Is WPA3 actually rolled out widely in 2026?

Most new APs and Wi-Fi 6/6E/7 client devices support it; many sites run "WPA3 transition mode" so older clients still work via WPA2. Pure WPA3 deployments are still rare. The right strategy is to require WPA3 for sensitive SSIDs (corporate, restricted) while running mixed-mode for guest.

Should I prefer EAP-TLS or PEAP-MSCHAPv2?

EAP-TLS, always, for new corporate networks. The complexity is real (managing device certificates) but the security gap with PEAP-MSCHAPv2 is enormous and Microsoft has been signalling deprecation of NTLM-derived authentication in Windows networks for years.

Are MAC randomisation features a problem for me?

Modern Android/iOS randomise MACs per SSID, breaking MAC-allowlist controls. The right answer: do not rely on MAC allowlists for security; use 802.1X. MAC randomisation also has DPDP-relevant privacy benefits — collect minimal device info on guest networks.

How long should a WPA2 PSK be?

Long enough that offline brute force is computationally infeasible. 20+ characters of high entropy is the practical floor for WPA2-PSK. Better: switch to WPA3-Personal (SAE) where offline cracking is no longer the dominant threat. Best: WPA2/3-Enterprise with EAP-TLS and skip PSKs entirely.

Do I need wireless IDS or is the AP enough?

In a small office, AP-built-in detection covers most. In a large campus or sensitive site, dedicated wireless IDS (with sensors that observe but do not transmit) catches rogue APs, evil twins, and deauth attacks the production APs would miss. The cost is moderate; the value is regulator-defensible.

What about Wi-Fi 7 in India?

802.11be is shipping in 2025-2026 client devices; 6 GHz spectrum allocation is still in process with DoT/WPC. Initial enterprise deployments started in 2025 with 5 GHz-only Wi-Fi 7 to capture MLO benefits even before 6 GHz is officially available.

Is WPS still a problem?

Yes on consumer routers — WPS PIN brute-force (Reaver) still works on many SOHO devices. Enterprise APs typically have WPS disabled by default; verify in your audit. Treat enabled WPS as a finding.

Wireless Security — WPA3, 802.1X, Evil Twin, KRACK

Read as

Last updated: May 1, 2026

Wi-Fi has gone through five generations of security: WEP (broken, do not deploy), WPA/WPA2 (still common, still attackable via offline cracking and KRACK), WPA3 (the modern default with SAE replacing PSK), and 802.1X / WPA3-Enterprise for managed environments. This module covers the protocol differences, the attacks (deauth, evil twin, KRACK, FragAttacks, PMKID, KARMA), and the practical wireless security baseline an Indian enterprise should run in 2026.

Wi-Fi is the default network for almost every laptop and phone in India in 2026. WPA2-PSK is still the most-deployed mode and is well-attacked; WPA3 is the proper modern default but adoption is uneven; enterprise networks should be 802.1X with EAP-TLS, but most are not. This module is the practitioner walk-through of the protocols, the attacks, and the deployment patterns that actually defend wireless networks.

A brief history of Wi-Fi security — and why most "WPA2" deployments are still attacked

WEP

1997— broken since 2001, full keystream recovery in minutes, never deploy. WPA

2003— interim TKIP-based fix; do not deploy. WPA2

2004— AES-CCMP-based, still ubiquitous in 2026. The 4-way handshake using a Pre-Shared Key (PSK) gave us PMK, then PTK. Attacker captures the handshake passively, cracks PSK offline with hashcat. WPA3

2018— SAE (Simultaneous Authentication of Equals, “Dragonfly”) replaces PSK handshake with a forward-secret password-authenticated key exchange. Offline crack of captured handshake is no longer feasible. WPA3-Enterprise mandates 192-bit suites for high-security mode. OWE (Opportunistic Wireless Encryption) brings encryption to “open” Wi-Fi without authentication. Reality 2026: most home and small-office Wi-Fi is still WPA2-PSK; most managed enterprise SSIDs are WPA2-Enterprise (PEAP-MSCHAPv2 or EAP-TLS); WPA3 transition mode is widely deployed but mixed-clients still fall back to WPA2.

Need a real pentest?

Get a VAPT scoping call

Senior practitioner-led VAPT — not a checklist run by juniors. CVSS-scored findings, free retest, attestation letter. India's SMBs and SaaS teams.

Book VAPT scoping call Replies in 4 working hrs · India-only · Senior consultants

Wireless Security and Wi-Fi Attacks — WEP to WPA3, and Why Captive Portals Lie

A brief history of Wi-Fi security — and why most "WPA2" deployments are still attacked

Get a VAPT scoping call

Other modules in this track

Networking Fundamentals — OSI, TCP/IP, and Why Layers Actually Matter

Packet Analysis with Wireshark — From “Open the PCAP” to Diagnosing Real Incidents

Network Protocols Deep Dive — ARP, DHCP, ICMP, DNS, HTTP and the Trust They Assume