Most people just put a WPA2 password on their Wi-Fi networks and move on. At my school, many people have managed to crack this system over and over again, to the point that they dropped that system and implemented a voucher system, in which users must input two five-digit passwords (characters 0-9 only), and this code expires after a preset length of time. Thus, there are, in theory, 10^10 possible combinations.
This is the sole security measure on the system; there is no physical key required, nor is there a WPA encryption on top of the voucher system.
For all intents and purposes for the sake of this question, assume I don't have physical access to the modem.
It seems that there are certain passkeys that work as dailies, certain passkeys that work as weeklies, etc., that are all pre-generated. I am unaware of the details behind how the vouchers are generated, but they seem to be pre-generated on a specific system and cannot just be generated when someone needs one. In all cases, the key can only be used once; for instance, if I have a passkey and type it in on my computer, it somehow will continue recognizing my computer until the key expires, but I will be unable to use that same key on my smartphone.
Do note that, taking all of this together, the following facts are true:
- Not all of the keys are active at once, so although one can randomly select keys and hope he gets one, he has far fewer than 10^10 possible combinations that actually work;
- Of the ones that are active, most of them are already being used and therefore cannot be re-used.
- One would need access to the server to generate a new passkey just for them, and, as noted above, that's not included in the scope of this question.
There does not appear to be anything preventing someone from just working through all 10,000,000,000 possible combinations until he gets lucky and finds one that works, but I'm hoping for an answer that does not involve brute-force.
Is this actually that much more secure than a system in which the user doesn't know how many characters there are, and which each have much more than just 10 options for each character? How much would it take to hack such a system, to be able to use it without authorization? (I've purposely phrased the question so that ways to get in without a passkey are allowed for the sake of this question.)