How a 2017 experiment challenges the way we think about network boundaries, signal propagation, and defense in depth.
The Invisible Network Beyond Your Walls
A home has walls, doors, and locks. A wireless network does not necessarily stop at any of them. Its edge is set by physics rather than property lines: a 2.4 GHz Wi-Fi signal has a wavelength of roughly 12.5 cm, and how much of it survives a wall depends on the frequency, the material, its thickness, the angle of incidence, and everything else in the room. Drywall and wood let a good deal through. Concrete, brick, and metal take more. The result is a coverage footprint shaped like no floor plan.
That spillover is a fact about propagation, not automatically a vulnerability. A beacon that is detectable on the sidewalk only matters if someone on the sidewalk can do something useful with it. Still, the mismatch between the physical boundary of a home and the radio boundary of its network raises a fair engineering question: if we could shape where the signal goes, would that add a meaningful layer of protection?
The 2017 Experiment Behind the 2026 Headline
A news story circulating in 2026 revived this question, but the research behind it is nine years old. In November 2017, Xi Xiong, Justin Chan, Ethan Yu, Nisha Kumari, Ardalan Amiri Sani, Changxi Zheng, and Xia Zhou presented "Customizing Indoor Wireless Coverage via 3D-Fabricated Reflectors" at ACM BuildSys in Delft. It extended a 2015 workshop paper by Chan, Zheng, and Zhou that introduced the system's name, WiPrint.
The approach is computational, not improvised. The user supplies a coarse 3D model of the space (walls and doors, no furniture), the access point's location and antenna positions, and a set of target areas where signal should be stronger or weaker. A 3D ray tracer, accounting for reflection, transmission, and diffraction, predicts signal strength in each 1 m × 1 m cell. The reflector surface is represented as a smooth parametric NURBS surface, and a simulated-annealing search guided by gradient descent reshapes it until predicted coverage best matches the target. On a 2017 laptop this took about 23 minutes. The shape is then 3D-printed in plastic, roughly 20 × 20 cm for under $35, coated in 0.024 mm household aluminum foil, and mounted around the router's antennas.
The team tested this in two furnished indoor scenes, a 19 × 13 m workspace and a 16 × 12 m home-like layout, with people moving around. The main access point was a Netgear R7000 (802.11ac, three antennas) set to 10 mW and measured on the 2.4 GHz band; two older 2.4 GHz routers were also tested. A programmed drone hovered at each location to log signal strength, and laptops running iperf measured throughput.
The widely repeated numbers check out, with a qualifier: the paper reports that optimized reflectors weakened signals in target areas by up to 10 dB and strengthened them by up to 6 dB. These are best-case figures in specific target regions, not averages across a home. In the single-router test, 83.1% of cells moved in the intended direction; in the two-router test, 91%. Throughput changes ranged from −63.3% to +55.1% across seven of nine sampled locations in the two-router scene. A naive concave reflector, the soda-can approach, simply weakened everything behind it.
Why Aluminum Reflects Wi-Fi Signals
Wi-Fi is electromagnetic radiation. When it meets a good conductor, free electrons in the metal respond to the oscillating field and re-radiate, so most of the incident energy is reflected rather than passed through. At 2.4 GHz, current in aluminum is confined to a skin depth of under two micrometers, which is why even kitchen foil is electrically thick enough to act as a reflector. The researchers found copper and aluminum performed similarly, silver slightly better, and thicker sheets improved blocking only moderately.
Energy striking the reflector is split between reflection, absorption, and some transmission. The authors observed that their reflectors were better at weakening than strengthening, and the reason is instructive: only reflected energy can boost the signal in front of the reflector, while both reflected and absorbed energy reduce it behind. A passive reflector adds no power; it only redirects what the antennas already radiate. Sending more energy toward one area generally leaves less for others, and because the redirected waves also interfere with the room's existing multipath, the reflector can shift signal strength in places it was never aimed at, upward in some spots and downward in others. The paper documents one such side effect: weakening the hallway also slightly weakened part of the lab.
