This article is written purely to build security awareness and provide historical context on well-known, publicly disclosed Wi-Fi vulnerabilities — it is a conceptual and historical overview, not an operational how-to guide. It contains no executable attack commands, no method for bypassing a password, and no guide for building a fake network. Testing any network's security, even with fully legal tools, should only be done on your own equipment or in an authorized lab/training environment; accessing someone else's network without their written permission is a crime, regardless of the tool or method used. This article carries no responsibility for any misuse of the general, publicly available information it reviews.
Why does this history matter?
WPA2 was the Wi-Fi industry's "secure standard" for years. But two separate security discoveries — one in 2017 and another in 2018 — showed that even a globally accepted, encrypted standard can have weaknesses; not because of a user's weak password, but sometimes in the protocol's design itself. Understanding this history is exactly what helps a network engineer or security professional make better decisions about Wi-Fi infrastructure.
What exactly does the WPA2 4-way handshake do?
Every time a device connects to a WPA/WPA2 network, an encrypted exchange called the 4-way handshake takes place between that device and the access point. The purpose of this exchange is for both sides to prove they know the correct password (PSK), without the password itself ever being transmitted over the air — exactly the fundamental cryptographic principle of "never transmit the raw secret, only proof that you know it."
Across these four messages, a session key called the PTK is derived from a combination of the network's passphrase, two random values (nonces) generated by each side, and both devices' MAC addresses. This design is theoretically strong — the issue starts from the fact that this exchange, while encrypted, isn't entirely hidden from an outside observer either; someone listening over the air can see and save this exchange, even without directly understanding its meaning.
The PMKID vulnerability (2018): when the router itself gives away extra information
In early 2018, Jens Steube (one of the creators of the well-known hashcat tool) was researching the next generation of Wi-Fi (WPA3) when he stumbled onto something entirely by accident: many access points include a value called the PMKID inside one of the fields of the very first message of the authentication process — even when no client is in the process of connecting. This meant this value no longer depended on a real user connecting at that exact moment.
The significance of this discovery is exactly here: previously, an attacker had to wait for a real device to connect to the network to see the handshake. The PMKID discovery showed that on much equipment, this waiting was no longer necessary — because the access point itself made this information available. This made the security industry realize that a vulnerability isn't always about user behavior; sometimes it's in the manufacturer's own implementation. The most important practical outcome of this discovery for the industry was increased pressure for longer, more random passphrases, and an accelerated push toward WPA3.
The KRACK attack (2017): when the protocol itself, not the password, is the target
A few months before the PMKID discovery, in October 2017, Mathy Vanhoef of KU Leuven University in Belgium published a vulnerability that shook the entire networking industry: KRACK, short for Key Reinstallation Attack. Unlike classic attacks that focus on guessing a password, KRACK had nothing to do with the password at all — this vulnerability existed in how that same 4-way handshake was handled, within the official WPA2 standard itself.
The key detail that made this discovery so serious: because the flaw was in the standard itself, not in one weak implementation, nearly every device supporting WPA2 — even ones that had implemented the encryption perfectly correctly — was potentially affected. The only real fix was a software patch from device and OS manufacturers, not a user changing their password — because the issue had nothing to do with the password in the first place.
This discovery was formally documented under several CVE identifiers (like CVE-2017-13077 through CVE-2017-13088), each related to a different part of the handshake process or its related variants (like Fast BSS Transition or TDLS). The industry's response to this discovery was one of the largest simultaneous waves of security patching in Wi-Fi history — from desktop operating systems to home router firmware.
Why did these two discoveries together push the industry toward WPA3?
PMKID showed that even without any user error, enough information for an offline password-guessing attempt could easily become available. KRACK showed that the problem could go even deeper than the password, into the standard protocol itself. These two discoveries, combined with years of industry experience with WPA2's limitations, were the main reason the Wi-Fi Alliance formally introduced WPA3 in 2018.
What exactly did WPA3 change?
WPA3's most fundamental change was fully replacing the passphrase (PSK) authentication mechanism with a protocol called SAE (Simultaneous Authentication of Equals, sometimes also called the Dragonfly Handshake). Unlike WPA2's old handshake, which produced a capturable "encrypted fingerprint," SAE is designed so that even if the entire exchange is intercepted, it doesn't give an attacker enough information to attempt an offline password guess — every guessing attempt must happen directly and online against the access point itself, which is both far slower and detectable and blockable.
On top of this, WPA3 also added a feature called forward secrecy — meaning even if the network's password is leaked in the future, previously captured traffic still can't be decrypted (unlike WPA2, where knowing the password meant all previously captured traffic could be read too).
Does this mean a strong password no longer matters?
No — this is a common misconception. WPA3 makes offline password-guessing attacks practically impossible, but a very weak, guessable password (like "12345678") can still be compromised in a slow but targeted online attack. A strong, long password, combined with WPA3, remains the best defensive combination — exactly the principle emphasized in my home Wi-Fi security tutorial.
Conclusion: why network engineers should know this history
Understanding where a vulnerability actually comes from — user behavior, a manufacturer's implementation, or the standard itself — is exactly the perspective that separates a real network engineer or security professional from an average user. Why WPA3 is designed the way it is only really makes sense once you understand exactly where WPA2 fell short — and that's exactly the depth of understanding my network and Wi-Fi security courses focus on, always within a fully legal and ethical framework.
Blog