A library kiosk is configured to auto-join the strongest SSID named LibraryGuest. Why does that increase evil-twin risk?
Select an answer to reveal the explanation.
Short Explanation
The kiosk is loyal to a name, not a badge. Spoof LibraryGuest louder than the real AP and the auto-join habit does the rest. Preferred networks without pinning are an open invitation.
Full Explanation
A library kiosk configured to auto-join the strongest SSID named LibraryGuest increases evil-twin risk because preferred-network and auto-join policies select among matching SSID names largely by signal and local policy, not by cryptographic proof of the legitimate access point's identity. An attacker or unauthorized lookalike that spoofs the same name with stronger RSSI can attract unmanaged auto-join clients without needing the user to tap Connect. Auto-join does not encrypt traffic with WPA3-SAE regardless of which AP is selected; encryption and authentication depend on the BSS configuration the client actually joins. Kiosks do not ignore SSIDs that match preferred lists—those lists are exactly what drives opportunistic association. Auto-join is a Wi-Fi client behavior, not an Ethernet-only feature. Exam caveat: SSID name matching without server or AP identity binding is a classic evil-twin success factor on guest and kiosk fleets. Operational check: inventory municipal kiosk preferred-network lists, prefer managed profiles that pin expected security modes, and validate in an authorized lab whether a stronger spoofed LibraryGuest attracts the device. For municipal and campus engagements, keep the finding language tied to authorized scope, name the building or SSID class affected, and state the residual risk to residents or staff if the rejected option had been chosen. Re-validate after the next change window that the selected control still matches inventory, monitoring, and RoE abort criteria used by the city wireless program.