Return to Answer

You should not use a "non-dictionary based word" for your AP "password", but instead use a multi-word passphrase. Don't reuse this passphrase for anything else (that you want to keep private) as you will be sharing this password (visiting friend needs to connect their laptop) and your devices will be storing this in a recoverable way. (And some devices will even by default store your wifi passwords in the cloud for you!) I suggest passphrase as it's easier to tell someone "correct horse battery staple" (all lowercase spaces, between words), than "Capital T, lowercase r, zero, lowercase u-b, number four, lowercase d-o-r, ampersand, number three" and the passphrase has higher entropy (also see discussion here). Attacks on observed wifi handshakes can be done offline, so strong passphrases are needed.

MAC address filtering is trivial to bypass and annoying to manage. MAC addresses are used for layer-2 (link level) addressing; so in wifi that's the radio signal between your router and any listening receiver. Even when you have an encrypted connection; the data is being encrypted not the layer-2 packet headers. Hence, if a router is using MAC address filtering, its quite easy to collect one packet sent from the router (to an allowed MAC address) and the attacker can then change their MAC address to clone the observed allowed MAC address. (Yes, two different computers using the same MAC address at the same time would cause problems, but you can wait until they no longer are using it.) Furthermore, MAC address filtering is annoying to manage, because you'll have to go into your router settings every time you add a new device to your network and copy the 12 hexademical digit MAC address (and bother with figuring out how to pull up a MAC address on every random wifi device). People who use MAC address filtering also get suckered into thinking its very secure and then make weak choices for passphrase or think its ok to use WEP or WPS or other vulnerabilities.

Disabling SSID broadcast leads to a loss of features for no concrete gain in security. Your mobile devices will not be able to automatically connect to the wifi network. Your cell phone can't switch from 3G/4G radio to faster less-power hungry wifi when you get home, unless you manually press buttons to switch to the unbroadcast network, or if the device is configured to frequently broadcast I'm looking for SSID 'sdfasdfasdf' that which leaves you vulnerable to attackers with rogue access points that will reply that's me. (Granted with WPA2 they should not be able to complete the 4-way handshake with you; but depending on your device - it may allow a connection to the same SSID that's suddenly not WPA2). Like MAC addresses, you can eavesdrop the SSID from observing other clients connecting to the non-broadcasting network even if WPA2 is enabled.

Make sure WPS (Wifi Protected Setup) is disabled. Many routers come with WPS enabled by default, and this allows an attacker to break into your network in under 11000 guesses. Granted newer routers may have timeouts on consecutive attempts that may make this more difficult; but the standard suggests only a 60s timeout which only delays an attackers attempts to break in by a couple days).

You should not use a "non-dictionary based word" for your AP "password", but instead use a multi-word passphrase. Don't reuse this passphrase for anything else (that you want to keep private) as you will be sharing this password (visiting friend needs to connect their laptop) and your devices will be storing this in a recoverable way. (And some devices will even by default store your wifi passwords in the cloud for you!) I suggest passphrase as it's easier to tell someone "correct horse battery staple" (all lowercase spaces, between words), than "Capital T, lowercase r, zero, lowercase u-b, number four, lowercase d-o-r, ampersand, number three" and the passphrase has higher entropy (also see discussion here). Attacks on observed wifi handshakes can be done offline, so strong passphrases are needed.

MAC address filtering is trivial to bypass and annoying to manage. MAC addresses are used for layer-2 (link level) addressing; so in wifi that's the radio signal between your router and any listening receiver. Even when you have an encrypted connection; the data is being encrypted not the layer-2 packet headers. Hence, if a router is using MAC address filtering, its quite easy to collect one packet sent from the router (to an allowed MAC address) and the attacker can then change their MAC address to clone the observed allowed MAC address. (Yes, two different computers using the same MAC address at the same time would cause problems, but you can wait until they no longer are using it.) Furthermore, MAC address filtering is annoying to manage, because you'll have to go into your router settings every time you add a new device to your network and copy the 12 hexademical digit MAC address (and bother with figuring out how to pull up a MAC address on every random wifi device). People who use MAC address filtering also get suckered into thinking its very secure and then make weak choices for passphrase or think its ok to use WEP or WPS or other vulnerabilities.

