Editing IEEE 802.11 (section)

==Security==
{{Update section|date=February 2024|reason=WPA2 is no longer the latest version of WPA}}
In 2001, a group from the [[University of California, Berkeley]] presented a paper describing weaknesses in the [[802.11]] Wired Equivalent Privacy (WEP) security mechanism defined in the original standard; they were followed by [[Fluhrer, Mantin and Shamir attack|Fluhrer, Mantin, and Shamir]]'s paper titled "Weaknesses in the Key Scheduling Algorithm of [[RC4]]". Not long after, Adam Stubblefield and [[AT&T Corporation|AT&T]] publicly announced the first verification of the attack. In the attack, they were able to intercept transmissions and gain unauthorized access to wireless networks.<ref>{{Cite web |title=Security Flaws in 802.11 Data Link Protocols |url=https://people.eecs.berkeley.edu/~daw/papers/wireless-cacm.pdf}}</ref>

The IEEE set up a dedicated task group to create a replacement security solution, 802.11i (previously, this work was handled as part of a broader 802.11e effort to enhance the [[MAC layer]]). The Wi-Fi Alliance announced an interim specification called [[Wi-Fi Protected Access]] (WPA) based on a subset of the then-current IEEE 802.11i draft. These started to appear in products in mid-2003. [[IEEE 802.11i]] (also known as WPA2) itself was ratified in June 2004, and uses the [[Advanced Encryption Standard]] (AES), instead of [[RC4]], which was used in WEP. The modern recommended encryption for the home/consumer space is WPA2 (AES Pre-Shared Key), and for the enterprise space is WPA2 along with a [[RADIUS]] authentication server (or another type of authentication server) and a strong authentication method such as [[EAP-TLS]].{{citation needed|date=May 2020}}

In January 2005, the IEEE set up yet another [[IEEE 802.11w-2009|task group "w"]] to protect management and broadcast frames, which previously were sent unsecured. Its standard was published in 2009.<ref>{{cite web |title= Status of Project IEEE 802.11 Task Group w: Protected Management Frames |author= Jesse Walker, Chair |date= May 2009 |url= https://grouper.ieee.org/groups/802/11/Reports/tgw_update.htm |access-date= 24 August 2020}}</ref>

In December 2011, a security flaw was revealed that affects some wireless routers with a specific implementation of the optional [[Wi-Fi Protected Setup]] (WPS) feature. While WPS is not a part of 802.11, the flaw allows an attacker within the range of the wireless router to recover the WPS PIN and, with it, the router's 802.11i password in a few hours.<ref>{{cite web |url=http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf |website=.braindump – RE and stuff |title=Brute forcing Wi-Fi Protected Setup |date=2011-12-26 |url-status=live |archive-url=https://web.archive.org/web/20120118105726/http://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf |archive-date=2012-01-18 }}</ref><ref>[[US CERT]] [http://www.kb.cert.org/vuls/id/723755 Vulnerability Note VU#723755] {{webarchive|url=https://web.archive.org/web/20120103152902/http://www.kb.cert.org/vuls/id/723755 |date=2012-01-03 }}</ref>

In late 2014, [[Apple Inc.|Apple]] announced that its [[iOS]]&nbsp;8 mobile operating system would scramble MAC addresses during the pre-association stage to thwart [[People counter|retail footfall tracking]] made possible by the regular transmission of uniquely identifiable probe requests.<ref>{{cite web |date=9 June 2014 |title=iOS 8 strikes an unexpected blow against location tracking |url=https://www.theverge.com/2014/6/9/5792970/ios-8-strikes-an-unexpected-blow-against-location-tracking |url-status=live |archive-url=https://web.archive.org/web/20150402001224/http://www.theverge.com/2014/6/9/5792970/ios-8-strikes-an-unexpected-blow-against-location-tracking |archive-date=2015-04-02}}</ref> Android 8.0 "Oreo" introduced a similar feature, named "MAC randomization".<ref>{{cite web |title=Implementing MAC Randomization |url=https://source.android.com/docs/core/connect/wifi-mac-randomization}}</ref>

Wi-Fi users may be subjected to a [[Wi-Fi deauthentication attack]] to eavesdrop, attack passwords, or force the use of another, usually more expensive access point.{{cn|date=October 2024}}