Ethical › Module 16 › Lesson 1
SSID, Encryption, and Guest Networks
WPA2/WPA3 as confidentiality on the air. Open café Wi-Fi is a threat model.
Visual · ssid_wpa_encryption
The air is a shared radio. WPA2/WPA3 is confidentiality on YOUR SSID. An open café network is a threat model for YOUR traffic — never a neighbor to crack.
Opening
Wi-Fi is a radio. Confidentiality is a lock on that radio. An SSID is only a name — and a café with no lock is a threat model, not a hunting ground.
Modules 1–15 kept every lab on a box, a listener, or a file you own. Module 16 is wireless: frames travel through air anyone nearby can energize. An SSID is a broadcast label. WPA2 or WPA3 is confidentiality on that name. An open café is a threat model for YOUR sessions — the same mood as leftover HTTP in Module 8 — not a lab in capturing neighbors or cracking handshakes. This is original Cyberlium teaching mapped to the CEH v13 wireless domain — not official EC-Council training, not a cert, not exam dumps. No aircrack-ng. No hashcat handshake. No deauth. No neighbor because the radio crossed a wall. Next names a rogue AP as a lookalike — still not a café twin. Here you name SSID versus encryption, lock notes, and keep the only hands-on SSID as one YOU administer.
1. The air is a shared wire — confidentiality has to live on the radio
On Ethernet, a switch usually delivers a frame to one port. On Wi-Fi, energy is a radio nearby adapters can hear even when they are not “on” your network. That physics sentence is Module 8 literacy. It is not consent. “The signal was in my kitchen” does not make a neighbor’s SSID yours. Confidentiality is link encryption — WPA2/WPA3 — so a stranger should not read your inner bytes just by sitting nearby. Without that lock, the air is closer to a hub than to a private cable.
Write the legal sentence first: original Cyberlium teaching mapped to the CEH v13 wireless domain — not official EC-Council training, not a cert, not exam dumps. A blog’s cert acronym is not a warrant. Skill does not create consent. The only authorized wireless object in this module is an SSID YOU administer — home lab, hotspot you created, router whose admin you are — or a labeled hypothetical you would own. Café, campus, hotel, and neighbor are out.
Command guide
Air is a shared wire — WHAT/WHY
═══ COMMANDS ═══
Command — copy this
cat >> "$NOTES" << 'EOF' air_is_shared: confidentiality must be on the radio (WPA2/WPA3) refuse: aircrack/handshake dumps, cafe capture EOF
2. SSID is a name on a list — hiding it is not a lock
An SSID is the string phones display. It is branding, not authentication, not encryption. “Hidden SSID” is a comfort setting, not confidentiality — clients still probe; the name still leaks. MAC-address allow-lists are the same class of comfort. Neither replaces WPA2/WPA3 and a long unique passphrase on a network you own.
A useful failure: “if I hide my SSID and filter MACs, I do not need WPA.” That is an unlocked door with extra checkboxes. Another failure: surveying every SSID on the floor into a trophy list. If you can see a neighbor’s label in the picker, you still do not add it to cyberlium-lab. Notes name YOUR SSID (or a hypothetical you own) and its encryption mode. Other people’s labels stay off the disk.
3. WPA2 and WPA3 are confidentiality on the air — named, never cracked here
WPA2-Personal and WPA3-Personal are the lock on a home or lab AP you administer. Prefer WPA3 when the box and clients allow it. WPA2 with a long unique passphrase is the fallback — still a lock, still not open. WEP is obsolete: retire it on gear YOU own. That is a retirement notice, not a crack recipe. You do not need aircrack, hashcat, a handshake, or a deauth to understand “use WPA3.” You need YOUR router UI (Lesson 4) or a hypothetical you label as yours.
Enterprise Wi-Fi (802.1X) is a named idea so you know campuses often authenticate people, not a shared house passphrase. Joining as a student does not make campus yours to audit, clone, or crack. No EAP capture. No fake enterprise portal. Open networks have no PSK lock — that is why café Wi-Fi is a threat model for YOUR HTTPS and VPN habits (Module 8), not a harvest of the table next to you.
4. Open café Wi-Fi is a threat model for YOUR traffic — not a neighbor to crack
When you join an open SSID, you chose a path with no link confidentiality. Treat it like leftover HTTP: prefer HTTPS, prefer a VPN you already trust, do not type secrets into a surprise portal, do not assume “Airport_Free” is the airport. Module 8’s sniffer is a microscope of frames you are allowed to see. Café guests are not in that set. Open is not consent. Open is a missing lock.
Hotel and campus guest Wi-Fi you did not build get the same sentence: customer if you must, never Module 16 homework. Do not crack, clone, or deauth it. A blog that starts wireless with a coffee-shop handshake is not this course. Encryption of YOUR home SSID is the homework. Other people’s air is not.
