WiFi password: What is the exposure? Is it only local or can WiFi password be used remotely somehow?

Question

(As everyone does) I have a local WiFi password that is used for signing in and using the WiFi for local users.

I have a separate & far stronger (64 char) admin password to gain access to my WiFi router (settings, etc).

My question is:

If the WiFi password is guessed is there anything that a remote user is able to do? I'm guessing that there is not, but I have not seen this explicitly covered anywhere and I want to make sure.

Restating For Clarity

Definitions (added for clarity)

• Local Attacker = within WiFi range
• Remote Attacker = not within WiFi range, but an attacker from across the Internet who has discovered my router's IP Address.

Again, I'm guessing that only a local attacker would be able to use the WiFi password in order to get onto my WiFi network. I'm also guessing that the remote attacker cannot use the WiFi password in any way to gain access to the router or network. Is that true?

Answer 1

Unless you've managed to configure the same password in both places, the attacker can't gain access.

BUT, you've given the attacker access to your network (discreetly), from which they can try all sorts of other attacks -- against things far more valuable than your admin password.

I will also add that WPA2-Enterprise is the best way to control access for users. That requires a Radius server, maybe an Active Directory server, and quite a bit of configuring. For a small company with a handful of users, it's probably not worth the effort -- unless you have high-value assets to protect.

Answer 2

If the WiFi password is guessed

If the pre-shared key (PSK) is disclosed or guessed, then anyone with that knowledge can connect to your network. That is equivalent to entering your premises and plugging a laptop into your switch.

What exactly they can do from there depends on the additional layers of security that your network uses.

I'm also guessing that the remote attacker cannot use the WiFi password in any way to gain access to the router or network.

Then you're guessing wrong. The PSK is the only thing that is required to gain access to your network. (With 'remote' meaning as far as the radio waves carry - connecting across the Internet isn't possible, of course. Radio waves can carry surprising distances if the attacker uses a directional antenna.)

Businesses should always use WPA2 Enterprise with user-specific logins (usually backed by RADIUS and/or X.509 certificates). That way, the admin can change user passwords that have been disclosed or specifically lock out compromised users. A pre-shared key requires you to interrupt service and notify all users to reconnect.