Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

I am writing a paper right now which involves Wi-Fi security (I'll spare you the details). A major argument in this area depends on the assertion that Wi-Fi routers come defaulted as open networks (ie no encryption of any sort). Basically the argument is that since many users are ignorant of how to set up an AP properly, whatever the default setting is should be assumed as the permanent state of configuration when making policy decisions.

In my experience, I have not seen a router which did not at least come with WEP/WPA password or WPA with WPS enabled by default out of the box. Perhaps they were all open by default back in the early days, but in this day and age it seems that to assume all routers come without security turned on is anachronistic. Am I totally off base here, or does your experience match mine? Have you encountered any sources which could back me up? I'm having a very hard time finding anything to pin it down short of listing all the companies whose routers come with any security defaulted on which is insufficient to say the majority of routers come with security on. Thanks for your help!

share|improve this question
Yeah, from my personal experience I'd say most only turn the wifi on after you do setup over an ethernet cable, which requires you to set up the wifi password. – Polynomial Dec 2 '12 at 22:46
Most from ISPs have a default key generated from the particular serial number these days, open/wep/wpa depends entirely on routers age mostly. New models tend to have wpa if the wifi is on by default. Finally, so the automatic configuration tool on the CD the include in the box works, the serial number has been known to be broadcast and then the disc can run the generation algorithm itself, I'll let you consider the consequences of that. – ewanm89 Dec 3 '12 at 0:35
While the answers you get here will be a useful starting point, I'd hesitate to say they would be authoritative. I think you should email the manufacturers directly and ask. It should be an easy "Tier 1 HelpDesk" copy and paste answer for them. That way you would have authoritative answers, with only a little bit more work. Even better, let us know the results! – scuzzy-delta Dec 3 '12 at 3:20
This question is too time-localized. As advancements are made in security, and best practices become more common, vendors will undoubtedly resolve any insecure configurations which may be given as answers here. Already, in just the past few years, we've seen vendors switch from no encryption/authentication by default to WEP and then WPA2. They've also gone from using simple and weak default passwords and PSKs to complex, per-device passcodes. Also, this community cannot hope to address the broad scope currently defined in this question. – Iszi Dec 3 '12 at 6:00
1  
Hi Marta - welcome to Security.SE. This question unfortunately doesn't fit our model very well, as any answers will change with technology changes, and may in any case be a bit subjective. I think your paper sounds interesting, though, and you may be able to get some discussion on this over in IT Security Chat – Rory Alsop♦ Dec 3 '12 at 9:27
show 2 more comments

closed as too localized by Iszi, Rory Alsop♦ Dec 3 '12 at 9:25

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, see the FAQ.

Browse other questions tagged or ask your own question.