The flashlight-mirror analogy helps up to a point and then fails. A 20 cm reflector is less than two wavelengths across at 2.4 GHz, so waves diffract around its edges instead of being cleanly redirected. Indoors, signals also arrive by many paths at once, bouncing off walls, floors, and furniture. This multipath propagation means the copies combine constructively in some spots and destructively in others, so readings can change by several decibels over a few centimeters. That is why a shape optimized for one floor plan is the wrong shape for another.
What the Experiment Demonstrated—and What It Didn't
What the study supports is specific: under its conditions, an optimized, carefully placed reflector redistributed received signal strength and throughput by moderate amounts in the intended direction across most cells. The effect tolerated about 10° of orientation error and 10 cm of placement error.
What it did not establish matters as much. All signal maps were collected at 2.4 GHz, so nothing in the paper speaks directly to 5 GHz, 6 GHz, Wi-Fi 6, 6E, or 7, wide channels, or modern routers with internal antenna arrays and beamforming. The authors themselves describe the RSS and throughput changes as moderate and attribute the limit to Wi-Fi's wavelength. Nor does the paper show that a hand-shaped sheet of foil behind a router reproduces the result; its own naive reflector did not.
Outcomes will also vary with antenna configuration, room layout, building materials, client placement, moving people, and neighboring networks. And received signal strength is not throughput, reliability, or security. Even the model's predictions carried a mean error of about 3 dBm.
Signal Containment Is Not Encryption
Coverage control answers where a signal can be received. Authentication answers who may join the network. Encryption answers what someone who receives the signal can learn. A reflector addresses only the first.
The paper's security test measured packet loss at locations outside each router's intended region. At some locations that could previously reach the network, packet loss rose to 50–60%, enough that the authors treat the network as inaccessible there. But at several others, including one close to the router, packet loss barely changed, and the authors proposed adding transmit-power control to address it. That is evidence of reduced usability at specific points for ordinary laptops. It is not evidence about an attacker.
A lower received signal level, often reported through RSSI (received signal strength indicator) or a device-specific signal measurement, may make reception more difficult without making it impossible. An adversary can move closer, wait outside a different wall, or use a directional antenna with substantially more gain than a laptop's. The researchers themselves frame physical confinement as complementary to encryption, and that is the defensible framing.
The protections that actually govern access and confidentiality live higher up, and each covers a different stretch of the path:
WPA2/WPA3 authenticate devices joining the network and encrypt traffic over the air between each device and the access point. Their protection ends at the router. WPA3-Personal replaces WPA2's pre-shared key handshake with SAE, which the Wi-Fi Alliance says gives users stronger protection against password-guessing attempts; WPA3 networks also require Protected Management Frames and disallow outdated protocols.
HTTPS/TLS encrypts and authenticates the connection between an application and the specific server it talks to, across every network in between. It protects content whether or not the Wi-Fi is trustworthy, though observers can still see which hosts you contact.
VPNs wrap traffic in an encrypted tunnel from your device to a VPN server, hiding traffic routed through the tunnel from the local network and your ISP. Beyond that server, traffic is only as protected as its own encryption, and you are trusting the VPN operator. A VPN can be useful for accessing corporate networks or adding privacy against local network observers, but it does not replace HTTPS and is not automatically necessary on public or home Wi-Fi.
The NSA's home network guidance translates this into practical steps:
Use WPA3, or WPA2/WPA3 mode only while older devices still need it, and enable Protected Management Frames where available.
Choose a passphrase of at least twenty characters.
Keep router firmware updated, and replace routers that no longer receive support.
Protect the router's admin login with strong authentication, and disable remote administration and UPnP.
Segment primary, guest, and IoT devices onto separate networks.
This is defense in depth: independent layers, each with a clearly stated job, so that one failure does not become total failure. For organizations, NIST SP 800-153 applies the same thinking to WLAN configuration and monitoring.
