Why is “Allow WEP networks” on by default?

Xtreix

nandohyphen1 This might have something to do with Google's advanced protection, since I've never used it, I haven't noticed any changes. For me, WEP has always been disabled. Or maybe I disabled it a long time ago and I don't remember.

nandohyphen1

Xtreix so it should be fine to disable then?

Xtreix

nandohyphen1 Fine in what sens ? Will the option remain disabled ? I don't know, as I wrote, I don't remember ever seeing this option enabled, but maybe I disabled it without remembering. I checked and WEP was indeed disabled, so I don't understand what's going on.

In any case, disable WEP. I see no reason to allow an unsecured protocol type for Wi-Fi.

1qkv9ddu3so2irvz

2G mobile network is also enabled by default right? Also strange.

IcyScroll

1qkv9ddu3so2irvz I believe that's purely for compatibility in all regions of the world. By default things shouldn't be breaking basic functionality. If a user doesn't disable 2G or enable LTE/5G only they likely wouldn't be able to navigate these settings properly when their "phone stops working".

IcyScroll

I'm pretty sure WEP is indeed enabled by default and I left it this way.

I don't think it matters that much. My guess is that WEP is not much worse than open WiFi networks which are fine most of the time. The worst thing that comes to mind is WEP giving user a false sense of security. And maybe increased amount of malicious actors present on a network. Not more than on unprotected WiFi networks, though.

Fay_Wilmont

I'd like to add that I just installed GrapheneOS (Android 16 release) the same week I reported this, therefore I'm 100% sure I didn't enable it myself. Should've included this in my initial post.

Probably9857 From what I can find, it looks like this toggle was introduced in A15, at which time the default was supposedly off.

In A16, one of the "features" of Advanced Protection mode is preventing WEP connections. Hmm...interesting idea to weaken default security and then call the previous default "advanced".

I assume the default was inherited from upstream and no one noticed.

Nice observation/digging, thanks! From my short time playing around with my Pixel's stock firmware on the first Android 16 update I seem to remember this Advanced Protection mode was on by default, so there is not really anything "interesting" about this; if you and I are correct, disallowing WEP networks was and remains the default. Not so on GrapheneOS though...

wuseman I don’t really see a point in having it disabled. You’d be hard pushed to find a WEP network in the first place.

You'd be hard pushed to find rental cars with a dummy brake pedal too, but if someone is out to kill you, you might just find yourself ending up in one... meaning an adversary may create a WEP protected network and trick their target into connecting to it.

mrn

Indeed, it's enabled by default on GrapheneOS, I always disable it.

mrn

wuseman
It's exactly the kind of thinking that will get you in danger.
The correct thinking is "it's so rare that the only networks that still use it might have been set up by attackers".

GrapheneOS

Probably9857

From what I can find, it looks like this toggle was introduced in A15, at which time the default was supposedly off.

What are you basing this on? Why do you think it was off by default?

In A16, one of the "features" of Advanced Protection mode is preventing WEP connections. Hmm...interesting idea to weaken default security and then call the previous default "advanced".

What's your source for it being off by default before Android 16?

Probably9857

GrapheneOS

News sites were reporting that during the A15 beta, and I never saw anything contradicting it. For example,

By default, Android 15 Beta 1 blocks connections to WEP networks.

https://www.phonearena.com/news/android-15-looking-to-enhance-wifi-security-with-a-new-toggle_id157275

However, I realize (and did when I wrote that post) that this could have changed prior to release, or the news articles themselves may not be reliable.

Hence my use of "from what I can tell" and "supposedly".

I apologize if that was misinformation.

GrapheneOS

Fay_Wilmont Wi-Fi networks shouldn't be trusted. Joining a public network using WPA3 instead of WEP doesn't make much difference. There's often no client isolation and even if there is that shouldn't be relied upon. The OS assumes the network is malicious and trying to monitor or manipulate traffic. Nearly all apps use authenticated encryption for their connections. Unencrypted connections are disabled by default for apps and they need to opt-in to having them. Wi-Fi network security is something you may be concerned about for your own network where you have devices unwisely trusting the local network but is not something requiring much thought from a GrapheneOS device. Users are expected to be joining untrustworthy networks with untrustworthy devices. Whether or not joining a WEP network is allowed by default doesn't matter much. Joining a coffee shop Wi-Fi network with WPA3 with a publicly posted password and no client isolation is pretty much the same as joining an unencrypted or WEP network. WEP is also not worse than unencrypted, just similar to it.

Fay_Wilmont

GrapheneOS Exactly the kind of explanation I was looking for but failed to come up with myself, thank you!