Security on a repeated network

A repeated network is as secure as its weakest key and its least-protected configuration page. The link from a phone to the extender is encrypted with the extender’s key; the link from the extender to the router is encrypted with the router’s. The extender holds both, so anyone with control of the extender’s configuration page has a foothold on the network. The password to that page, printed on the unit from the factory, is the credential that deserves the most attention and gets the least.

Wireless security encrypts the air between a device and the access point it is attached to. Everything a phone sends is scrambled with a key derived from the network passphrase before it leaves the phone, and unscrambled by the access point on arrival. In a household with an extender, a phone in the far room is attached to the extender, so its traffic is encrypted for the extender, with the key the extender publishes.

The extender is in turn attached to the router as a client, and everything it forwards is encrypted again, for the router, with the router’s key. Two links, each protected, each with its own key. Under the one-name arrangement the two keys are the same value; under the two-name arrangement they may differ, and an owner who has given the extender a simpler key than the router’s has made the far end of the house easier to join than the near end.

Because the two links use different keys, the extender cannot simply pass frames through. It unscrambles what arrives from the phone, holds it briefly in plain form, and scrambles it again for the router. The same happens in the other direction. The extender therefore sees everything that crosses it, in the same way the router sees everything that crosses the router. That is inherent in being an access point, and it is why the unit’s own security matters as much as the keys.

Every extender has a configuration page, served by the unit itself and reachable from inside the network. The local setup address describes how it is reached and why it cannot be reached from outside. It is protected by a password that has nothing to do with any wireless key: it is the unit’s administrator credential, and it is often left at the value printed on the label.

Anyone who can join the network and knows that value can open the page, read the stored network name, sometimes read the stored key, change the name and key the extender publishes, and alter its settings. On a network shared with lodgers, guests or a workplace, the printed default is the weakest point in the whole arrangement, and it is the one item on the unit that an owner sets once and never has to think about again.

A network key is what a device needs to join; the administrator credential is what a person needs to change the unit. They are different secrets, protect different things, and are worth keeping different.

Consumer wireless security has passed through generations, each replacing a weaker predecessor. The current one, WPA3, resists offline guessing of the passphrase in a way its predecessor WPA2 does not, and it does not carry the WPS mechanism. An extender takes part in whichever generation its firmware provides, on both of its links.

That has a consequence for the router’s settings. A router configured to accept only WPA3 will refuse an extender that speaks only WPA2, exactly as it would refuse an old laptop. Most routers offer a transitional mode that accepts both generations on one network, which is the mode an older extender can join; the price is that the network is only as strong as the older generation for any device using it. The same applies on the far side: the extender publishes its own network under the generation its firmware provides, whatever the router does.

Many routers publish a second network for visitors, kept apart from the household’s own devices so that a guest’s phone cannot see a resident’s printer or media server. That separation is enforced inside the router. An extender paired to the main network repeats the main network, and a guest who joins the extender’s network is on the main network with everything on it, whatever the router’s guest settings say.

Some extenders can repeat the guest network as well, or publish a guest network of their own; whether a given unit can is stated in its documentation. Where an extender cannot, the far rooms have no guest network, and the household’s choice is between giving visitors the main key or no coverage there.

Outward, nothing. The extender is a client of the router, sits behind the router’s firewall like any other device, and offers no service to the internet. Its configuration page answers only to devices already inside the network. No party outside the building can reach it, configure it, or read from it, and any offer to do so by telephone or through a website is describing something the equipment does not permit.

Inward, it adds one thing to the household’s exposure: a second access point with its own key and its own administrator password, both of which need to be as good as the router’s. Kept that way, a repeated network is no less secure than the network it repeats. Firmware from the maker addresses weaknesses found after a unit shipped, and a unit that has not been updated in years is running whatever was known then.