Wi-Fi Security Still Spotty

Don't Assume WPA

Technically, WPA is not part of the 802.11g standard, but in September 2003 the Wi-Fi Alliance began making WPA support a requirement for most products to pass 11g certification tests.

But 802.11g certification is no guarantee of WPA compliance. That's because products submitted for testing before last September--including the Microsoft MN-700--were exempt from the Wi-Fi Alliance's WPA requirement.

Other name-brand Wi-Fi products we tested were also certified for 802.11g but not WPA. Still, most managed to work together with WPA enabled. The only exception, besides the Microsoft MN-700, was IOGear's GWA 501 access point/router, which is not Wi-Fi-certified for anything. It did establish WPA connections with four cards and three notebooks; but it failed with two other cards and five other notebooks we tested, including two using the Wi-Fi chip in Intel's Centrino mobile technology.

How important is Wi-Fi certification? Corporate IT departments generally demand it, but it appears to be less important to small businesses and to home users. So some vendors, such as IOGear, skip certification altogether, while others begin selling a product before it has been certified, assuming that it will pass later on. Netgear's new WGT634U Wireless Media Router, for example, has been on the market since April but was still awaiting certification at press time. The Wi-Fi Alliance, however, says that about one in four products fail the test on their first attempt, mostly because of WPA glitches.

Regardless of the equipment you have, you can increase its chances of working with other products by installing the manufacturer's latest drivers and firmware and Microsoft's latest updates. The original Windows XP update adding WPA capabilities had bugs that sometimes killed connections. Go to this link for the fix.

WPA-certified products may be hard to find in certain categories. That's because WPA wasn't required for 802.11a products (including 11a/11g combos) until October of last year--and even then it was required only for basic equipment such as access points, access point/routers, notebook and desktop cards, and notebooks with built-in wireless.

For devices such as media receivers, printers, print servers, PDAs, and ethernet-to-wireless bridges, WPA wasn't required for Wi-Fi certification until late January 2004. Few current devices support WPA, certified or otherwise, though most do offer WEP (Wired Equivalent Privacy), its weaker predecessor. A few access points, such as those from SMC, can support both WPA and WEP clients simultaneously. But in that case, a hacker could access the network by cracking the weaker WEP encryption. And if your access point doesn't support both encryption schemes simultaneously, you'll have to use WEP unless all of your equipment supports WPA.

Bottom Line: WPA provides strong security for wireless networks, but be sure that you buy the latest Wi-Fi-certified products to avoid incompatibilities. Products on the Wi-Fi Alliance's certified list are the safest; contact the vendor if you're in doubt. And be prepared to wait anywhere from several months to as long as a year for specialty equipment with WPA certification to become widely available.