A city attorney asks whether choosing a long, complex passphrase makes WEP acceptable for a remaining legacy SSID. What is the correct guidance?
Select an answer to reveal the explanation.
Short Explanation
Putting a fancier combination on a broken padlock doesn't weld the shackle shut. WEP's problems are in the crypto design — a long passphrase is a myth of safety, not a fix.
Full Explanation
WEP’s structural IV and RC4 weaknesses are not remediated by choosing a long, complex passphrase. City attorneys evaluating a remaining legacy SSID should hear clear guidance: passphrase-length myths do not make WEP acceptable, and the control remains cryptographically broken for municipal use. Migration away from WEP is the remediation, not creative password policy on a failed cipher. Claiming any passphrase over twenty characters fully remediates WEP’s IV design flaws is false. Saying WEP becomes equivalent to WPA3-SAE when symbols are included conflates incompatible designs. Asserting passphrase length matters only on 5 GHz WEP which was never broken invents a band-limited exception that does not exist. Exam caveat: Do not trade WEP findings for “but the password is long” exceptions in reports. Operational check: Confirm WEP in beacons for the legacy SSID, capture authorized evidence, and recommend an isolated upgrade path rather than passphrase hardening alone. In civic WLAN stewardship, keep authorization boundaries explicit, prefer the least disruptive technique class allowed by RoE, and record BSSID, channel, band, and security mode beside every conclusion so another assessor can reproduce the observation.