A library board wants a password-free ‘open’ municipal SSID that still encrypts airtime against casual sniffing. Which control should the WLAN designer select?
Select an answer to reveal the explanation.
Short Explanation
OWE is the ‘open door with a privacy curtain’—no password to remember, but the session still gets encrypted. Plain open Wi-Fi is a postcard anyone can read, and WEP is a broken lock you should not put back on a library network.
Full Explanation
Enabling Opportunistic Wireless Encryption (OWE) on the public SSID is the best choice for a library board wanting a password-free network that still encrypts airtime against casual sniffing. OWE provides unauthenticated encryption by performing a Diffie-Hellman key exchange during association, creating a unique encryption key per client without requiring a shared password. This protects against passive eavesdropping on Wi-Fi frames, improving privacy over fully open networks. Leaving the SSID fully open with no encryption relies solely on higher-layer protocols like HTTPS for confidentiality, but wireless frames remain unencrypted, exposing metadata and traffic patterns to passive attackers. Mandating WEP-40 is insecure and deprecated; WEP is easily cracked and should never be used, regardless of user convenience. Bridging patron clients onto the staff VLAN with the same open SSID risks exposing sensitive internal resources and violates network segmentation best practices. It is important to recognize that OWE does not provide authentication or access control, so additional mechanisms like captive portals may be necessary for policy enforcement. Practically, the WLAN designer should verify that client devices support OWE and that the SSID advertises it properly, ensuring encrypted associations without user passphrases.