11

I use an old AirPort Extreme to provide WiFi in my home. It provides a 2.4 and 5.0 GHz network with a good password, only available to me and my wife. It also provides a separate guest network without password. The benefit is that visitors can have WiFi in my home without needing my password so I don’t need to hand my password out.

Question: Does the ability of a stranger to connect to the guest network put my password protected network at risk? Of course they can cause mayhem on the guest network, but would my main network using the same router be in danger, actual or theoretical?

PS. Thanks for all the answers. My plan was to enable friends and family to use Wifi, but not giving them a password which would be dangerous if one of them is a hacker, more dangerous is one of them is careless and gives the password to a real hacker, and inconvenient because changing the password is a pain if a friend becomes an ex-friend.

Apple has a feature where your phone can send the password to another phone if you allow it, so that phone can connect to your network, but the user cannot find out the password. Small improvement.

So the problems are: Anyone near my home can use my WiFi (I've heard a claim that someone in an apartment block could see 37 networks on their Mac!!!, so you could have 37 people able to log in). Not that big a problem because I can throw them out, but still. And the other problem: Someone who has access to an actual network on my router, meaning my router has to process their network traffic, may have more access to vulnerabilities in the router than someone who just parks their car near my network with nothing opened.

5
  • 3
    "[...] not giving them a password which would be dangerous if one of them is a hacker, more dangerous is one of them is careless and gives the password to a real hacker [...]" Who are your friends/family and where do you live that this is a legitimate concern for you? What's your attack surface? What are you trying to protect, exactly?
    – esqew
    Oct 24, 2022 at 19:26
  • 2
    "I've heard a claim that someone in an apartment block could see 37 networks on their Mac!!!" It's really not clear how this is relevant to the question at hand, but I'm not sure why you've chosen verbiage that makes it seem you believe this is far-fetched at all. In my last apartment building in New York, there were 394 units, likely each with their own SSID. I probably had far more than 37 within range at any given time, and that wasn't even close to the largest building on the same block.
    – esqew
    Oct 24, 2022 at 19:29
  • There's another problem: A "hacker" could wreak havoc on your friends/family's devices in the process of wreaking havoc on your open network. If possible, it would be better to have the currently open network protected with a different password. Oct 24, 2022 at 21:11
  • 1
    "Apple has a feature where your phone can send the password to another phone if you allow it, so that phone can connect to your network, but the user cannot find out the password. Small improvement.". I'm pretty sure the receiver of the password can in fact see the password afterwards. You can see the password of any Wifi network that you are connected to
    – Ivo
    Oct 25, 2022 at 6:32
  • There is no way to "share a wifi password" without the other person being able to retrieve it. It fundamentally doesn't work like that.
    – GACy20
    Oct 25, 2022 at 10:41

4 Answers 4

15

There is no inherent unavoidable risk in this approach which would put your private WiFi in danger. But ...

These networks are served by the same router. This means their implementation and configuration are only separated by software. And software can have bugs. For example if the attacker manages to exploit your router from the guest network, then this would likely enable the attacker to hijack your private network too.

Note that this scenario is not be that far fetched, since critical bugs in WiFi drivers, routers etc are not uncommon. The market for routers is usually not driven by best security, but by most features for lowest price.

9
  • At the very least, I suspect someone on Guest Wifi could access the modems' settings and if you kept default username/password, make changes there? Or do "guest profiles" disable the access to the modems settings like that?
    – BruceWayne
    Oct 24, 2022 at 16:14
  • 5
    @BruceWayne: My expectation would be that admin interface is only accessible on the "normal" internal network, i.e. no external access to admin interface and no access from guest network either. Oct 24, 2022 at 16:29
  • For WiFi, aren't all implementations separated just by software? Even if OP had two internet connections with two separate routers/APs, the simple fact of being in the range of one AP put its software stack at risk since you can send it frames over the radio. It seems a moot point to me, considering also that routing is (mostly?) implemented in software but it's widely used to segregate networks. VLAN, too. Oct 24, 2022 at 17:36
  • @BruceWayne. It's interesting. It's an AirPort Extreme, it has no browser access, but an app named "Airport Utility". I switched my iPhone to the guest network, and "Airport Utility" says it cannot detect the base station.
    – gnasher729
    Oct 24, 2022 at 17:44
  • @MargaretBloom I thought about that. My Mac for example displays the names of "foreign" networks so I suppose the router must gather the names, and ignore packets on that that network. So in principle it could be attacked, but the amount of attackable code would be much less.
    – gnasher729
    Oct 24, 2022 at 17:47
8

I think that besides the technical security risk (which probably is not that critical if the system only works for your visitiors and you trust them), the major problem will be that anybody near your home can use that network.

This means, even if your hard- and software don't have any flaws, the next guy from the street could use your WiFi to perform illegal actions for which you will be held responsible.

And there are people that scan for such freely usable networks, probably even sell that information on a black market. With those kind of "users" the technical side also becomes critical again.

So: set a password for your guest network, and create a QR-Code for that. And change the password regularly (maybe every 3 months?). The QR-Code will make it more convenient for your visitors to log in. (You could use an open network with a gateway page to enter the password, like other WiFis in public places use, but I personally find that a bit of a chore both for the maintainer - you - and the user - your visitors. In the end they don't have to accept any written terms or whatsoever.)

2
  • 1
    Good advice. Along with this, disable the guest network when the guests leave.
    – Barmar
    Oct 24, 2022 at 13:51
  • this is a real scenario you have to worry about: criminal activities through your guest access. So the advice of QR Code and rotation of a password for the guest access is the best for mer.
    – robob
    Nov 7, 2022 at 6:10
4

As mentioned in the other answers, all bets are off if your router has a vulnerability which a malicious user is able to exploit.

Notwithstanding, it sounds like what you are looking for is network segmentation, where devices on the guest network cannot see or access devices on the main network, and vice versa. This can be done by creating two separate VLAN's - one for the main network and one for the guest network. Then, it will appear to users on the guest network that they are the only ones on the network, and likewise for users of the main network. Devices on one network will not be visible or accessible to devices on the other network. See https://www.routersecurity.org/vlan.php for a good write-up on this subject.

But, it bears repeating that the above configuration could fail spectacularly if the router has a vulnerability that can be exploited by a user on the guest network.

3
  • As the page you linked to says: "VLANs are only offered in professional grade routers." I don't think it's available on Airport Extreme. The guest network is essentially a single VLAN.
    – Barmar
    Oct 24, 2022 at 13:49
  • 1
    @Barmar "VLANs are only offered in professional grade routers." - That's simply false though; there's definitely consumer-oriented routers that offer VLAN support. Both my switch and my wifi router here at home do (but I selected specifically for that when I bought them).
    – marcelm
    Oct 24, 2022 at 16:39
  • It's not common, though, and I doubt it's in Airport. @marcelm But maybe it's something that can be added to other routers with DD-WRT.
    – Barmar
    Oct 24, 2022 at 16:45
2

You can check if your router has a known vulnerability if you look at the common vulnerabilities and exposures site of the product. The higher the number, the more dangerous. 10 is the maximum.

An attacker could check this and try to use it. A 9-10 is a critical one and easy to use with a high impact.

In your scenario this could be for example access to your router administration interface. If you already opened a network for guests without password the attacker could use this.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .