Month 4: Wi-Fi at the shops

Open, secured and captive

Public or open networks need no password, so anyone nearby can join, and traffic over the air isn't encrypted by the Wi-Fi itself. Private or secured networks need a password (Personal) or a username or certificate (Enterprise), and encrypt traffic. Captive or subscription networks (hotels, airports, Kibble's guest Wi-Fi) let you join, then send you to a web captive portal to sign in, accept terms or pay before the internet works.

Rosa: That's why the hotel Wi-Fi made me accept terms on my last trip!

Exam tip Apple devices show a lock for secured networks and a Privacy or Weak Security warning for networks that are open or use old security.

Living with captive portals

After joining, iPhone, iPad and Mac usually open the sign-in page by themselves. If it doesn't appear, open Safari and visit any plain http page such as captive.apple.com to trigger it. Until the user signs in, the network shows as connected but with no internet. Some subscription networks (such as Passpoint carrier hotspots) sign in automatically with a profile or account.

• Open network: prefer apps using HTTPS, or a VPN
• Captive network: sign in, then the internet works
• Secured network: password or credentials before joining

Dev: Most "guest Wi-Fi is broken" tickets are a captive portal nobody opened.

Personal: one shared password

WPA3 Personal (using SAE) is the strongest home and small-office option and resists password-guessing. WPA2 Personal with AES is still common and supported everywhere. WPA2/WPA3 Transitional mode lets older devices use WPA2 while newer ones use WPA3. WEP and WPA/TKIP are obsolete; Apple devices flag them with a Weak Security warning.

Exam tip Exam pick: the most secure option a modern Apple device supports for a password network is WPA3 Personal.

Enterprise: each user signs in

WPA2 Enterprise and WPA3 Enterprise (including a 192-bit mode) use 802.1X with a RADIUS server, so every user or device has its own credentials. Apple devices support EAP types such as EAP-TLS (certificates on both sides), PEAP and EAP-TTLS (username and password inside a TLS tunnel) and EAP-FAST. Companies push these settings and certificates in an MDM Wi-Fi payload.

Exam tip Certificate-based EAP-TLS is why an unenrolled device can't join staff Wi-Fi: its certificate came from MDM.

A private address for each network

Every Wi-Fi chip has a hardware MAC address. If a device used it everywhere, every network it joined could recognize it, and observers could track the device from the coffee shop to the airport. So iPhone, iPad, Apple Watch, Vision Pro and Mac (macOS 15 and later) join each network with a private Wi-Fi address: a different MAC address per network.

Exam tip The goal is privacy: network operators and passive observers can't link the device across networks or over time.

Fixed, Rotating, or Off

Newer releases (iOS 18 and later, macOS 15 and later) offer three settings per network.

• Fixed: one private address that doesn't change on that network. Default for WPA2 or stronger networks
• Rotating: a new private address about every two weeks. Default for open or weak networks
• Off: the hardware MAC address is used
• Erasing the device or resetting network settings gives a new private address next time; so does forgetting the network, unless it was last forgotten less than 24 hours earlier (iOS 18 and later)

Exam tip Older iOS versions show a simple Private Wi-Fi Address on/off switch. Same idea, fewer choices.

Where the switch lives

Open Settings > Wi-Fi, tap the Info button next to the network, then Private Wi-Fi Address: choose Off to use the hardware address, or Fixed or Rotating to resume using a private one. The device rejoins the network with the new address. The setting is per network, so turning it off for KC-Shop doesn't affect other networks.

Exam tip On Mac: System Settings > Wi-Fi > Details for the network > Private Wi-Fi Address.

When to turn it off

Turn it off only for networks that depend on recognizing a device: MAC address filtering (allow lists), DHCP reservations, network access control, or parental controls and monitoring tools. The better long-term fix is for the network admin to stop relying on MAC addresses, or for MDM to turn off the private address in the managed Wi-Fi payload for that network.

Dev: I know, I know. I'll replace that router with 802.1X. Next budget.

Ranger: skeptical stare

Inside a network's Info screen (iPhone, iPad)

Tap the Info button next to a network to see and change:

• Auto-Join: join this network automatically when in range
• Low Data Mode: apps cut background data, useful on hotspots
• Limit IP Address Tracking: hides the IP address from known trackers in Mail and Safari
• Configure IP: Automatic (DHCP), Manual or BootP; shows IP address, subnet mask and router
• Configure DNS: Automatic or Manual servers; HTTP Proxy: Off, Manual or Automatic
• Forget This Network: removes it and its password

Network-wide choices and the Mac

On the main Wi-Fi screen, Ask to Join Networks (Off, Notify, Ask) and Auto-Join Hotspot (Never, Ask to Join, Automatic) control how the device finds new networks. On Mac, System Settings > Wi-Fi > Details for a network adds tabs for TCP/IP, DNS, WINS, 802.1X, Proxies and Hardware (MAC address, MTU), plus Low Data Mode and Limit IP Address Tracking. Known networks can be edited or removed there.

Exam tip Manual DNS or proxy settings left over from another site are a classic cause of "connected, but nothing loads".