How Developers Can Investigate Their Own Wireless Coverage
A controlled comparison at home teaches a lot about propagation. It will not validate foil as a security control.
Pick five to ten fixed measurement spots, including a few near exterior walls, and mark them.
Record a baseline: at each spot, take at least ten readings with the same device, held the same way.
Place a reflector behind the router without covering vents or touching power connections.
Repeat the same readings at the same spots.
Compare medians and spread, not single readings.
Keep the router, client device, band, channel, and orientation constant. On Linux, iw dev link reports signal in dBm; Windows' netsh wlan show interfaces reports a percentage, which is not directly comparable. RSSI scales are vendor-defined and uncalibrated, so trust differences on one device more than absolute numbers across devices.
A decibel describes a ratio: ΔP(dB) = 10 · log₁₀(P₂ / P₁). dBm is an absolute level referenced to one milliwatt, so −60 dBm is one nanowatt. Subtracting two dBm readings gives a difference in dB. A 10 dB drop means one-tenth the received power, not one-tenth the range: in free space, where power falls with the square of distance, it corresponds to roughly a 3.2× change in distance, and indoors the relationship depends on the environment. It says nothing direct about throughput or attack probability.
This script compares the median reading at each spot before and after, and reports the spread of each set. The sample data is hypothetical, ten readings per spot to match the procedure above, and two spots stand in for your full list.
python
import statistics as st
import matplotlib.pyplot as plt
HYPOTHETICAL readings in dBm — replace with your own measurements
baseline = {
"desk": [-48, -50, -49, -47, -51, -49, -48, -50, -52, -49],
"porch": [-71, -74, -72, -73, -70, -72, -75, -71, -73, -72],
}
modified = {
"desk": [-45, -46, -44, -47, -45, -46, -44, -45, -47, -46],
"porch": [-78, -80, -77, -79, -81, -78, -80, -79, -77, -82],
}
locations = list(baseline)
deltas = [st.median(modified[k]) - st.median(baseline[k]) for k in locations]
for k, d in zip(locations, deltas):
before = max(baseline[k]) - min(baseline[k])
after = max(modified[k]) - min(modified[k])
print(f"{k:>6}: median change {d:+.1f} dB (power ×{10 ** (d / 10):.2f}), "
f"spread {before} dB before, {after} dB after")
plt.bar(locations, deltas, color=["tab:green" if d > 0 else "tab:red" for d in deltas])
plt.axhline(0, color="black", linewidth=0.8)
plt.ylabel("Median change (dB)")
plt.title("Change in median RSSI per spot (hypothetical data)")
plt.show()
The bar chart shows the change in median RSSI at each named spot. It is not a coverage heatmap; for that, you would plot the same deltas at each spot's position on a floor plan.
Test only networks you own or are authorized to measure, never block router ventilation, and keep foil away from power supplies and outlets.
The Bigger Engineering Lesson
Software engineers work mostly above the physical layer, for good reason. But coverage is a design parameter, shaped by geometry and materials as much as by configuration files, and WiPrint makes that unusually visible.
The lesson is not that foil secures Wi-Fi. It is that every security control should come with an honest statement of what it protects against and what evidence supports it. Signal shaping can modestly reduce where a network is usable, under measured conditions, at 2.4 GHz. Encryption, authentication, and secure configuration protect what the network carries and who may join. The two belong in the same threat model, at different layers, and neither substitutes for the other.
We put enormous effort into protecting the information that travels through our networks. Knowing where the network itself physically travels belongs in that same engineering conversation.
