During an authorized county Wi-Fi assessment, an assessor considers uploading captured handshakes to a third-party cloud cracking service for speed. What concern should stop that move without explicit approval?

During an authorized county Wi-Fi assessment, uploading captured handshakes to a third-party cloud cracking service for speed can violate rules of engagement and privacy obligations because handshake material embeds client cryptographic evidence from municipal users. Civic assessors should keep cracking on approved, assessor-controlled systems unless the client explicitly authorizes a named processing path. Speed never outranks authorization and privacy.

'Cloud services refuse WPA2 handshakes and only accept WEP IVs' fails because cloud services are not limited to WEP IVs; the issue is authorization and privacy, not format refusal. 'Cloud cracking always invalidates the cryptographic strength of AES-CCMP itself' fails because using a cloud cracker does not cryptanalytically invalidate AES-CCMP itself. 'OffSec-style methodology forbids any GPU use even on assessor-owned hardware' fails because OffSec-style methodology does not forbid GPU use on assessor-owned hardware.

Exam caveat: even anonymized-looking captures can still be sensitive—ask before any third-party processing. Operational check: crack municipal captures on engagement-approved hosts, record where hashes were processed, and obtain written approval before any cloud upload. If denied, use local GPU/CPU capacity and adjust timeboxes accordingly. In municipal wireless operations, record the rationale in the engagement notes so future assessors know which control or technique class was chosen and which failure modes the rejected options would create for city services.