5. What you record: YOUR SSID, encryption mode, café-as-threat-model — not a hallway survey
A wireless literacy note is boring on purpose. Date (UTC). SSID_means: a name, not a lock. Encryption_means: WPA2 or WPA3 (WPA3 preferred on gear you own). Open_cafe_means: threat model for MY traffic — never a capture lab. Ethics: NEVER aircrack, hashcat handshake, deauth, or neighbor/café/campus as a target. Legal line: original Cyberlium teaching mapped to the CEH v13 wireless domain — not official EC-Council training, not a cert, not exam dumps. Path: $HOME/cyberlium-lab/ssid-encryption-notes.txt, chmod 600. Empty files fail. Neighbor SSIDs as targets fail. World-readable 777 fails.
A useful feeling: the lesson is “too small” because you did not capture a handshake. That feeling is how people leave literacy. The skill is stopping at names. Lesson 2 names rogue APs as lookalikes you refuse to run in public. Lesson 4 writes encryption mode and guest status for a network you administer — or a hypothetical you own plus ethics. A filled definition file is a complete Lesson 1. Do not paste aircrack flags as “research.”
6. Wrong vs right: hallway aircrack vs named encryption and locked notes
Worked failure — same curiosity about Wi-Fi, opposite blast radius. Right never treats a café, a campus, or a neighbor as a wireless lab.
Wrong
Capture a neighbor handshake. Run aircrack-ng or hashcat. Deauth a stranger “to get a handshake.” Hide SSID and skip WPA. Dump café SSIDs into Discord as CEH. Save world-readable notes with victim names. This course is not official CEH training and does not give you that hunt.
Right
Name SSID as a label. Name WPA2/WPA3 as confidentiality on the air. Treat open café Wi-Fi as a threat model for YOUR traffic, not a crack lab. Write ssid-encryption-notes.txt in $HOME/cyberlium-lab, chmod 600. No aircrack. No hashcat. No neighbor. Next: Rogue AP as a Trust Trick — recognize a lookalike; do not run one in public.
7. Hands-on: lock ssid-encryption-notes.txt — names only, no handshake file
On a computer you own, create cyberlium-lab if needed. Fill the template in your own words. Do not add a capture. Do not add a neighbor SSID. chmod 600. The block below writes the file and refuses to become a crack kit — there is no monitor mode, no handshake, no extra radio.
Command guide
WPA2/WPA3 named — WHAT/WHY then lock
═══ COMMANDS ═══
Command — copy this
cat >> "$NOTES" << 'EOF' wpa2_wpa3: confidentiality on MY air refuse: crack WPA, hashcat, cafe handshake EOF
Mission: ssid-encryption-notes.txt in cyberlium-lab (mode 600)
1) In your own words, define SSID as a name (not a lock) and WPA2/WPA3 as confidentiality on the air — no crack commands. 2) Fill $HOME/cyberlium-lab/ssid-encryption-notes.txt with the legal line, open-café threat model, and ethics refuse line. chmod 600. 3) Ethics: no aircrack, no hashcat handshake, no deauth, no café/campus/neighbor target. Lesson 4 is YOUR administered Wi-Fi only.
Stuck? Ask Cyberlium AI Mentor
If “I cannot learn wireless without a handshake from the hallway” still feels true, ask for a hint — not a crack line. Try: "Hint only: why an SSID is a name not a lock, why WPA2/WPA3 is confidentiality on the air, why open café Wi-Fi is a threat model for MY traffic, and where locked notes live?" You still fill ssid-encryption-notes.txt. No aircrack. No neighbor. No café capture.
You now treat Wi-Fi as a radio that needs a lock: SSID is a label, WPA2/WPA3 is confidentiality, open café Wi-Fi is a threat model for YOUR sessions — not a hunting ground. Notes are locked in cyberlium-lab. This is original Cyberlium teaching mapped to the CEH v13 wireless domain — not official EC-Council training, not a cert, not exam dumps. Next — Rogue AP as a Trust Trick — lookalike names you recognize and refuse to run in public.
Knowledge Check
APPLY: A classmate wants to aircrack a neighbor handshake “for a few minutes of CEH wireless.” What is an SSID here, and what do you do?
Multiple choice
Knowledge Check
APPLY: True or False: Open café Wi-Fi is in-scope to capture because there is no password, and Module 16 is wireless.
True or False
Knowledge Check
APPLY: You are filling ssid-encryption-notes.txt. Which pairing matches the allowed artifact and hygiene?
Multiple choice
Knowledge Check
APPLY: curl of http://192.168.0.1/ shows a home router login (TP-Link / Netgear / Huawei / "Router Admin"). Is that DEMO in scope as a hacking target?
Multiple choice