References and Further Reading
Xiong, X., Chan, J., Yu, E., Kumari, N., Amiri Sani, A., Zheng, C., & Zhou, X. (2017). Customizing Indoor Wireless Coverage via 3D-Fabricated Reflectors. Proceedings of the 4th ACM International Conference on Systems for Energy-Efficient Built Environments (BuildSys '17). https://doi.org/10.1145/3137133.3137148 · PDF
Chan, J., Zheng, C., & Zhou, X. (2015). 3D Printing Your Wireless Coverage. ACM Workshop on Hot Topics in Wireless (HotWireless). https://cs.dartmouth.edu/~xia/papers/hotw15-wiprint.pdf
DartNets Lab, Dartmouth College. WiPrint project page. https://dartnets.cs.dartmouth.edu/wiprint
Sheth, A., Seshan, S., & Wetherall, D. (2009). Geo-fencing: Confining Wi-Fi Coverage to Physical Boundaries. Pervasive Computing (Pervasive 2009), 274–290. Springer. https://doi.org/10.1007/978-3-642-01516-8_19
Souppaya, M., & Scarfone, K. (2012). Guidelines for Securing Wireless Local Area Networks (WLANs), NIST SP 800-153. National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-153
Wi-Fi Alliance. Security: WPA3, Wi-Fi Enhanced Open, and Protected Management Frames. https://www.wi-fi.org/security
National Security Agency (2023). Best Practices for Securing Your Home Network, Cybersecurity Information Sheet. https://media.defense.gov/2023/Feb/22/2003165170/-1/-1/0/CSI_BEST_PRACTICS_FOR_SECURING_YOUR_HOME_NETWORK.PDF
Top comments (14)
This is fantastic! The framing that "signal containment is not encryption" is such a clear way to put it, and the point that a 10 dB drop means one-tenth the power, not one-tenth the range, is something I wish more people understood. I loved how you traced the headline back to the 2017 WiPrint paper and were so precise about what it did and didn't show, from the 2.4 GHz limits to the best-case figures. The home measurement exercise was a great touch, and the closing idea that every security control should state what it protects against is one I'll be borrowing. Rigorous, practical, and wonderfully clear!
Holy crap, Khali Sollis just dropped absolute fire.
This piece is pure engineering poetry. You took a nine-year-old research paper that most people would skim and turn into a clickbait “foil your Wi-Fi” meme, and instead turned it into one of the cleanest, most intellectually honest explainers I’ve read on physical-layer security in ages. The way you walk from ray-tracing + NURBS + simulated annealing all the way to “signal containment is not encryption” without ever overselling the foil is chef’s-kiss perfect. You killed the hype, kept the wonder, and still made me want to go measure my own house with a drone and a roll of Reynolds Wrap.
That section on skin depth, multipath, and why a 20 cm reflector is still only a couple of wavelengths across? Delicious. The defense-in-depth breakdown (WPA3, TLS, VPN, segmentation) is the exact tone the internet needs more of. And the little Python snippet at the end? Instantly practical. No fluff, no fear-mongering, just rigorous, curious, beautifully written technical writing.
Khali, you absolute legend. This is the kind of post that makes people smarter and more careful at the same time. Keep cooking. The rest of us are just trying to keep up.
A fascinating look at how physics and cybersecurity intersect in ways we often overlook. The key takeaway is that controlling signal coverage can add a layer of defense, but it can never replace strong encryption and proper network security. Great reminder that effective security comes from understanding the limits of each layer and combining them wisely.
Really solid deep dive—appreciate how clearly it separates signal shaping from actual security.
The WiPrint work is clever engineering, but the article nails the right takeaway: foil (or any passive reflector) can nudge coverage a bit, yet it never replaces WPA3, strong passphrases, firmware updates, or proper network segmentation. Physics sets the footprint; cryptography and configuration protect what travels through it.
Love the honest framing that moderate RSSI/throughput shifts ≠ meaningful defense against a determined attacker with a better antenna. Defense in depth still wins.
This hits on something important that often gets lost in these discussions.
The seductive vs. deceptive distinction is useful precisely because it moves the conversation away from moralizing (“evil designers”) and toward engineering trade-offs. Once you frame infinite scroll as the removal of a decision point rather than a trick, the design question becomes clearer: which moments of friction are actually protective of user intent, and which are just annoyance?