Disabling SSID broadcast leads to a loss of features for no concrete gain in security. Your mobile devices will not be able to automatically connect to the wifi network. Your cell phone can't switch from 3G/4G radio to faster less-power hungry wifi when you get home, unless you manually press buttons to switch to the unbroadcast network, or if the device is configured to frequently broadcast I'm looking for SSID 'sdfasdfasdf' that which leaves you vulnerable to attackers with rogue access points that will reply that's me. (Granted with WPA2 they should not be able to complete the 4-way handshake with you; but depending on your device - it may allow a connection to the same SSID that's suddenly not WPA2). Like MAC addresses, you can eavesdrop the SSID from observing other clients connecting to the non-broadcasting network even if WPA2 is enabled.

Make sure WPS (Wifi Protected Setup) is disabled. Many routers come with WPS enabled by default, and this allows an attacker to break into your network in under 11000 guesses. Granted newer routers may have timeouts on consecutive attempts that may make this more difficult; but the standard suggests only a 60s timeout which only delays an attackers attempts to break in by a couple days).

You should not use a "non-dictionary based word" for your AP "password", but instead use a multi-word passphrase. Don't reuse this passphrase for anything else (that you want to keep private) as you will be sharing this password (visiting friend needs to connect their laptop) and your devices will be storing this in a recoverable way. (And some devices will even by default store your wifi passwords in the cloud for you!) I suggest passphrase as it's easier to tell someone "correct horse battery staple" (all lowercase spaces, between words), than "Capital T, lowercase r, zero, lowercase u-b, number four, lowercase d-o-r, ampersand, number three" and the passphrase has higher entropy (also see discussion here). Attacks on observed wifi handshakes can be done offline, so strong passphrases are needed.

MAC address filtering is trivial to bypass and annoying to manage. MAC addresses are used for layer-2 (link level) addressing; so in wifi that's the radio signal between your router and any listening receiver. Even when you have an encrypted connection; the data is being encrypted not the layer-2 packet headers. Hence, if a router is using MAC address filtering, its quite easy to collect one packet sent from the router (to an allowed MAC address) and the attacker can then change their MAC address to clone the observed allowed MAC address. (Yes, two different computers using the same MAC address at the same time would cause problems, but you can wait until they no longer are using it.) Furthermore, MAC address filtering is annoying to manage, because you'll have to go into your router settings every time you add a new device to your network and copy the 12 hexademical digit MAC address (and bother with figuring out how to pull up a MAC address on every random wifi device). People who use MAC address filtering also get suckered into thinking its very secure and then make weak choices for passphrase or think its ok to use WEP or WPS or other vulnerabilities.

Disabling SSID broadcast leads to a loss of features for no concrete gain in security. Your mobile devices will not be able to automatically connect to the wifi network. Your cell phone can't switch from 3G/4G radio to faster less-power hungry wifi when you get home, unless you manually press buttons to switch to the unbroadcast network, or if the device is configured to frequently broadcast I'm looking for SSID 'sdfasdfasdf' that which leaves you vulnerable to attackers with rogue access points that will reply that's me. (Granted with WPA2 they should not be able to complete the 4-way handshake with you; but depending on your device - it may allow a connection to the same SSID that's suddenly not WPA2). Like MAC addresses, you can eavesdrop the SSID from observing other clients connecting to the non-broadcasting network even if WPA2 is enabled.

Make sure WPS (Wifi Protected Setup) is disabled. Many routers come with WPS enabled by default, and this allows an attacker to break into your network in under 11000 guesses. Granted newer routers may have timeouts on consecutive attempts that may make this more difficult; but the standard suggests only a 60s timeout which only delays an attackers attempts to break in by a couple days).

