Most people just put a WPA2 password on their Wi-Fi networks and move on. At my school, many people have managed to crack this system over and over again, to the point that they dropped that system and implemented a voucher system, in which users must input two five-digit passwords (characters 0-9 only), and this code expires after a preset length of time. Thus, there are, in theory, 10^10 possible combinations.

This is the sole security measure on the system; there is no physical key required, nor is there a WPA encryption on top of the voucher system.

For all intents and purposes for the sake of this question, assume I don't have physical access to the modem.

It seems that there are certain passkeys that work as dailies, certain passkeys that work as weeklies, etc., that are all pre-generated. I am unaware of the details behind how the vouchers are generated, but they seem to be pre-generated on a specific system and cannot just be generated when someone needs one. In all cases, the key can only be used once; for instance, if I have a passkey and type it in on my computer, it somehow will continue recognizing my computer until the key expires, but I will be unable to use that same key on my smartphone.

Do note that, taking all of this together, the following facts are true:

  1. Not all of the keys are active at once, so although one can randomly select keys and hope he gets one, he has far fewer than 10^10 possible combinations that actually work;
  2. Of the ones that are active, most of them are already being used and therefore cannot be re-used.
  3. One would need access to the server to generate a new passkey just for them, and, as noted above, that's not included in the scope of this question.

There does not appear to be anything preventing someone from just working through all 10,000,000,000 possible combinations until he gets lucky and finds one that works, but I'm hoping for an answer that does not involve brute-force.

Is this actually that much more secure than a system in which the user doesn't know how many characters there are, and which each have much more than just 10 options for each character? How much would it take to hack such a system, to be able to use it without authorization? (I've purposely phrased the question so that ways to get in without a passkey are allowed for the sake of this question.)

  • Where do you input the voucher? Into a captive portal? As a wifi passphrase? – David Aug 28 '17 at 3:45
  • 1
    Also, secure against what? Sniffing traffic of others, using network without authorization ... ? And, is this voucher on top of WPA, how long is the voucher, is there rate limiting employed to stop brute forcing, how easy is the voucher to guess, how easy is it to trick the system to get a new voucher ... ? In short: your question has too few details which makes it too broad to answer. – Steffen Ullrich Aug 28 '17 at 4:38
  • 1
    Or in other words: it is possible to implement a system based on vouchers which adds security compared to a network with only WPA and shared passphrase. But it is also possible to implement a system based on vouchers which provides even less security. – Steffen Ullrich Aug 28 '17 at 4:46
  • @SteffenUllrich I don’t know the answers to all of those questions, but I’ve edited to address the ones I do know. – DonielF Aug 28 '17 at 13:12
  • @SteffenUllrich Is this better, or do you have any other concerns? – DonielF Sep 1 '17 at 18:39

There is an inherent difference between WPA2 which should authorize and encrypt, and a captive portal with some key, which can only authorize. If you switch off WPA2 you loose encryption over the air, which is a bad thing, since now people can spy on your transmissions.

So its like on Airport WiFi´s and other public places, do not use any communication which is not encrypted. Already before, of course, all people joining the WiFi with the WPA2 could do that.

On the other hand, was the other answer tells, the portal can help avoiding people joining over and over again with the same key, when they shouldn´t. In the end the best solution would be to have username and password login with a Radius server behind, to establish enterprise-grade user authentication and key exchange.


In my opinion is as secure as long is the passkey. The main advantage is when someone crack the system (the passkey) he can take advantage of this just a few period of time (as long as the passkey is up to date).

  • Why is this not the same as using a normal WPA2 encryption with a reaaally long password? – DonielF Aug 28 '17 at 13:10
  • Because you use the key only to get access to the internet probably, while the normal traffic stays unencrypted. Or maybe I understood it wrong ;) – flohack Aug 28 '17 at 13:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.