I’ve been thinking about the Version A / Version B comparison a lot. What’s interesting is that Version B doesn’t reduce access — it only changes the cost structure of continuing. In practice, that small shift can surface latent preferences that continuous feeds keep buried. People who genuinely want more content still get it with one tap; people who were mostly coasting get a natural off-ramp. The fact that so few products even run that experiment (and report the fuller set of metrics) feels like a missed opportunity.
On the metrics point: the reluctance to measure perceived control or post-session regret is understandable — those signals are messier and slower than session length. But if the only thing we reliably optimize is time-on-site, we shouldn’t be surprised when the product becomes better at holding attention than at serving the reasons people opened it in the first place.
Curious whether anyone has data (even internal or informal) on what happens when you introduce deliberate stopping points or batch loading. Does session length drop in a way that correlates with higher task completion or lower regret, or does it mostly just reduce engagement without clear upside?
This is the rare security piece that debunks a viral headline without dismissing the research behind it. Tracing the story back to the 2017 WiPrint paper, and noting the best-case 10 dB and 6 dB figures are target-region results rather than averages, is exactly the rigor this topic needs. The explanation of why the soda-can reflector fails (a 20 cm surface is under two wavelengths across, so waves diffract around it and multipath scrambles the rest) was the clearest physical intuition I’ve read on this. I also loved the framing that signal containment answers where a signal can be received, while authentication and encryption answer who joins and what they learn, so foil belongs in the threat model at a different layer, not as a substitute. The home measurement procedure, with medians and spread rather than single readings, is a great reminder that honest evidence starts with controlling variables. And the closing principle, that every control should state what it protects against and what evidence supports it, is one I’ll be borrowing for design reviews.
The framing that coverage control, authentication, and encryption answer three different questions is the clearest takeaway here. Signal containment tells you where a network can be received, but it says nothing about who can join or what they can learn, and that's why the foil-as-security idea falls apart as a threat model. I also appreciated how carefully you scoped the WiPrint results: best-case figures in target regions, 2.4 GHz only, and a naive reflector that actually made things worse. The point that an adversary can simply move closer or use a directional antenna is a good reminder that a weaker signal isn't the same as an inaccessible one. The home measurement procedure, using medians and spread instead of single readings, is a nice touch for anyone who wants to test propagation without overclaiming. Thanks for a piece that treats security controls with the honesty they deserve.
This is an outstanding example of how rigorous engineering research can transform an everyday curiosity into a genuinely valuable lesson about cybersecurity. What I love most is the distinction between controlling where a signal travels and actually securing the information it carries. The WiPrint experiment is fascinating, but your explanation of its limitations is what truly elevates this piece—you resist the temptation to turn an intriguing demonstration into an exaggerated security claim. The combination of physics, practical testing, reproducible code, and defense-in-depth principles makes this both intellectually engaging and immediately useful. Brilliantly researched, exceptionally clear, and a powerful reminder that good security engineering begins with understanding exactly what a control can—and cannot—protect.
Thanks for this, Khali. The line that coverage control, authentication, and encryption each answer a different question was the clearest way I've seen to explain why a reflector can't stand in for real security. Framing signal shaping as complementary to the layers above it, rather than a substitute, is the right call.
I also appreciated how careful you were with the original research. Noting that the 10 dB and 6 dB figures are best-case results in specific target regions, that everything was measured at 2.4 GHz, and that the team's own naive reflector didn't reproduce the effect keeps the headline from getting more credit than the study earned. The point that packet loss barely changed at some spots, including one near the router, is a detail most summaries would skip.
The home measurement procedure was a nice practical touch too. Comparing medians and spread instead of single readings, and explaining that a 10 dB drop means a tenth of the power rather than a tenth of the range, will save people from some common misreadings. Great piece.
This is an outstanding piece of technical writing. It takes a flashy 2026 headline about aluminum foil and calmly walks the reader through the actual 2017 research, the physics, the real limits of signal shaping, and why encryption still does the heavy lifting. Clear, rigorous, and genuinely useful—exactly how security topics should be explained.