You should not use a "non-dictionary based word" for your AP "password", but instead use a multi-word passphrase. Don't reuse this passphrase for anything else (that you want to keep private) as you will be sharing this password (visiting friend needs to connect their laptop) and your devices will be storing this in a recoverable way. (And some devices will even by default store your wifi passwords in the cloud for you!) I suggest passphrase as it's easier to tell someone "correct horse battery staple" (all lowercase spaces, between words), than "Capital T, lowercase r, zero, lowercase u-b, number four, lowercase d-o-r, ampersand, number three" and the passphrase has higher entropy (also see discussion here). Attacks on observed wifi handshakes can be done offline, so strong passphrases are needed.

MAC address filtering is trivial to bypass and annoying to manage. MAC addresses are used for layer-2 (link level) addressing; so in wifi that's the radio signal between your router and any listening receiver. Even when you have an encrypted connection; the data is being encrypted not the layer-2 packet headers. Hence, if a router is using MAC address filtering, its quite easy to collect one packet sent from the router (to an allowed MAC address) and the attacker can then change their MAC address to clone the observed allowed MAC address. (Yes, two different computers using the same MAC address at the same time would cause problems, but you can wait until they no longer are using it.) Furthermore, MAC address filtering is annoying to manage, because you'll have to go into your router settings every time you add a new device to your network and copy the 12 hexademical digit MAC address (and bother with figuring out how to pull up a MAC address on every random wifi device). People who use MAC address filtering also get suckered into thinking its very secure and then make weak choices for passphrase or think its ok to use WEP or WPS or other vulnerabilities.

Disabling SSID broadcast leads to a loss of features for no concrete gain in security. Your mobile devices will not be able to automatically connect to the wifi network. Your cell phone can't switch from 3G/4G radio to faster less-power hungry wifi when you get home, unless you manually press buttons to switch to the unbroadcast network, or if the device is configured to frequently broadcast I'm looking for SSID 'sdfasdfasdf' that which leaves you vulnerable to attackers with rogue access points that will reply that's me. (Granted with WPA2 they should not be able to complete the 4-way handshake with you; but depending on your device - it may allow a connection to the same SSID that's suddenly not WPA2). Like MAC addresses, you can eavesdrop the SSID from observing other clients connecting to the non-broadcasting network even if WPA2 is enabled.

Make sure WPS (Wifi Protected Setup) is disabled. Many routers come with WPS enabled by default, and this allows an attacker to break into your network in under 11000 guesses. Granted newer routers may have timeouts on consecutive attempts that may make this more difficult; but the standard suggests only a 60s timeout which only delays an attackers attempts to break in by a couple days).

You should not use a "non-dictionary based word" for your AP "password", but instead use a multi-word passphrase. Don't reuse this passphrase for anything else (that you want to keep private) as you will be sharing this password (visiting friend needs to connect their laptop) and your devices will be storing this in a recoverable way. (And some devices will even by default store your wifi passwords in the cloud for you!) I suggest passphrase as it's easier to tell someone "correct horse battery staple" (all lowercase spaces, between words), than "Capital T, lowercase r, zero, lowercase u-b, number four, lowercase d-o-r, ampersand, number three" and the passphrase has higher entropy (also see discussion here). Attacks on observed wifi handshakes can be done offline, so strong passphrases are needed.

MAC address filtering is trivial to bypass and annoying to manage. MAC addresses are used for layer-2 (link level) addressing; so in wifi that's the radio signal between your router and any listening receiver. Even when you have an encrypted connection; the data is being encrypted not the layer-2 packet headers. Hence, if a router is using MAC address filtering, its quite easy to collect one packet sent from the router (to an allowed MAC address) and the attacker can then change their MAC address to clone the observed allowed MAC address. (Yes, two different computers using the same MAC address at the same address at the same time could cause problems, but you can wait until they no longer are using it.) Furthermore, MAC address filtering is annoying to manage, because you'll have to go into your router settings every time you add a new device to your network and copy the 12 hexademical digit MAC address (and bother with figuring out how to pull up a MAC address on every random wifi device). People who use MAC address filtering also get suckered into thinking its very secure and then make weak choices for passphrase or think its ok to use WEP or WPS or other vulnerabilities.

