH; 8/25/2019
With 'warshipping', hackers ship their exploits directly to their target's mail room Wi-Fi devices in packages; TC; 8/6/2019
82% of People in Study Say They Connect to Any Free WiFi That's Available in a Public Place 8/1/2019
Never Commit a Crime When Your Phone Is Connected to a Wi-Fi Network Four students who left racist graffiti on their high school were caught when their smartphones betrayed them; Slate; 7/12/2019
6 Ways to Identify If You're Using Fraudulent Wi-Fi
1. The Wi-Fi Network Has A Vague Name.
2. You Haven't Confirmed The Network Name With Someone Trustworthy.
3. The Network Name Looks Almost Identical To Another One In The Area.
4. There Wasn't An Opt-In Page When You Logged On.
5. The Network Required You To Install Something Before You Could Use It.
6. The Network Isn't On A Reliable Database Of Vetted Networks; MF; 7/2/2019
Wi-Fi 6: Better, faster internet is coming -- here's what you need to know CNet; 5/11/2019
How Do I Share My Neighbor's Wi-Fi Connection? with permission; LH; 4/12/2019
[2] Serious flaws leave WPA3 vulnerable to hacks that steal Wi-Fi passwords Ars; 4/11/2019
How Do I Block My Neighbor's Wifi? LH; 3/22/2019
A brief history of Wi-Fi security protocols from "oh my, that's bad' to WPA3 ~1997: WEP(RC4); ~1999:WPA(TKIP); ~2004:WPA2(AES-CCMP); ~2018:WPA3(NFC, PFS, SAE); Ars; 3/10/2019
Do My Devices Have to Use the Same Wi-Fi Band to Talk to Each Other? LH; 3/8/2019
[2] Which Wi-Fi Channels Should I Use for My Wireless Network?
2.4GHz (2400-2500MHz): 14 channels @ 20MHz each, all overlapping -- ideally, channels 1, 6, or 11;
5GHz (5200-5400MHz): 25 channels @ 20MHz each, though you’ll only typically see up to 12 options, each 40MHz wide;
you want your wireless networks to live on channels that have as few competing networks as possible;
wireless scanning app: Wifi Analyzer Win: free;
Wifi Explorer Mac: $20;
NetSpot: And, Mac, Win: free, $; LH; 2/22/2019
Wi-Fi 6: is it really that much faster? WPA3; theoretical max speed: 9.6 Gbps vs. 3.5 Gbps on Wi-Fi 5; more about improving the network when many devices are connected; Verge; 2/21/2019
Which Wi-Fi Band Should I Use for My Devices? 2.4GHz band: better range; 5GHz band: fastest speeds; congestion, number of devices? LH; 2/15/2019
[2] WiFi firmware bug affects laptops, smartphones, routers, gaming devices lets attacker hijack devices without any user interaction; list of impacted devices includes PS4, Xbox One, Samsung Chromebooks, and Microsoft Surface devices; "patches are in the works"; ZD; 1/18/2019

Windows

Printer-friendly version

Safer Internet: Connection: Encrypt Wi-Fi

Quotes

Summary

[1] Connecting to a Wi-Fi Network

[1] Encrypting your Wi-Fi Network

[1] Router: Admin Password

[1] Router: Disable Remote Admin and UPnP

[1] Router/Device DNS

[2] Wi-Fi Connection Problems?

[2] Router: Backup Settings

[2] Router: Update Firmware

[3] Set Device SIM PIN

References

Android

Cellular

DNS, IP Addresses

iOS

ISP; Satellite

macOS

Modem, Router

Wi-Fi

Windows