DEV Community

freerave
freerave

Posted on

title: The Worst Wi-Fi Security Advice I Found on Facebook 🤦‍♂️ (And Why It's Dangerous)

#security #networking #infosec #cybersecurity

I recently stumbled upon a wild discussion on Facebook regarding home router security, and as someone passionate about cybersecurity, I was absolutely mind-blown by the "expert" advice being thrown around.

I wanted to bring this discussion to the Dev community to get your thoughts and maybe share a good laugh (or cry) at the state of general InfoSec awareness.

The Scenario

A user posted a screenshot of their router settings asking which of the following configurations provides the strongest security:

  1. No Security
  2. WPA2-PSK-AES
  3. WPA/WPA2-PSK-TKIP/AES (Mixed Mode)
  4. WPA2-EAP-AES

The "Wild" Advice: MAC Filtering is King? 👑

To my absolute shock, a highly supported opinion in the comments was to completely disable encryption (No Security), hide the SSID, and rely entirely on MAC Filtering.

Yes, you read that right.

Let's break down why this is a terrible idea:

  • Hidden SSIDs are a Myth: Hiding your SSID doesn't make your network invisible. It actually forces your devices to constantly broadcast "Probe Requests" looking for the hidden network. This makes you highly vulnerable to Rogue AP (Access Point) attacks.
  • MAC Addresses are Plain Text: MAC addresses are broadcasted in plain text over the air. Anyone with a $15 Wi-Fi adapter in Monitor Mode can passively sniff the network using basic tools like airodump-ng.
  • Spoofing is Trivial: Once an attacker sees a whitelisted MAC address communicating with the router, they can just use macchanger to spoof their own MAC address, disconnect the legitimate user (Deauth attack), and bypass the "filter" entirely without ever needing a password.

It’s essentially leaving your front door wide open and putting up a "Do Not Enter" sign made of paper.

The Plot Twist: The Mixed Mode Defenders 🛡️

Later in the thread, another group fiercely defended the Mixed Mode (WPA/WPA2-PSK-TKIP/AES) as the "absolute best" choice because it "covers all bases."

Here is where I started questioning everything. Choosing TKIP is fundamentally flawed for modern networks:

  1. Ancient Vulnerabilities: TKIP is based on the deprecated RC4 cipher, which is riddled with known vulnerabilities.
  2. Goodbye Bandwidth: Enabling TKIP typically forces the router to throttle your Wi-Fi speeds down to a maximum of 54 Mbps (802.11g speeds), completely wasting your modern fiber connection.

The only correct answer for a standard home network in that list is, of course, WPA2-PSK-AES (paired with a strong, unpredictable passphrase).

My Question to You 👇

Why do you think some people still believe MAC filtering and Hidden SSIDs are the ultimate security standards in 2026?

And more importantly, how do you usually explain these critical flaws to non-technical friends or clients without sounding like an absolute nerd?

Let me know your thoughts in the comments!

Top comments (0)