One of the biggest potential security vulnerabilities -- public Wi-Fi -- may soon get its fix.
The Wi-Fi Alliance, the organization that sets standards for Wi-Fi safety and is made up of members such as Apple, Samsung and Intel, on Monday at CES unveiled a new security protocol called WPA3. It's the successor to the WPA2 technology that you often see when signing on to a new Wi-Fi network, and protects nearly every modern phone, computer and router on a network.
The improvements blocks people from guessing your passwords, as well as secure both your traffic and connected gadgets, a trend known as the Internet of Things. You can expect to see WPA3 arrive in early 2018, said Kevin Robinson, the Wi-Fi Alliance's vice president of marketing.
Further protecting an insecure Wi-Fi network potentially takes away one of the easiest ways for hackers to get access to private information like what websites you visit and what passwords you type into your browser. It's why hackers like to target hotels and tourist hot spots with public Wi-Fi available. With WPA3, the Wi-Fi Alliance hopes to create a much more secure connection without the complications that come with locking down your network.
"It's really a lot about simplification and the user not needing to think about security under the hood," Robinson said.
The security improvements should arrive alongside other Wi-Fi changes designed to make wireless networking more reliable in modern homes burdened with more and more digital devices.
One of the WPA3 upgrades will encrypt all data on public Wi-Fi networks. When you use a public network, for example in a coffee shop, hotel or bus, you can expose yourself to snoops spying on your traffic.
That's because the data traveling through the public network is open, meaning that anyone listening with a tool like Wireshark can know what websites you're visiting while sipping on a latte, and depending on the page you visit, the passwords you type in.
With WPA3, Robinson said, the encryption would be built in the open network, providing every person who uses it a secure and private channel that other people can't spy on. The change could provide you nearly as much privacy as your home network.
"All of that data going across would be encrypted. A hacker wouldn't see it," he said. Still, it isn't bulletproof -- the added protection prevents mass surveillance, but a hacker could still steal data through a dedicated and active attack, he said.
But he added WPA3 will at least be able to block brute-force attacks, which are when a computer (or a very dedicated person) gets access by guessing every possible combination until it gets the password. Thwarting attacks like these is why your phone locks up after too many incorrect password guesses.
WPA3 takes a page out of that playbook, blocking users after too many guesses.
The third major change coming with WPA3 is better security for IoT devices with no displays, like smart lightbulbs or doorbells. IoT devices are notorious for their lack of security, often because owners don't have many options to adjust settings.
The new security standards won't arrive overnight, Robinson said. The Wi-Fi Alliance only sets the standards, and it can take months or years for router manufacturers to support them and for us to buy the new network gear.
But although the shift from WPA2 to WPA3 will be slow, it should improve security without too much of a technical headache.