Disabling SSID broadcast leads to a loss of features for no concrete gain in security. Your mobile devices will not be able to automatically connect to the wifi network. Your cell phone can't switch from 3G/4G radio to faster less-power hungry wifi when you get home, unless you manually press buttons to switch to the unbroadcast network, or if the device is configured to frequently broadcast I'm looking for SSID 'sdfasdfasdf' that which leaves you vulnerable to attackers with rogue access points that will reply that's me. (Granted with WPA2 they should not be able to complete the 4-way handshake with you; but depending on your device - it may allow a connection to the same SSID that's suddenly not WPA2). Like MAC addresses, you can eavesdrop the SSID from observing other clients connecting to the non-broadcasting network even if WPA2 is enabled.

Make sure WPS (Wifi Protected Setup) is disabled. Many routers come with WPS enabled by default, and this allows an attacker to break into your network in under 11000 guesses. Granted newer routers may have timeouts on consecutive attempts that may make this more difficult; but the standard suggests only a 60s timeout which only delays an attackers attempts to break in by a couple days).

You should not use a "non-dictionary based word" for your AP "password", but instead use a multi-word passphrase. Don't reuse this passphrase for anything else (that you want to keep private) as you will be sharing this password (visiting friend needs to connect their laptop) and your devices will be storing this in a recoverable way. (And some devices will even by default store your wifi passwords in the cloud for you!) I suggest passphrase as it's easier to tell someone "correct horse battery staple" (all lowercase spaces, between words), than "Capital T, lowercase r, zero, lowercase u-b, number four, lowercase d-o-r, ampersand, number three" and the passphrase has higher entropy (also see discussion here). Attacks on observed wifi handshakes can be done offline, so strong passphrases are needed.

MAC address filtering is trivial to bypass and annoying to manage. MAC addresses are used for layer-2 (link level) addressing; so in wifi that's the radio signal between your router and any listening receiver. Even when you have an encrypted connection; the data is being encrypted not the layer-2 packet headers. Hence, if a router is using MAC address filtering, its quite easy to collect one packet sent from the router (to an allowed MAC address) and the attacker can then change their MAC address to clone the observed allowed MAC address. (Yes, two different computers using the same MAC address at the same time would cause problems, but you can wait until they no longer are using it.) Furthermore, MAC address filtering is annoying to manage, because you'll have to go into your router settings every time you add a new device to your network and copy the 12 hexademical digit MAC address (and bother with figuring out how to pull up a MAC address on every random wifi device). People who use MAC address filtering also get suckered into thinking its very secure and then make weak choices for passphrase or think its ok to use WEP or WPS or other vulnerabilities.

Disabling SSID broadcast leads to a loss of features for no concrete gain in security. Your mobile devices will not be able to automatically connect to the wifi network. Your cell phone can't switch from 3G/4G radio to faster less-power hungry wifi when you get home, unless you manually press buttons to switch to the unbroadcast network, or if the device is configured to frequently broadcast I'm looking for SSID 'sdfasdfasdf' that which leaves you vulnerable to attackers with rogue access points that will reply that's me. (Granted with WPA2 they should not be able to complete the 4-way handshake with you; but depending on your device - it may allow a connection to the same SSID that's suddenly not WPA2). Like MAC addresses, you can eavesdrop the SSID from observing other clients connecting to the non-broadcasting network even if WPA2 is enabled.

Make sure WPS (Wifi Protected Setup) is disabled. Many routers come with WPS enabled by default, and this allows an attacker to break into your network in under 11000 guesses. Granted newer routers may have timeouts on consecutive attempts that may make this more difficult; but the standard suggests only a 60s timeout which only delays an attackers attempts to break in by a couple days).