A county transit hub wants a password-free public SSID that still protects riders from casual passive sniffing on the RF. Which encryption approach should the architect select?
Select an answer to reveal the explanation.
Short Explanation
Public Wi-Fi without a password used to mean anyone with a sniffer could read the air like an open postcard. OWE puts opportunistic encryption on that open SSID so casual eavesdropping gets much harder—no shared passphrase required. Portals and old WEP/TKIP tricks are not the modern answer.
Full Explanation
A county transit hub that needs password-free public Wi-Fi while reducing casual passive sniffing should select Opportunistic Wireless Encryption (OWE). OWE keeps onboarding open from a passphrase perspective yet establishes individualized encryption so riders are not broadcasting clear RF postcards to every nearby sniffer on the platform. That matches civic guest and transit designs where distributing a shared PSK is impractical, unscalable, or actively harmful when posted in public view. WEP with a key posted on the departure board recreates a public shared secret and inherits WEP’s fatal cryptographic weaknesses. TKIP-only WPA prioritizes obsolete compatibility over current encryption practice and still depends on weak transitional cryptography unsuitable for a modern hub. Relying on fully open authentication with no opportunistic encryption and hoping riders use only HTTP—or even application HTTPS alone—leaves link-layer frames exposed to passive capture between the phone and the AP. Exam caveat: OWE is not a substitute for authenticated Enterprise access to staff or operations systems; it addresses open/public confidentiality, not identity-bound authorization onto transit back-office VLANs. Operational check: stand up a pilot OWE SSID in a non-production RF cell, associate a modern phone, and confirm unicast frames are encrypted in a protocol capture while still requiring no shared passphrase at join time, then document client exceptions before hub-wide enablement.