Safer Internet: Connection: Encrypt Wi-Fi

Quotes | Summary | Connecting | Encrypting | Admin | Remote Admin |
DNS | Conn. Problems | Backup | Firmware | SIM Pin |
References: General | Android | Cellular | DNS, IP | iOS |
ISP | macOS | Modem, Router | Wi-Fi | Windows

Quotes

Summary

[1] Connecting to a Wi-Fi Network

  • Connect to known networks using WPA2 -- unless you're already encrypting traffic using a Virtual Private Network (VPN), and/or HTTPS: for all web sites and TLS/SSL for email.
  • This assumes that your device, router and destination web server have the latest security updates installed;
    there are exceptions depending on your risk tolerance.
  • WEP (Wired Equivalency Protocol) is old and easily cracked -- barely better than no encryption
  • WPS (Wi-Fi Protected Setup) lets you use WPA without having to enter a long password; however, you may be vulnerable if you have not changed the pre-shared WPA key from the factory default setting, and PIN feature is enabled -- one reason why WPS is less secure than WPA2
  • wpaNetwork figures
  • with no encryption (Wi-Fi, SSL/HTTPS): {Figure 1. TCYOP-4: 56; TCYOP-3: 44}
  • with Wi-Fi encryption: {Figure 3. TCYOP-4: 58; TCYOP-3: 46}
  • Connect intentionally -- not automatically -- to open (insecure) Wi-Fi networks.
  • By default, macOS & iOS connect automatically only to "known" networks, i.e., open or password-protected networks that you've connected to before
  • Automatic connections might occur in older systems or on other platforms?
  • For a new, unknown network, you can be prompted to join it, or to select it manually. it won't connect automatically
  • macOS: System Preferences > Network > Wi-Fi > Ask to Join New Networks : "on" (prompt you when a new network is avail) or "off" (you'll select manually)
  • iOS: Settings > Wi-Fi > Ask to Join Networks (same as macOS)
  • iOS: Settings > Wi-Fi > (select network > 'i' > Auto-Join -- customize for individual networks
  • high altitude dolomitesiOS: If a friend's iOS 11 device tries to connect to your Wi-Fi network, you’ll receive a prompt that lets you send over the password by tapping Send Password
  • To remove a network from the list of automatically connecting "known" networks (that you've connected to previously)
  • macOS: System Preferences > Network > Wi-Fi > Advanced > W-Fi > (select network) > "-"
  • iOS: Settings > Wi-Fi > "i" (for network) > Forget This Network
  • warningCheck encryption level from client: none?, WEP?, WPA? WPA2?
  • macOS: menubar > [option-click] Wi-Fi icon: current network stats displayed; other networks: hover to display stats
  • iOS: Settings > Wi-Fi insecure connection warning (right)
  • You could also use a utility, e.g., NetSpot (Mac, Win) that displays encryption level for nearby networks -- and signal/noise, etc.
  • Android, macOS, Windows: How to Check WiFi Security Encryption Type 1/24/2014

[1] Encrypting your Wi-Fi Network

  • Encrypt Wi-Fi networks you control WPA2 (Wi-Fi Protected Access) -- not WPA or WPA2/WPA combo -- certainly not WEP; eventually WPA3 -- with a strong password: memorable / typable occasionally by you & your guests
  • Weak/no password could create problems if neighbors use your connection (& IP address)
    for illicit activities or excessive downloads -- not an issue (e.g., hackers in your driveway)
    if your WiFi range does not extend outside, or for hard-wired devices (via Ethernet cable)
  • Check your router's manual (download .pdf) to locate settings and router IP address, e.g., http://192.168.1.1
  • Connect via web browser to router's local web server, or use manufacturer's configuration app
  • Netgear WPAUse WPA2/AES rather than TKIP encryption (note: old Netgear figure shows incorrect combo setting)
  • Apple Airport config {Figure 2. TCYOP-4: 47; TCYOP-3: 45}
  • Netgear: Wireless Settings > Security Options > WPA2
  • TP-Link: Wireless (freq) > Wireless Security > WPA2 [screenshot]
  • [2] To make your network freely available to others, e.g., during a disaster, set up a separate Guest network (with no password), rather than disabling security on your regular network, if possible [screenshot]
  • If you set up your smartphone to share its data connection via Wi-Fi (aka 'Personal Hotspot' or 'tethering'), be sure to set a password for security and to avoid others using your data allocation.
  • iOS: Settings > Personal Hotspot (if Cellular Data on) > On (Wi-Fi,Bluetooth,USB); Wi-Fi Password: xxx

[1] Router: Admin Password

  • Set a strong admin password -- this protects the router itself -- different from the Wi-Fi password you use or supply to guests; long, random -- save in password manager!
  • If password is required to be short (older routers?), also change admin user name
  • Netgear: Maintenance > Set Password
  • TP-Link: System Tools > Password [screenshot]

Netgear remote[1] Router: Disable Remote Admin and UPnP

  • Turn off ability to log in and administer your router remotely -- hopefully, it was already off by default
  • Netgear: Advanced > Remote Management
  • TP-Link: Security > Remote Management [screenshot]
  • [3] Re-enable if you have need / expertise
  • Disable UPnP (Universal Plug and Play) -- hopefully, it was already off by default
  • TP-Link: Forwarding > UPnP (or maybe Advanced > NAT Forwarding?)
  • Check if disabled: F-Secure's Router Checker or ShieldsUp!! Instant UPnP Exposure Test

Netgear DNS[1] Router/Device DNS

  • "What does a network administrator say after returning from work?...
  • DNS (Domain Name System) is a directory service that returns an IP address corresponding to a domain name, e.g., www.google.com (analogous to telephone white pages)
  • Change DNS name servers; e.g., Netgear w/ OpenDNS (right)
  • suggested servers (below) usually faster than your ISP's DNS
  • reliability/speed: these servers generally better than what your ISP provides
  • privacy: reduce ISP logging of sites visited
  • security: avoid ISP redirecting non-existent addresses to promotional ad sites
  • Several free DNS services, and their primary and secondary name servers: {TCYOP-4: 69}
  • CloudFlare: 1.1.1.1; 1.0.0.1
  • Cloudflare: malware blocking 1.1.1.2; 1.0.0.2; + adult content blocking: 1.1.1.3; 1.0.0.3;
  • Google Public DNS: 8.8.8.8; 8.8.4.4
  • OpenDNS (Cisco): 208.67.222.222; 208.67.220.220
  • Quad9: 9.9.9.9; 149.112.112.112
  • Recursive DNS: 156.154.70.1; 156.154.71.1
  • If set centrally in your router, all your connected devices will use the DNS servers
  • Netgear: Basic Settings > DNS Address
  • TP-Link: DHCP > DHCP Settings [screenshot]; Network > WAN [screenshot]
  • If you have no router (or it's someone else's), you can change DNS directly on individual devices via "Network > DNS settings"
  • iOS: Settings > WiFi > (network: "i") > Configure DNS
  • For iOS (and Android) devices, an app can manage DNS more simply, esp. for cellular data. e.g., "1.1.1.1 Faster Internet" (Cloudflare) sets up a VPN connection for DNS lookups.
  • macOS: System Preferences > Network > Advanced > DNS > DNS Servers
  • macOS: If possible, create separate network profile, e.g., Home, Travel?
  • You can also hide -- and encrypt -- DNS lookups by using a VPN (next section)

[2] Wi-Fi Connection Problems?

  • If your Wi-Fi connection seems 'stuck', first try toggling Wi-Fi connection off/on; check that expected router reconnects
  • macOS: (Wi-Fi icon) > Turn Wi-Fi Off/On
  • iOS: Settings > Wi-Fi: off/on -- note: disabling via iOS11 Control Center does not completely turn off!
  • If just one app not working, e.g., browser ok, but not email, close/reopen app
  • [2] Reset/get new device IP address
  • iOS: Settings > Wi-Fi > (current network "i" icon) > Renew Lease
  • macOS: System Preferences > Network > Advanced > TCP/IP > Renew DHCP Lease
  • Basic troubleshooting (step 1): Disconnect/Reconnect to router (Mac: option-click Wi-Fi icon); Turn Wi-Fi Off/On; reboot computer/device
  • Basic troubleshooting (step 2): Turn Off cable/DSL modem & Router; wait ~60 seconds; Modem On; wait ~30-60 seconds (for internet connection to be established); Router On; wait until Wi-Fi connection reappears on device

[2] Router: Backup Settings

  • If you have made numerous changes, back up router settings to ease restoration after any 'factory reset'.
  • Netgear: Maintenance > Backup Settings
  • TP-Link: System Tools > Backup & Restore

[2] Router: Update Firmware

  • Check your router manufacturer's web site periodically (or automatically upon login) for firmware (i.e., low-level software) upgrades -- and install them
  • Beyond having a good admin password, and disabling remote admin, this should further minimize security problems and attempts to weaken or hijack router, e.g., WPA2 protocol vulnerability (KRACK: Key Reinstallation Attacks) 10/16/2017; VPNFilter 5/23/2018
  • Netgear: Maintenance > Router Upgrade
  • TP-Link: System Tools > Firmware Upgrade [screenshot]
  • If you rent a router from your ISP, check with them about updates.
  • [3] Firmware in a cable modem should be updated automatically by your ISP.
  • Check current modem version by browsing (usually) to: http://192.168.100.1 to access diagnostic page;
    check manufacturer site for recommended version; contact ISP if major discrepancy.

[3] Set Device SIM PIN

  • On some devices, e.g., iPhone, iPad*, you can lock your SIM card so that cellular data can't be used without entering a PIN -- whenever you swap SIM cards or restart. To enable, disable or change your SIM PIN:
  • iPhone: Settings > Phone > SIM PIN
  • iPad: Settings > Cellular Data > SIM PIN (*Wi-Fi + Cellular models)

References

Android

Cellular

DNS, IP Addresses

iOS

ISP; Satellite

macOS

Modem, Router

cafe iceland no wifiWi-Fi

Windows