A municipal open guest SSID provides no OWE and no other Layer-2 encryption. What threat should policy and design explicitly recognize?
Select an answer to reveal the explanation.
Short Explanation
Open Wi-Fi without OWE is a postcard—anyone nearby can read the traffic that isn’t wrapped higher up. Call eavesdropping by its name in the threat model and fix it with encryption (OWE or better architectures), not wishful thinking about MAC tricks.
Full Explanation
A municipal open guest SSID with no OWE and no other Layer-2 encryption exposes 802.11 data frames to nearby observers. Policy and design must explicitly recognize that eavesdropping risk: unless Opportunistic Wireless Encryption or another encryption mode protects the BSS, passive capture of guest traffic is feasible on the air. Civic plazas and libraries that advertise free Wi-Fi without encryption therefore need honest threat language and compensating controls such as HTTPS guidance and client isolation—not pretend immunity.
Claiming open SSIDs are immune because HTTP is rare ignores remaining cleartext, misconfigured apps, and metadata exposure and still fails Layer-2 confidentiality. Asserting that only evil-twin attacks matter while passive sniffing is “impossible” is false. Believing MAC randomization alone encrypts guest frames confuses privacy of identifiers with confidentiality of payloads.
Exam caveat: OWE (“enhanced open”) encrypts the air without a shared password but is not a substitute for user education about phishing portals or for segmentation from staff VLANs. Operational check: confirm whether the guest BSS advertises OWE or another encryption mode; if open/clear, document eavesdropping risk in policy and verify client isolation plus portal guidance are in place.