I thought WiFi was somewhat secure from other clients, even if your connection is unsecured at the TCP layer, so long as they're not impersonating the hotspot. You're certainly not secure from the hotspot itself, of course.
Only if the WiFi network is password-protected, which causes connections to be encrypted. Pretty much all WiFi is password-protected nowadays -- if a cafe wants to enable public access to their WiFi, they'll write the password on the wall -- but that only became the case after Firesheep and other sniffing tools drew attention to this issue around 2010. In the old days, there were plenty of networks with no password (and hence, no encryption) at all.
The GP specified "without cryptography", in reference to a counterfactual world where we weren't allowed to encrypt things.
> Pretty much all WiFi is password-protected nowadays
I was at Disneyland last week and stayed at one of their hotels - and all the guest Wi-Fi networks were passwordless and therefore insecure. Ditto the free WiFi at the airports at both ends; oh, and the in-flight Wi-Fi too. While walking around the park my iPhone listed a bunch of passwordless mobile hotspots too.
Are you thinking of captive-portals with logins/passwords? (E.g. Mariott/Hilton “Enter your room-number and last-name” portals) - I assume you’re aware that’s only used to authenticate after the WiFi connection is already established?
———
(I really hope that I’m wrong on this; but I’m not aware of any modern wifi standards that address this…. Of course, corp/edu networks can just use RADIUS or a client-certificate (which works on wired networks too).
Also, it’s surprising we still haven’t figured out getting TLS to work with home-user-grade routers’ control-panels…
> Pretty much all WiFi is password-protected nowadays
This is absolutely not true in the US. All major hotel chains have no encryption, airports do not, Starbucks doesn’t, etc.
It’s usually small businesses that opt for a WPA pass phrase because that’s easier to setup than the captive portal nonsense that all of the big companies use.
Aren’t they still just encrypted against the password itself? So if it is a public place like a coffee shop with a known password, anyone can decrypt the data?
Ah ok. I thought they were referring back to SSL in their first paragraph. Interesting, I had forgotten that WiFi networks once didn't all have passwords.
